1. Who is responsible for your data
News Search API, LLC., trading as NovoSenseAI, News Search API, Bellandur, Bangalore, India - 560103 (“we”, “us”), is the data controller for personal data processed through News Search API (newssearchapi.com, the developer console and apis.newssearchapi.com).
For payments, Paddle.com Market Ltd acts as Merchant of Record and is an independent controller of the payment data it collects (see Section 7).
Privacy contact: [email protected]
2. Data we collect
| Category | What | Source |
|---|---|---|
| Account | Email address, name, avatar image URL, internal user ID | GitHub, Google or email magic-link sign-in via our authentication service |
| API keys | Key name, creation/last-used time; the key itself is stored only as a one-way hash | You, in the console |
| API request logs | Timestamp, endpoint, query string (API key redacted), HTTP status, response latency, IP address, user-agent | Automatically, when you call the API |
| Aggregated usage | Request counts per account/key per day/month (no query content) | Derived from request logs |
| Subscription | Plan, billing period, subscription status, Paddle customer/subscription IDs | Paddle, via webhooks |
| Support | Messages you send us and our replies | You |
We do not collect or store card numbers or bank details. We do not intentionally collect special-category data.
3. Why we use it and our legal bases (GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account; sign you in | Account | Contract |
| Issue and authenticate API keys | API keys | Contract |
| Serve API requests, enforce quotas and rate limits | Request logs, usage | Contract |
| Show you your request logs and usage in the console | Request logs, usage | Contract |
| Billing and plan entitlements | Subscription | Contract; legal obligation |
| Security, abuse and fraud prevention, debugging | Request logs, IP, user-agent | Legitimate interests |
| Service emails (security, billing, policy changes) | Contract; legitimate interests | |
| Product improvement using aggregated statistics | Aggregated usage | Legitimate interests |
We do not sell personal data, do not use it for third-party advertising, and do not make decisions with legal effects based solely on automated processing.
4. Retention
| Data | Retention |
|---|---|
| API request logs | For the retention period of your plan, then deleted |
| Aggregated usage | 400 days |
| Account data and API key hashes | While your account is active; deleted within 30 days of account closure unless the law requires longer |
| Subscription records | As required by tax and accounting law |
| Support messages | Up to 2 years after the conversation closes |
| Backups | Overwritten on a rolling cycle of up to 30 days |
If you downgrade, log retention shortens to the new plan’s period.
5. Cookies and local storage
We use only essential cookies and browser localStorage needed to sign you in and keep your session (e.g. authentication tokens and sign-in state). We do not use advertising trackers or third-party marketing cookies. Because these are strictly necessary, no consent banner is required for them; blocking them will prevent sign-in.
Paddle.js. Our pricing and checkout pages load Paddle.js, the script of our Merchant of Record. Paddle may set its own cookies or local storage and collect device and browser data (such as IP address, browser type and approximate location) to show local prices and tax, prevent fraud and process payment. Paddle does this as an independent controller under its own privacy notice (paddle.com/legal/privacy).
If we later add analytics, we will update this policy and ask for consent where required.
6. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud (Google LLC / Google Cloud EMEA Ltd) | Hosting, compute, databases, storage | United States |
| Paddle.com Market Ltd | Merchant of Record: checkout, payments, tax, invoicing, refunds | UK / global |
| Amazon Web Services, Inc. (Amazon SES) | Transactional emails (sign-in links, billing and security notices) | USA |
| GitHub, Inc. / Google LLC | Identity providers, only if you choose to sign in with them | USA |
We will update this list before adding new sub-processors that process personal data.
7. Payments (Paddle)
Paddle collects your payment details, billing address and tax information directly, under its own privacy notice (paddle.com/legal/privacy). Paddle shares with us only what we need to manage your subscription (e.g. email, country, plan, status, transaction IDs).
8. International transfers
Your data may be processed outside your country, including in the USA. Where data leaves the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses (and the UK Addendum) with our providers.
9. Security
- API keys stored only as hashes; keys are redacted from request logs.
- Encryption in transit (TLS) and at rest via our hosting provider.
- Access to production data restricted to authorised personnel.
No system is perfectly secure; we will notify you and regulators of personal data breaches as required by law.
10. Your rights (GDPR / UK GDPR)
If you are in the EEA or UK, you have the right to:
- Access your personal data and receive a copy;
- Rectify inaccurate data;
- Erase your data (“right to be forgotten”);
- Restrict or object to processing, including processing based on legitimate interests;
- Data portability — receive your data in a machine-readable format;
- Withdraw consent where processing is based on consent;
- Complain to your local supervisory authority (e.g. the ICO in the UK or your EU data protection authority).
11. Your rights (California — CCPA/CPRA)
If you are a California resident, you have the right to:
- Know the categories and specific pieces of personal information we collect, the sources, purposes and the categories of third parties we disclose it to (described in Sections 2–6);
- Delete personal information, subject to legal exceptions;
- Correct inaccurate personal information;
- Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising;
- Limit use of sensitive personal information — we do not use sensitive personal information for purposes requiring this right;
- Non-discrimination for exercising your rights.
You may use an authorised agent; we may verify both your identity and the agent’s authority.
12. How to exercise your rights
Email [email protected] from the address on your account. We may need to verify your identity. We respond within one month (GDPR) or 45 days (CCPA), extendable where the law allows. You can also revoke API keys and view your request logs yourself in the console.
13. Children
The Service is not directed to children under 16, and we do not knowingly collect their data. Contact us if you believe a child has provided data to us.
14. Changes to this policy
We will post updates here and update the effective date. Material changes will be notified by email or in the console.
15. Contact
News Search API, LLC. (NovoSenseAI) News Search API, Bellandur, Bangalore, India - 560103 [email protected]