← Back to Holistic Quality

Data Policy

Version 2.0 · Last updated: 2026-10-18

Correction, 18 October 2026. The international-transfers paragraph below had said that the 2021 Standard Contractual Clauses are incorporated by reference in each subprocessor's Data Processing Addendum. Not every Addendum does: some apply the clauses only to a transfer that needs them. The paragraph now says so.

Correction, 8 October 2026. The subprocessor list below now names Google Workspace, which hosts our own mailbox and the form behind the site feedback widget, and says that Resend also sends the contact-form email and the guide email series. Both were existing recipients that the list had left out.

Correction, 29 September 2026. We corrected this page to describe what our systems actually do. It had said that API keys were stored hashed, that stored data was encrypted at rest by our database provider, that only shortened IP addresses were kept and that query parameters were never logged, and it gave backup and after-cancellation retention periods that the code does not follow and did not say how long watchlists, webhooks and the Stripe customer reference are kept. We also removed statements we could not check. On the same date, erasure was changed so that it also deletes keys deactivated before the request and reports an erasure it could not finish, watchlists, webhooks and daily RapidAPI counts now expire (if setting an expiry ever fails, a cleanup we run at every deploy sets it, or deletes the record if it should already have expired), and two application log lines stopped recording which record was requested.

This policy explains how Holistic Quality LLC ("HQ," "we," "us") collects, uses, stores, and deletes data across the HQ ecosystem, including holisticquality.io, aletheia.holisticquality.io, api.aletheia.holisticquality.io, safety.holisticquality.io, dimensionalliteracy.org, csl.dimensionalliteracy.org, and related support flows. It is the controller-level source of truth for privacy claims made across our public properties. Where the ALETHEIA website privacy notice or API-served privacy pages provide additional implementation detail, those details must remain consistent with this policy on controller identity, retention, subprocessors, rights, and contact information.

The Short Version

We collect the minimum data required to operate the service. We do not sell it, share it with advertisers, or build profiles on you. Your API usage is yours. Some of what you send us is stored because it is what you ask us to keep: your email address (for a trial, a paid key, key recovery or an erasure request), the record IDs you save to a watchlist, your webhook registrations, enterprise-inquiry messages (kept 30 days), and the email address you give for a free guide or on the contact form (kept 30 days and 24 hours respectively, only to avoid sending twice; a guide request also keeps the schedule of its follow-up emails for 30 days). If you unsubscribe from any of our emails, we keep a record of that (see the retention table). Our hosting provider also logs the path of every request, which names the record requested (see below). We do not use your requests for advertising, model training, or competitive profiling.

Scope and Roles

Holistic Quality LLC is the data controller for the customer and visitor data described in this policy.

What We Collect

For direct-issued ALETHEIA trials and subscriptions:

API request metadata (collected for every call):

Our hosting provider (Vercel) logs every request: the time, the request path including any query parameters, the HTTP status code, your full IP address and your User-Agent. These logs are kept for 30 days. Our own database keeps, for each API key, the time it was last used and the IP address it was last used from, truncated to a /24 subnet for IPv4 (e.g., 203.0.113.0) or a /112 subnet for IPv6; that record is deleted after 90 days. These records are used for rate limiting, abuse detection, security and debugging, and never to profile you or anyone else.

For website visitors:

What We Do Not Collect

How We Use Data

Legal Bases for Processing

For users located in the European Economic Area, the United Kingdom, and other GDPR-aligned jurisdictions, we process personal data under the following lawful bases (GDPR Art. 6):

How Data Is Stored and Shared

Core ALETHEIA account and key records are stored in Upstash Redis hosted on AWS eu-west-1 (Ireland). Website and application infrastructure runs on Vercel. Transactional email is sent through Resend. Our own mailbox and the form behind the site feedback widget are hosted by Google Workspace. Payments are processed by Stripe.

Our canonical subprocessor list (all tiers must mirror this exactly):

We do not share personal data with advertisers. We may disclose data to law enforcement or other third parties only when required by law, legal process, or a good-faith need to protect rights, safety, or service integrity.

Regulatory-Currency Data Sources

ALETHEIA checks the California Proposition 65 list automatically each week; the other sources below are consulted when a record is reviewed or corrected. There is no automated monitoring of recalls or enforcement actions. These checks read only public, sanctioned data endpoints under an honest, self-identifying User-Agent, and flag possible changes — they never republish bulk source datasets. Where we surface information derived from these sources, we attribute it as follows. No source listed here endorses Holistic Quality LLC, the ALETHEIA API, or any of our products or findings; attribution does not imply agency endorsement.

Of 7,244 regulatory classifications, exposure limits and reference values on our compound records, and regulatory classifications, restrictions and migration limits on our material records, 3,444 cite a source and 1,063 are archived with a fingerprint and a confirming quote from that source. Automated checks only flag candidate changes; they never set a regulatory value on their own.

International Transfers

Holistic Quality LLC is based in Ohio, USA. Upstash processes API key data in the European Union (eu-west-1, Ireland); the other subprocessors above may process data in the United States or across global networks. Where applicable law requires safeguards for a transfer, we rely on the transfer mechanism in the subprocessor's Data Processing Addendum, including the European Commission's 2021 Standard Contractual Clauses where that Addendum provides for them. Some Addenda apply the clauses only to a transfer that needs them (for Google, where Google has not adopted an Alternative Transfer Solution for the transfer). Per-processor transfer-mechanism status (SCC execution, EU-US Data Privacy Framework participation) is tracked at /api/compliance.

Data Retention

We keep identifiable data only for as long as needed for the specific operational, security, or legal purpose that justified collecting it. This is our canonical retention matrix — all other HQ-ecosystem documents must reference this table exactly.

Data Category Retention Period Legal Basis
Email + API key (active subscription) Key record: up to 2 years after the key was last used (a paid key that is never used: 2 years after it is issued; a trial key that is never used: 14 days after it is issued). The Stripe customer reference, which holds your email, is kept for up to 5 years from checkout while the subscription is active, and 90 days after cancellation. Contract performance (Art. 6(1)(b))
Email + API key (post-cancellation) The key record keeps its remaining time (up to 2 years after the key was last used); cancelling does not shorten it. The Stripe customer reference expires 90 days after cancellation. A verified erasure request deletes both sooner. Legitimate interest: billing reconciliation, dispute resolution (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))
Hosting-provider request logs (Vercel): time, request path with query parameters, status, full IP address, User-Agent 30 days (holisticquality.io, aletheia.holisticquality.io, api.aletheia.holisticquality.io and safety.holisticquality.io) Legitimate interest: abuse prevention, debugging (Art. 6(1)(f))
Per-key last-use record (last-used time; IP address truncated to /24 for IPv4 or /112 for IPv6) 90 days (auto-TTL) Legitimate interest: abuse prevention, debugging (Art. 6(1)(f))
Saved watchlists, webhook registrations (which include the API key they belong to) and webhook delivery logs (the last 50 deliveries) Expire with the API key record they belong to (up to 2 years after the key was last used). If setting that expiry ever fails, a cleanup we run at every deploy sets it, or deletes the record if its key record is already gone. You can delete them sooner (a deleted webhook takes its delivery log with it), and a verified erasure request deletes them Contract performance (Art. 6(1)(b))
Email given for a free guide or on the contact form (duplicate-send check) 30 days (guide, including the schedule of its follow-up emails); 24 hours (contact form); auto-TTL Legitimate interest: not sending the same email twice (Art. 6(1)(f))
Rate-limit counters, and the daily request count kept for each RapidAPI username 24 hours (auto-TTL). If setting a daily count's expiry ever fails, a cleanup we run at every deploy sets it, or deletes the count if its day is already over Legitimate interest: service operation (Art. 6(1)(f))
Unsubscribe record (email address, which emails you left, and when) No expiry, so that the unsubscribe keeps being honoured; an erasure request keeps it Legitimate interest: honouring your unsubscribe (Art. 6(1)(f))
Security audit logs (administrative actions, key rotations and erasures; a key-rotation entry includes the account email and the full IP address) 90 days Legitimate interest: fraud prevention (Art. 6(1)(f))
Trial and reminder-email flags (keyed by email address) 30 days (auto-TTL) Legitimate interest: trial management (Art. 6(1)(f))
Enterprise inquiry data 30 days (auto-TTL) Legitimate interest: sales follow-up (Art. 6(1)(f))
Weekly backup snapshots (API-key, Stripe-customer and webhook records), written to the same Upstash database Each snapshot expires 30 days after it is taken Legitimate interest: disaster recovery (Art. 6(1)(f))
Verified erasure requests Processed without undue delay after verification (typically within 30 days for general requests; California requests under the CCPA follow section 9.8 of the ALETHEIA Privacy Policy); always shorter than the normal post-cancellation window, except where a legal, fraud, or active payment-dispute hold applies GDPR Art. 17 (right to erasure)
Per-client analytics: the daily list of the busiest unauthenticated clients, and the daily count of each client’s rate-limited requests (each client identified by a keyed hash of its IP address or API key) 30 days (auto-TTL) Legitimate interest: to see which clients use the API heavily and may need an API key or a paid plan (Art. 6(1)(f))
Aggregated or anonymized analytics May be retained longer because it no longer identifies a person Not personal data once anonymized

Security Measures

Our sites and the API are served over HTTPS using TLS 1.2 or 1.3. Plain-HTTP requests are redirected to HTTPS, and HTTPS responses carry an HSTS header. API keys are generated with high-entropy cryptographic functions. The key store holds each API key itself, not a hash of it, because requests are authenticated by looking the key up. Administrative actions, key rotations and erasures are recorded in an audit log.

Your Rights

You have the right to access, correct, delete, restrict, object to, or port your personal data, and to lodge a complaint with a data-protection supervisory authority where applicable (GDPR Art. 77).

For direct-issued ALETHEIA accounts: Email privacy@holisticquality.io or use the verified deletion flow:

  1. POST /api/keys/erasure with {"email": "you@example.com"}
  2. Check your email for a 6-digit verification code
  3. POST /api/keys/erasure with {"email": "you@example.com", "code": "123456"}
  4. All account records, API keys (active or deactivated), saved watchlists and webhooks are permanently deleted without undue delay; a record of any email unsubscribe is kept, so that it keeps being honoured. Copies in the weekly backup snapshots expire within 30 days; security audit entries and hosting-provider logs expire on the schedules in the retention table above.

We respond to verified rights requests without undue delay, typically within 30 days of verification (or sooner where required by applicable law). California requests under the CCPA follow the response times in section 9.8 of the ALETHEIA Privacy Policy. If you access ALETHEIA through RapidAPI, rights requests about your RapidAPI account or billing should be directed to RapidAPI first; we will cooperate in good faith on any data we directly control.

Children

The ALETHEIA API is a business-to-business service providing chemical and pharmaceutical safety reference; it is not directed to individuals under 18, and we do not knowingly collect personal data from anyone under 18 in connection with ALETHEIA. If you believe a minor has provided personal data through an HQ-ecosystem property, contact privacy@holisticquality.io and we will investigate and delete it where appropriate.

Changes to This Policy

If we change our subprocessor list, retention windows, legal bases, or data collection practices, we will update this page and the Last updated date above. For material changes that affect your rights, we will notify active direct-issued subscribers by email and post an announcement on our platform at least 30 days before the changes take effect. Historical versions are available on request.

What We Will Never Do

Contact

Privacy matters, data-rights requests, and questions about this policy:
privacy@holisticquality.io

Security vulnerability reports: security@holisticquality.io (or /.well-known/security.txt)
Terms of Service and legal notices: legal@holisticquality.io
API trial and key delivery: api@holisticquality.io
Billing, refunds, and support: support@holisticquality.io
Safety database: safety@holisticquality.io

Holistic Quality LLC · Lebanon, Ohio, USA

#FTP — For The People, Always

Holistic Quality LLC · Ohio, USA

Accessibility

For Regulators Bill of Rights · Engagement Registry · Agency Directory · Verify a Manifest