Legal

Privacy Policy

This policy explains what ShotAPI stores when you use the rendering API and the public website. Last updated 22 October 2026. Operator: 禧柱 于 (Abalam-Yu). Contact yu609659349@gmail.com.

Who we are

ShotAPI is operated by 禧柱 于 (Abalam-Yu), an individual seller. For privacy requests, email yu609659349@gmail.com. The public site and API are hosted on Vercel.

What we collect

We keep the data needed to authenticate a key, count usage, and apply a paid plan.

• API key records: an id, a display name, a prefix, a hash of the secret, the plan, and the time the key was created. The plaintext secret is not stored after it is shown once.
• Usage: a monthly count and byte total, plus a short event with the format, whether the source was a URL or HTML, the HTTP status, the byte size, and how long the render took. We do not store the URL, the HTML body, or the rendered file.
• Billing identifiers, when you pay: the billing provider, and the customer id and subscription id that provider sends us. We also send the API key id to that provider as checkout metadata so the webhook can find the key.
• Operational logs: request ids and error messages. Logs are for debugging and are not a customer database.

The marketing site does not run advertising cookies and does not ask you to create an account. The API is called with an Authorization header or X-API-Key, not a browser session.

Payments

Card details are entered on the merchant of record's checkout page. Creem is the primary live processor. Stripe may be used in sandbox mode. Paddle may be added later. Those companies receive the payment data you submit to them, and they send us a webhook with the result, their customer id, and the key id we attached. We do not receive your full card number. Their privacy notices govern what they do with payment data.

Why we use it

• To authenticate requests and enforce the monthly quota.
• To turn a paid subscription on or off for the key that started checkout.
• To keep the service reliable, investigate abuse, and fix failures.
• To meet tax, accounting, and dispute duties that apply to the operator or the merchant of record.

We do not sell personal information. We do not use render contents to train models. We do not build advertising profiles.

Who else processes it

• Vercel hosts the application and may process request metadata as our infrastructure provider.
• Upstash Redis stores key and usage records when it is configured. Without it, usage may stay in memory on the server and disappear when the instance stops.
• Creem, Stripe, or Paddle, when that provider is the one configured for checkout.

A render fetches the URL you submit, or loads the HTML you submit, inside a browser we operate. That request is visible to the site you asked us to capture. We do not forward your API key or cookies to that site.

How long we keep it

Key and usage records are kept while the key exists. Email yu609659349@gmail.com to ask us to delete a key. We will remove our copy of the key record and its usage. Billing identifiers may be retained for as long as the merchant of record, tax rules, or a payment dispute requires. Server logs are kept for a short operational period and then discarded by the host.

International transfers

The operator is an individual in mainland China. Hosting, Redis, and payment processors may store data in other countries, including the United States and the European Union. Those processors act under their own terms and data-processing commitments.

Your requests

Depending on where you live, you may have the right to access, correct, or delete personal information we hold, or to object to a particular use. Email yu609659349@gmail.com with the key prefix (not the full secret) and the email you used at checkout. We may need to confirm that you control the key. Payment records held only by the merchant of record have to be requested from them as well.

The service is not directed at children under 16, and we do not knowingly collect their personal information.

Changes

We will post changes on this page and update the date above. A change that materially expands what we collect will be reflected here before we rely on it for new processing.