Privacy
What our free public REST APIs record, how long it stays, and who else sees it. Written from the service source rather than from a template, so it describes this system and not a generic one.
Last updated 16 August 2026.
Who is responsible
AI SENSE AS, Postboks 1202 Vika, 0110 Oslo, Norway. Org.nr NO 922 601 151 MVA. Contact support@aisense.no for anything on this page.
The short version
There are no accounts, no API keys and no sign-up, so we hold no name, email address or payment detail for anyone using the free APIs. We set no cookies and run no analytics, advertising or tracking scripts. What we do record is the technical detail of each request, because a public service has to be able to see its own traffic.
What we record
Every request
One line in a server log: the time, your IP address, the HTTP method, the full path you requested, the protocol, the content type and your browser or client's User-Agent string.
The path includes anything you put in it. Several endpoints take their input in the URL rather than in a request body - /url_shortener/{url} receives an entire target address, /ip_reverse_lookup/{ip} an IP address, /domain_ip_lookup/{domain} a domain name. Those values are written to the log along with the rest of the line. Do not put anything sensitive in a URL, here or anywhere else.
Rate limiting
We count requests per IP address to enforce the published limit of 5000 per 24 hours. The counter is stored against the address.
What you send to the storage endpoints
Four endpoints exist to hold data briefly, and they hold exactly what you give them:
| Endpoint | What is stored |
|---|---|
/storage | Your request body, byte for byte, unchanged |
/url_shortener | The address you asked us to shorten |
/webhook_capture | The complete inbound request, including all headers and the sender's IP |
/webhook_action | The form you defined and the answer someone submitted to it |
Webhook Capture deserves particular attention. It records every header a caller sends, and services that post to webhooks routinely include authorisation tokens and signatures in those headers. If you point a third-party service at a capture URL, its credentials will sit in our storage for 24 hours. That is the endpoint working as intended, but you should know it before you use it.
What we do not do
No cookies from the API. No analytics, no advertising, no fingerprinting, no profiling, no automated decision-making. We do not sell or rent anything to anyone. We do not attempt to identify who you are, and without accounts we generally cannot.
IP geolocation via /ip_reverse_lookup runs against database files on our own server. The address you look up is not sent anywhere.
How long we keep it
| Data | Kept for |
|---|---|
| Storage, URL shortener, webhook capture, webhook action | 24 hours, then it expires |
| Rate limit counters | Rolling 24 hours |
| Server access logs | 14 days |
| Machine-access audit log | 12 weeks |
The 24-hour expiry means the data becomes unreachable - no request will return it. Purging of the underlying storage happens on the same schedule as the log rotation above.
Where data goes
Four endpoints have to ask someone else a question in order to answer yours. Only the value you supplied is passed on:
| If you call | We ask | And send |
|---|---|---|
/bitcoin/balance/{address} | blockchain.info | The wallet address |
/solana/balance/{address} | api.mainnet-beta.solana.com | The wallet address |
/ethereum/balance/{address} | ethereum-rpc.publicnode.com | The wallet address |
/url_shortener/{url} | 307.fi | The address being shortened |
These are the only third parties involved. Nothing else leaves our servers.
Calls from other websites
Our API responses permit cross-origin requests from any website, which is what makes the endpoints usable directly from browser JavaScript. A consequence worth stating plainly: if a site you visit calls our API from your browser, your IP address reaches us and is logged, even though you never visited us. We have no way to know which site that was, and we do not receive a referrer for it.
Your rights
Under the GDPR you may request access to personal data we hold about you, its correction or erasure, a restriction on how we use it, or a copy of it - and you may object to our use of it. Write to support@aisense.no.
One practical limit, stated because it is true rather than to avoid the obligation: log entries and rate-limit counters are stored by IP address and nothing else. If you ask us to find your records, an IP address is all we can search on, and shared or dynamic addresses mean we may not be able to distinguish your requests from someone else's. Data you stored through /storage is different - quote the storage_id and we can act on it precisely, though it will have expired within 24 hours anyway.
You may complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no.
Why we are allowed to do this
We rely on legitimate interest for the technical logging and rate limiting described above: operating a public service, keeping it available, and investigating abuse and faults. The data is limited to what those purposes need and is not used for anything else. Where you send us content deliberately - anything you post to the storage or webhook endpoints - you are asking us to hold it, and we hold it only for as long as stated.
Security
All traffic is served over HTTPS. The service holds no credentials belonging to you, because it issues none. Data stored through the temporary endpoints is addressed by a random UUID that only you receive - treat that identifier as a secret, since anyone holding it can retrieve what you stored.
Changes
When the service changes, this page changes with it. The date at the top is the last time it was checked against what the code actually does.