GDPR Privacy Information

Scope and Controller

Onur Öztürk, a sole proprietor trading as Ozan Soft and the publisher of GenderAPI, is the controller for the personal-data processing described here. Full identity and contact details appear below.

Data We Process

• Account data: information voluntarily supplied for an account, purchase or support request.
• Successful API queries: processed to return a result and, under the published policy, not retained as reusable query records; technical and security logs follow a separate schedule.
• Email queries: not retained as reusable query records under the published policy; technical and security logs follow a separate schedule.
• Unresolved queries: the published policy permits only unresolved non-email queries to be retained for coverage improvement, subject to the bounded retention and rights terms below.
• Excel and CSV files: the published policy schedules removal from active systems within five days and offers earlier active-workspace removal after export; backup overwrite is separate.
• Google Sheets data: processed in real time and not stored or logged.

Purposes and Legal Bases

Query, account and purchase data is processed as necessary to provide the requested service and perform our contract with you. Billing records may also be processed to comply with accounting and tax duties. Security logs are processed for our legitimate interest in protecting the Service and its Users. Unresolved non-email queries may be processed for our legitimate interest in improving result coverage, balanced against the limited data, access controls, retention period and rights described on this page. Where processing relies on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

Account and payment information is required where you choose to create an account or purchase a plan. If it is not provided, we may be unable to create the account, complete the purchase or provide the related service. Optional analytics is not required to use the Service.

Retention

Successful query inputs are not retained as reusable query records. Technical and security logs are governed separately. Unresolved non-email queries may be retained for up to 12 months for product improvement and then deleted or irreversibly anonymized. For Excel and CSV files, the published policy schedules active-system removal within five days and offers earlier workspace removal after export; rolling backups may persist for up to 15 additional days.

Account data is retained while the account is active and is deleted or irreversibly anonymized within 30 days after closure or an approved deletion request, unless an exception applies. Support communications may be retained for 24 months after closure, and security or technical logs for 90 days.

Billing and transaction records may be retained for up to seven years where needed for accounting, tax, chargeback or fraud-prevention obligations. Data removed from active systems may remain in access-restricted rolling backups for up to 15 additional days. A longer period applies only where required by law or necessary for a legal claim, fraud inquiry or security investigation. See the complete schedule in our Privacy Policy.

Recipients and Processors

GenderAPI does not sell or rent personal data. Query inputs and Excel, CSV, Google Sheets or Microsoft Excel data are not disclosed for advertising or another company’s independent use. They may be processed by Cloudflare and on DigitalOcean infrastructure as necessary to transmit, secure, host and operate the Service. Automated inference runs on a private GenderAPI-operated AI server; query inputs are not sent to a third-party AI provider, used for model training or retained in AI logs.

Cloudflare provides network delivery and security; DigitalOcean provides United States hosting; iyzico processes card payments; Binance supports cryptocurrency transaction verification; Twilio SendGrid sends transactional account emails; Google Workspace/Gmail and Chatra provide manual support channels; and Google Analytics, Google Tag Manager and Google Ads provide consent-based measurement and conversion functions. Each provider receives only the categories needed for its contracted purpose.

The primary hosting region is in the United States. Other providers may also process information outside Türkiye, the EEA or the User’s country. Where GDPR restricted transfers apply, GenderAPI relies on the provider’s applicable adequacy framework, including the EU-U.S. Data Privacy Framework where available, or contractual safeguards such as the European Commission’s Standard Contractual Clauses, with additional measures where required. You may request information about the safeguard applicable to your data by contacting us.

Information may also be disclosed where required by applicable law or valid legal process, or where necessary to protect Users, GenderAPI or the public. Details about the categories of processing appear in the Privacy Policy.

Where GenderAPI processes personal data on a customer's behalf, the Data Processing Agreement and current Subprocessors register provide the applicable processor terms and provider-change procedure.

Your GDPR Rights

Subject to applicable conditions and exceptions, you may request information and access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent and lodge a complaint with the data protection authority in your habitual residence, place of work or place of the alleged infringement.

GenderAPI returns probabilistic inference results. It does not use query results to make decisions that produce legal or similarly significant effects about an individual. Customers determine how they use the results and must not rely on them as the sole basis for consequential decisions.

Exercise Your Rights

Email support@genderapi.io. We may request information needed to verify identity. GDPR requests are handled without undue delay and generally within one month, subject to legally permitted extensions or exceptions.