Privacy policy.
This policy explains how AddressDesk processes personal data when you visit our website, create an account, use our address autocomplete and validation services, integrate our JavaScript SDK, or contact us.
1. Data controller
AddressDesk is the service through which we provide our website, address autocomplete and validation functionality, JavaScript SDK, API, and related subscription features. In this policy, "we", "us", and "our" refer to AddressDesk.
Responsibility for personal data depends on the processing activity and the role we perform. The following sections explain how we handle personal data when providing and maintaining our services and when responding to requests.
For questions about personal data, requests to exercise your rights, or concerns about our processing, contact us at addressdesk@gmail.com.
2. Scope and roles
This policy covers personal data processed in connection with:
- The AddressDesk public website and its informational pages.
- Account registration, authentication, and account management.
- API keys, SDK integrations, API requests, and service usage.
- Address autocomplete, address validation, and embedded forms.
- Subscription management, payment administration, and support.
Personal data means information relating to an identified or identifiable natural person. A postal address may be personal data when it identifies or can be linked to an individual.
When you use AddressDesk for your own business, our respective roles depend on the processing activity. We generally act as an independent controller for our own website, account administration, billing, security, and service administration.
If we process personal data contained in your customers' address requests solely on your documented instructions, your business may be the controller and we may act as a processor. Where required, that processing must be governed by a separate data processing agreement under Article 28 GDPR.
Customers are responsible for establishing their own lawful basis, providing required privacy information to their end users, and configuring their integrations appropriately. The actual roles depend on the service architecture and contractual arrangements.
3. Data we process
3.1 Website visits and technical logs
When you access the website or an API endpoint, technical information may be processed to deliver the service, maintain security, and investigate failures. Depending on the connection and system configuration, this may include:
- IP address and request timestamp.
- Requested URL, HTTP method, status code, and response metadata.
- Browser, device, and user-agent information.
- Referrer information, where transmitted.
- Diagnostic information and security-related events.
3.2 Account and authentication data
When you register or sign in, we may process your email address, account identifier, authentication credentials, account status, account preferences, and relevant registration or sign-in timestamps. Passwords should be stored only using an appropriate secure password hashing mechanism, never as readable plaintext.
3.3 API keys and service usage
When you use the AddressDesk SDK or API, we may process API key identifiers, project or account identifiers, request timestamps, endpoint information, usage records, response status, error information, and security or rate-limiting signals.
API credentials are used to associate requests with an account, authorize service access, administer subscriptions, and protect the service from misuse. Access credentials should not be exposed beyond the environments for which they are intended.
3.4 Address search and validation data
Address autocomplete and validation requests may contain partial search terms or address details, including street names, house numbers, postal codes, cities, and countries. We process the information necessary to return the requested search suggestions or validation results.
Depending on the integration and system configuration, request content may also be processed for troubleshooting, security, or support. Address information entered into a customer's checkout may identify that customer's end user. Customers should avoid sending unrelated personal information through address fields.
3.5 Subscription and billing information
If you purchase a subscription, we may process your selected plan, billing period, subscription status, trial status where applicable, transaction references, invoice information, billing address, and tax-related details when required.
Payment information may be processed by the payment provider used for a transaction and by us to the extent necessary to administer subscriptions, reconcile payments, manage billing records, and comply with legal obligations. The precise processing depends on the payment method and the providers involved.
3.6 Communications and support
If you contact us, we process your contact details, the content of your message, and the information reasonably necessary to investigate and respond to your request.
4. Purposes and legal bases
We process personal data only where an applicable legal basis permits the processing. Depending on the activity, the legal bases under Article 6 GDPR are:
| Purpose | Legal basis |
|---|---|
| Creating and managing accounts, authenticating users, and providing subscribed features. | Article 6(1)(b) GDPR: performance of a contract or pre-contractual measures. |
| Processing address searches, autocomplete requests, and validation requests. | Article 6(1)(b) GDPR where necessary for our contract with the user; otherwise, the applicable controller's documented legal basis. |
| Managing payments, invoices, tax records, and legally required accounting documentation. | Article 6(1)(b) GDPR and Article 6(1)(c) GDPR, as applicable. |
| Protecting accounts, securing API access, detecting abuse, troubleshooting failures, and defending legal claims. | Article 6(1)(f) GDPR: legitimate interests, subject to balancing those interests against your rights. |
| Responding to support requests and service-related enquiries. | Article 6(1)(b) GDPR or Article 6(1)(f) GDPR, depending on the request. |
| Using non-essential cookies or similar technologies requiring consent. | Article 6(1)(a) GDPR and the applicable consent requirements under German law. |
Our legitimate interests, where applicable, include maintaining the availability and integrity of AddressDesk, preventing unauthorized access, protecting customers and the service, and handling legal claims.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7. International data transfers
AddressDesk provides address-related functionality for supported countries in the European Union, the United States, and Canada. This describes the service's geographic coverage and does not, by itself, determine where personal data is stored or accessed.
Depending on the location of our infrastructure and service providers, personal data may be processed in or transferred to countries outside the European Economic Area. Where Chapter V GDPR applies, we will rely on an applicable legal transfer mechanism, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses, where applicable.
Where required, additional safeguards and an assessment of the circumstances of the transfer will be considered. Information about the relevant transfer mechanism and how to obtain a copy of applicable safeguards will be provided where necessary.
8. Data retention
We retain personal data only for as long as reasonably necessary for the relevant purpose, unless a longer period is required or permitted by law.
- Account data: generally for the duration of the account and for a reasonable period afterwards where needed to complete account closure, resolve disputes, or comply with legal obligations.
- API and address request data: for the period necessary to return results, provide the contracted service, resolve technical issues, maintain security, and comply with applicable requirements.
- Technical and security logs: for a limited period proportionate to operational, security, and troubleshooting needs.
- Billing and tax records: for the statutory retention periods applicable to the records in question.
- Support communications: until the enquiry and relevant follow-up are resolved, with longer retention where needed for legal claims or other lawful purposes.
When personal data is no longer needed, we delete it or render it anonymous where appropriate. Backups and legally required records may remain for the period necessary under the applicable retention process.
Retention periods depend on the type of data, the purpose of processing, technical requirements, and applicable legal obligations. We review retention practices and limit storage to what is necessary for those purposes.
9. Security
We aim to implement appropriate technical and organizational measures proportionate to the risks of processing. Depending on the relevant system, these measures may include access restrictions, secure authentication, protection of API credentials, appropriate encryption, reliable backups, and procedures for identifying and responding to security incidents.
No internet transmission or storage system can be guaranteed to be completely secure. Customers should protect their account credentials and API keys, restrict access to authorized personnel, and report suspected unauthorized use promptly.
10. Your privacy rights
Subject to the conditions and exceptions under applicable law, you may have the right to:
- Access your personal data and obtain a copy.
- Correct inaccurate or incomplete personal data.
- Request erasure of personal data.
- Request restriction of processing.
- Receive certain data in a structured, commonly used format or request its transfer to another controller.
- Object to processing based on legitimate interests.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with a competent data protection supervisory authority.
These rights are not absolute and may be subject to statutory conditions. For example, some information must be retained to comply with tax or accounting obligations or to establish, exercise, or defend legal claims.
To exercise a right, email addressdesk@gmail.com. Please describe your request clearly. We may ask for proportionate information to verify your identity before disclosing or changing personal data.
You may complain to the supervisory authority competent for the processing, or another authority permitted under Article 77 GDPR, including an authority in your habitual place of residence, place of work, or the place of the alleged infringement.
11. Required information and automated processing
11.1 Information you provide
Providing an email address and the other information marked as necessary during account registration is required to create and administer an account. If required information is not provided, we may be unable to provide the requested account or feature.
Billing information required to complete a purchase or meet legal obligations must be provided where applicable. Address details submitted to the SDK or API are processed as needed for the requested address functionality and any other clearly disclosed, lawful purposes.
11.2 Automated processing
Address autocomplete and validation use automated processing to generate suggestions or validation results. Based on the service described here, we do not intend to make decisions about individuals that produce legal effects or similarly significant effects solely through automated processing within the meaning of Article 22 GDPR.
Customers must independently assess how they use address results in their own systems. They should not treat an autocomplete match as a decision about a person's identity, eligibility, or legal status.
12. Changes and contact
We may update this policy when our services, processing activities, providers, or applicable legal requirements change. The revised version will be published on this page with an updated revision date. Where legally required, we will provide additional notice.
If you have questions about this policy or how your data is handled, contact us at addressdesk@gmail.com.
This policy should be read together with the Terms of Service and any applicable data processing agreement.