Terms of Service & Privacy Notice

Zero payload logging guarantee and fair-use terms for Tinplate APIs.

Zero Payload Logging

1. Zero Payload Logging & Stateless Processing

Tinplate APIs process request payloads strictly in volatile memory on Cloudflare Workers. We never log, store, inspect, sell, or retain your request bodies, response bodies, signing secrets, PII, HTML, emails, or tokens.

2. Minimal Operational Telemetry

To monitor uptime, latency, and quota abuse, the gateway records only non-content operational metrics:

Target API identifier (e.g., 10_JSON_HEAL) and HTTP method.
Marketplace auth provider (rapid, zyla) and subscription tier name.
Coarse request-size bucket (e.g., le_4kb), HTTP status code, and server processing time (ms).

No IP addresses, headers, API keys, or payload fragments are written to telemetry or logs.

3. Short-Lived Public Caching & Optional Workers AI

Public Cache Only: Public EU VIES VAT lookup results (/v1/eu-vat-iban/vat) and public HTML-to-Markdown conversions by URL hash (/v1/html-to-markdown) may be cached briefly in Cloudflare KV to reduce upstream latency. Raw HTML inputs and private secrets are never cached.
Optional AI Judge: When you explicitly pass "use_ai_judge": true on /v1/prompt-guard or /v1/hallucination-diff, the text excerpt is evaluated statelessly via Cloudflare Workers AI with no training retention.
Billing Data: All subscriptions, invoices, and payment details are handled directly by RapidAPI or Zyla API Hub.

1. Service Scope & Marketplace Billing

Tinplate provides deterministic and edge-hosted micro-APIs via https://api.tinplate.dev, distributed through RapidAPI and Zyla API Hub. Plan quotas, rate limits, overages, and refunds are governed by your subscribed marketplace plan.

Fair-Use Policy

2. Fair-Use Clause for Fetcher-Backed APIs

Certain endpoints (/v1/html-to-markdown, /v1/security-headers, and /v1/ssrf-firewall with redirect inspection) fetch public URLs on your behalf via an isolated SSRF-guarded Worker (edgeguard-fetcher). By using these endpoints, you agree not to:

Target private, loopback, RFC1918, CGNAT, or cloud metadata networks, or attempt to bypass SSRF protections.
Use Tinplate as an open proxy, DDoS amplifier, credential-stuffing relay, or high-frequency bulk scraper.
Fetch unlawful content or circumvent target authentication or access controls.

All outbound fetches enforce a 10-second timeout, a 1 MB response body cap, and redirect-hop limits. Abusive fetch patterns may be throttled or suspended.

3. Advisory Outputs & No Warranty

All Tinplate APIs are provided "as is" without warranty of any kind. Advisory security outputs (including SSRF pre-checks, security header scores, signup fraud scores, prompt-injection scores, and JSON repairs) assist your application logic and do not replace defense-in-depth enforcement in your own infrastructure.