Privacy

The Hosted order form

When you submit the order form, we store what you entered — your email address, your name if you gave one, the organisation, the vendors, the number of manifests, your acceptance criteria, your delivery date and your notes — together with the terms version you ordered under, a hash of those terms, the price and the time we received it. It is kept in a Postgres database hosted by Neon; the site is served by Vercel.

We store it to reply to your order and, if it is countersigned, to fulfil it. Nothing else.

No IP address or user agent is stored with it. To slow down abuse, the server counts submissions per network address in its own memory for ten minutes; that count is never written to the database. A submission that trips the form's spam trap is stored the same way under a separate label, so a real order caught by mistake is not lost.

Visiting the site

The site uses Vercel Web Analytics, which reports page views (with referrer, country, browser and device) in aggregate and does not use cookies. Vercel, which serves the site, keeps its standard request logs. The site itself sets no cookies.

Sharing and retention

Nothing is sold, and nothing is shared for marketing.

An order is kept while it is open and for up to 12 months after it closes — accepted and later cancelled, withdrawn, lapsed or declined — and then deleted.

Seeing or deleting what we hold

Reply to our email and ask. If you never received one, open an issue in the repository titled “data request”, with no personal details in it, and we will contact you by email at the address you ordered with. The issue cannot tell us which order is yours, so we write to every order we have not yet replied to.

The free Action and CLI

They send nothing to us. They read your apibreak.json on the machine they run on and make requests only to GitHub: api.github.com, for the public commit history of each vendor's specification repository, and raw.githubusercontent.com, for the specification files. Those requests name the vendor's specification and the baseline you pinned, never the endpoints you listed. A GitHub token, if you give one, is sent only to api.github.com.

The Action writes its report to your workflow's job summary and annotations, which are as visible as the rest of your repository's Actions runs.