Privacy
What our free public REST APIs record, how long it stays, and who else sees it. Written from the service source rather than from a template, so it describes this system and not a generic one.
Last updated 5 September 2026.
Who is responsible
AI SENSE AS, Postboks 1202 Vika, 0110 Oslo, Norway. Org.nr NO 922 601 151 MVA. Contact support@aisense.no for anything on this page.
The short version
There are no accounts, no API keys and no sign-up, so we hold no name, email address or payment detail for anyone using the free APIs. We set no cookies and run no analytics, advertising or tracking scripts. What we do record is the technical detail of each request, because a public service has to be able to see its own traffic.
What we record
Every request
One line in a server log: the time, your IP address, the HTTP method, the full path you requested, the protocol, the content type and your browser or client's User-Agent string.
The path includes anything you put in it. Several endpoints take their input in the URL rather than in a request body - /url_shortener/{url} receives an entire target address, /ip_reverse_lookup/{ip} an IP address, /domain_ip_lookup/{domain} a domain name. Those values are written to the log along with the rest of the line. Do not put anything sensitive in a URL, here or anywhere else.
Rate limiting
We count requests per IP address to enforce the published limit of 5000 per 24 hours. The counter is stored against the address.
What temporary endpoints store
Eight endpoint groups hold temporary state or content:
| Endpoint | What is stored |
|---|---|
/storage | Your request body, byte for byte, unchanged |
/url_shortener | The address you asked us to shorten |
/webhook_capture | The complete inbound request, including all headers and the sender's IP |
/webhook_action | The form you defined and the answer someone submitted to it |
/webhook_schedule | The target URL, delivery time, JSON payload and delivery result |
/agent_wake | Task state and the webhook, human answer or time result. Standard credential headers on webhooks are redacted |
/heartbeat | Check-in timing, the webhook URL and optional payload, or an Agent Wake task ID. The target is removed when the monitor becomes terminal |
/lease | Hashed lease identity and owner data, timing, fencing token and an optional completed result. Raw namespaces, keys, owner tokens and fingerprints are not stored |
Webhook Capture deserves particular attention. It records every header a caller sends, and services that post to webhooks routinely include authorisation tokens and signatures in those headers. If you point a third-party service at a capture URL, its credentials will sit in our storage for 24 hours. That is the endpoint working as intended, but you should know it before you use it.
Lease replaces values under secret-shaped field names such as authorization, password, token and api_key with [redacted] before storage. It cannot detect a secret placed under an ordinary field name. Keep credentials and personal data out of Lease results and Heartbeat payloads.
What we do not do
No cookies from the API. No analytics, no advertising, no fingerprinting, no profiling, no automated decision-making. We do not sell or rent anything to anyone. We do not attempt to identify who you are, and without accounts we generally cannot.
IP geolocation via /ip_reverse_lookup runs against database files on our own server. The address you look up is not sent anywhere.
How long we keep it
| Data | Kept for |
|---|---|
| Storage, URL shortener, webhook capture, webhook action, Agent Wake | Up to 24 hours |
| Webhook Schedule | Scheduled for up to 24 hours. The final result can remain readable for another 24 hours |
| Heartbeat | Armed for no more than 24 hours. Terminal timing and delivery state can remain readable for another 24 hours |
| Lease | Until the fixed absolute expiry 24 hours after the first acquisition. Renewals do not extend it |
| Rate limit counters | Rolling 24 hours |
| Server access logs | 14 days |
| Machine-access audit log | 12 weeks |
Once the stated readable period ends, the data becomes unreachable through the API. Cleanup runs on a schedule, so removal of the underlying file can happen after the stated API expiry.
Where data goes
Some endpoints contact another service or a destination you selected. Only the value needed for that call is sent:
| If you call | We ask | And send |
|---|---|---|
/bitcoin/balance/{address} | blockchain.info | The wallet address |
/solana/balance/{address} | api.mainnet-beta.solana.com | The wallet address |
/ethereum/balance/{address} | ethereum-rpc.publicnode.com | The wallet address |
/url_shortener/{url} | 307.fi | The address being shortened |
/webhook_schedule | The public webhook URL you supplied | Your JSON payload and the schedule ID |
/heartbeat with a webhook action | The public webhook URL you supplied | The heartbeat miss event and your optional JSON payload |
No other free REST endpoint sends your supplied content to a fixed third party. An Agent Wake heartbeat action stays inside AI SENSE.
Calls from other websites
Our API responses permit cross-origin requests from any website, which is what makes the endpoints usable directly from browser JavaScript. A consequence worth stating plainly: if a site you visit calls our API from your browser, your IP address reaches us and is logged, even though you never visited us. We have no way to know which site that was, and we do not receive a referrer for it.
Your rights
Under the GDPR you may request access to personal data we hold about you, its correction or erasure, a restriction on how we use it, or a copy of it - and you may object to our use of it. Write to support@aisense.no.
One practical limit, stated because it is true rather than to avoid the obligation: log entries and rate-limit counters are stored by IP address and nothing else. If you ask us to find your records, an IP address is all we can search on, and shared or dynamic addresses mean we may not be able to distinguish your requests from someone else's. Data you stored through /storage is different - quote the storage_id and we can act on it precisely, though it will have expired within 24 hours anyway.
You may complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no.
Why we are allowed to do this
We rely on legitimate interest for the technical logging and rate limiting described above: operating a public service, keeping it available, and investigating abuse and faults. The data is limited to what those purposes need and is not used for anything else. Where you send us content deliberately - anything you post to the storage or webhook endpoints - you are asking us to hold it, and we hold it only for as long as stated.
Security
All traffic is served over HTTPS. The service holds no account credentials because it issues none. Temporary data is addressed by an unguessable bearer identifier, or by a Lease namespace and key. Treat these values as secrets. Anyone holding the right value can read the associated public state or result.
Changes
When the service changes, this page changes with it. The date at the top is the last time it was checked against what the code actually does.