REST Lens Privacy Policy

Introduction

This privacy policy explains how your personal data is handled when you use REST Lens, the enterprise API quality assurance platform provided by E.SU. IT AB.

• "Service" refers to REST Lens, our OpenAPI specification analysis platform
• "We" or "Us" refers to E.SU. IT AB (Org.no 559484-0505)
• "You" or "Your" refers to you as a user of the REST Lens platform

Last Updated

This privacy policy was last updated on January 11, 2026.

Data Collection

We collect and store the following types of data when you use our Service:

Account Information

• Name and email address (for account creation and management)
• Company/organization name and customer type (individual/business)
• Billing address (street, city, postal code, country)
• VAT number (for business customers)
• Subscription details, transaction history, and auto top-up settings
• Authentication credentials

Fraud Prevention Data

• Payment card fingerprint (card type, last 4 digits, and expiry date) for fraud prevention
• This data is used solely to prevent abuse of free plan offers and is processed under our legitimate interest in preventing fraud

API Specification Data

• OpenAPI specification files (JSON/YAML) that you upload for analysis
• Analysis results and configurations
• Custom rule configurations you create
• Historical analysis data for version comparison

Usage Data

• Service usage patterns and analytics
• Error logs and diagnostic information
• Performance metrics
• Feature usage statistics

Technical Data

• IP address and browser information
• Session data and cookies
• Device and operating system information

Purpose of Data Processing

We collect and process your information for the following purposes:

Service Delivery

• Analyzing your OpenAPI specifications against REST best practices
• Providing detailed findings and recommendations
• Enabling version comparison and historical tracking
• Delivering semantic insights and contextual recommendations

Account Management

• Creating and maintaining your user account
• Processing subscription payments and billing
• Providing customer support
• Communicating service updates and notifications

Service Improvement

• Creating anonymized usage statistics to improve the platform
• Identifying and fixing technical issues
• Developing new features and capabilities
• Enhancing our rule system and analysis algorithms

Legal Basis for Processing

We process your personal data under the following legal bases as defined in GDPR Article 6:

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service, including account management, payment processing, and delivering API analysis features you have subscribed to.
• Legitimate Interests (Article 6(1)(f)): Processing for service improvement, security monitoring, fraud prevention, and analytics to enhance our platform. This includes storing payment card fingerprints (card type, last 4 digits, expiry) to prevent abuse of free plan offers. We balance our interests against your rights and only process data where our interests do not override your fundamental rights.
• Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable laws, such as maintaining billing records for tax purposes.

For any questions about our legal basis for processing, contact us at [email protected].

Data Security and Storage

Security Measures

• All data is encrypted in transit and at rest
• Access controls and authentication mechanisms protect your data

Data Location

• All data is stored in secure data centers within the European Union
• Data backups are maintained for service continuity and disaster recovery

API Specification Handling

• Your uploaded API specifications are processed securely and confidentially
• Analysis results are associated with your account and protected accordingly
• We do not share your API specifications with third parties

Data Retention

Account Data

• Account information is retained for the duration of your subscription
• After account termination, personal data is deleted within 30 days
• Billing records may be retained longer for legal and tax compliance

API Specifications and Analysis Data

• API specifications and analysis results are retained during your active subscription
• Historical data for version comparison is maintained as per your subscription plan
• Upon account deletion, all API data is permanently removed within 7 days

Backups

• System backups may retain data for up to 90 days for disaster recovery purposes
• Backup data is subject to the same security and privacy protections

Third-Party Providers

We use the following third-party providers to provide the Service:

Payment Processing

Stripe, Inc processes all payment transactions. When you make a purchase, Stripe processes your payment information directly. We do not store your full credit card details. However, for fraud prevention purposes, we store a card fingerprint consisting of the card type (e.g., Visa, Mastercard), the last 4 digits, and the expiry date. This information is used solely to prevent abuse of free plan offers. Stripe may collect additional information as described in their Privacy Policy.

VAT Validation

For EU business customers, we validate VAT numbers using the VIES (VAT Information Exchange System) service operated by the European Commission on behalf of EU Member States. When you provide a VAT number for reverse charge eligibility, we send it to VIES along with our company VAT number (SE559484050501) as the requester. VIES returns the validation status, registered company name, and address associated with your VAT number. We store the VIES consultation number for tax audit purposes as required by Swedish VAT legislation. This processing is necessary for compliance with EU Council Regulation 904/2010 on administrative cooperation in the field of VAT. For more information, see the VIES Privacy Statement.

Analytics

We use self-hosted analytics (Rybbit) to understand how our Service is used. This analytics system is privacy-focused and does not use cookies. It collects anonymized data including page views, referrers, browser type, device information, and approximate geographic location. IP addresses are used only temporarily for geolocation and are not stored. All analytics data is stored on our own infrastructure within the European Union.

Your Privacy Rights

Under applicable data protection laws, you have the following rights:

Access and Portability

• Request access to personal data we hold about you
• Receive a copy of your data in a structured, machine-readable format

Correction and Deletion

• Request correction of inaccurate or incomplete personal data
• Request deletion of your personal data (subject to legal obligations)

Processing Restrictions

• Object to or restrict certain types of data processing
• Withdraw consent for processing based on consent

Complaints

• Lodge a complaint with supervisory authorities if you believe your rights have been violated

To exercise these rights, contact us at [email protected].

In Sweden, the supervisory authority for data protection is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You can file a complaint with IMY at www.imy.se or contact them at Box 8114, 104 20 Stockholm, Sweden.

Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your login session
• Remember your preferences and settings
• Analyze service usage and performance
• Provide security features

You can control cookie settings through your browser, though some features may not function properly if cookies are disabled.

Children's Privacy

Our Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not use the Service or provide any personal information.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child under 16, please contact us immediately at [email protected].

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR requirements (Article 33-34).

Notification will include:

• The nature of the personal data breach
• The likely consequences of the breach
• The measures taken or proposed to address the breach
• Contact information for further inquiries

We will notify you via email to your registered address and, where appropriate, through prominent notice on our website or in-app notifications.

If you become aware of a security incident or unauthorized access to your account, please immediately contact us at [email protected].

Service Communications

We may send you service-related communications including:

• Account notifications and security alerts
• Billing and subscription updates
• Important service announcements and product updates
• Responses to your support requests

These communications are necessary for providing the Service and you cannot opt out of them while maintaining an active account.

Third-Party Links

Our Service may contain links to third-party websites, services, or resources that are not owned or controlled by us. These links are provided for your convenience and reference.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. When you click on a third-party link and leave our Service, you are subject to the terms and privacy policies of that third party.

We encourage you to review the privacy policies of any third-party websites you visit. This Privacy Policy applies only to information collected by REST Lens.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes through:

• Email notification to your registered address
• Prominent notice on our website
• In-app notifications when you next use the Service

We encourage you to review this policy periodically to stay informed about how we protect your privacy.

Contact Information

If you have questions or concerns about this Privacy Policy, or wish to exercise your data protection rights, please contact our Data Protection Officer, Edwin Sundberg, at: [email protected].