Last updated: October 28, 2026
This policy explains what information is processed when you create an account, define a project, generate or download output, purchase tokens, or contact support; why it is needed, who it may be shared with, and how to request access, correction, or deletion.
Account and sign-in information. We process the name, email address, or phone number you provide and information needed to sign in and verify it. Passwords are stored as hashes rather than plain text; one-time verification codes and session data are used for authentication and abuse prevention.
Project definitions and submitted content. We process project configurations, entity and field names, relationships, routes, selected options, support messages, and files needed to generate or deliver output. Information you put into this content may be stored with the request.
Orders and payments. Token balances, orders, amount and currency, order status, transaction references, and payment-gateway confirmation results are retained to record and resolve transactions. Do not enter full bank-card details or payment passwords into API Besaz forms; payment takes place on the gateway’s page.
Technical and browser information. For security and troubleshooting, we may record IP address, technical request details, operation time and result, and error or security events. Language preference is stored in the browser, and a limited set of account-profile fields may also be stored there for display in the interface.
Information is used only as needed for these stated purposes:
The configuration and code you generate for your project are yours as project content. API Besaz validates and processes that content to fulfil your request. This does not mean that your private configuration or code should be published elsewhere; you remain responsible for not placing secrets or unnecessary data in your input.
Access to data should be limited to operational need, and infrastructure secrets should be stored through secret-management mechanisms. However, absolute security or immunity from every incident cannot be guaranteed. Retention depends on the type of data, service needs, dispute handling, and legal duties; this policy does not claim a single fixed deletion deadline for all data and backups. Deletion requests are reviewed, but transaction, security, or legally required records may not be removed immediately.
Token balances, orders, and payment confirmations are retained for accounting, support, and duplicate-transaction prevention. The payment gateway processes the data needed to take and verify payment, and some transaction data may be exchanged between API Besaz and the gateway. The gateway’s own processing is subject to its rules and policy. Keep your receipt and order reference for disputes; do not send full card details or payment passwords to support.
Your language preference is stored in browser local storage. Your name, email, phone number, and two-factor-authentication status may be stored locally for interface display. The access token is held in application memory, while persistent sessions use an HttpOnly cookie. Clearing browser data can reset preferences or sign you out; sign out on shared devices.
We do not sell your personal information. Data is shared only as necessary:
To request access to account information, correction of inaccurate details, or deletion, use the configured privacy mailbox or contact us through the contact form. We may verify the requester’s identity to protect the account. Requests are handled within the applicable legal framework; some transaction records or legally required information may need to be retained.
API Besaz is designed for developers and is not specifically directed at children. If you are not legally old enough to enter into the relevant agreement or use the service, use it only with any permission or supervision required by law. If you believe a child’s information was submitted without appropriate authority, contact us.
This policy may change as the service or applicable rules evolve. The current version and latest review date appear on this page; material changes may be communicated through the website or a registered contact channel where appropriate.
Have a privacy question or request? Contact us through: the contact form.
This policy takes account of Iran’s Electronic Commerce Law (2003), including Articles 58–61 on personal and sensitive data and Articles 33–35 on pre-contract disclosures, as well as the Computer Crimes Law and other applicable laws of the Islamic Republic of Iran. Under the applicable framework, collection purposes should be clear, processing should be limited to what those purposes require, and requests for access, correction, or deletion may be considered within the law. Do not upload private or sensitive information about other people without valid authority; processing sensitive data may require explicit consent.