Privacy
Effective 3 November 2026.
FactLot collects as little as it can. This page covers factlot.com, the hosted API at api.factlot.com, and paid plans. The open-source packages you run yourself make no network calls and send FactLot nothing.
The website
factlot.com sets no cookies, runs no scripts, and uses no analytics or tracking. Cloudflare, which hosts it, processes your IP address to deliver the page and protect it from abuse.
The hosted API
- Not logged: request bodies, tool arguments, results, and headers. Documents you send are processed in memory to answer the request and are not stored.
- Metered: for each request, the time, path, plan tier, response status, and the first 16 characters of a one-way hash of your API key (never the key). This is kept for usage reporting and abuse prevention.
- Rate limits: free-tier requests are counted per IP address for one minute, in memory, then discarded.
Paid plans
Stripe processes payments; FactLot never sees your card number. FactLot stores your Stripe customer and subscription IDs, your plan, and a SHA-256 hash of your API key. Stripe's privacy policy covers what Stripe collects.
Registry data
The FactLot Registry holds public records about commercial property. It stores owner names only for organisations and never for natural persons. If you believe a record names you as a person, or is wrong, email contact@factlot.com and we will review and remove it.
If you write to contact@factlot.com, we keep your message to answer it. Please do not send confidential leases or personal data by email.
Sharing and your rights
FactLot does not sell or share personal data, and does not use your API requests to train models. You can ask what we hold about you, or ask us to delete it, at contact@factlot.com. We will update this page and its date when practices change.