Privacy Notice

Effective date: 29 October 2026

Who we are

NPReq is run by Miles Medical Services, LLC, an Indiana limited liability company. This notice covers the NPReq account portal (/account/) and the NPReq API (api.npreq.com). The free lookup site on npreq.com has its own privacy page.

What we store

Your email address, to sign you in and to send account notices (sign-in links, key warnings, billing changes, notice of API changes). Team members' email addresses, if the account owner invites them.
Sign-in links and codes, stored only as hashes and valid for 15 minutes, once.
Four cookies, all strictly necessary: a session cookie while you are signed in (it ends 60 minutes after you sign in); a short-lived cookie that ties a sign-in link to the browser that asked for it; and a cookie that remembers for 180 days that this browser has signed in to an address before, so it can still get a sign-in link when someone else has used up that address's hourly limit. It holds a random number and a check value, never your email address. If you sign in with Google, GitHub or Microsoft, a fourth cookie lasts 10 minutes and ties that provider's reply to the browser that started the sign-in. No advertising or analytics cookies, and no analytics on any account page.
API keys and access tokens, stored only as hashes. We keep the last 4 characters of a key so you can tell your keys apart. We cannot show a key again after you create it.
Usage counts per key (requests per minute and per day) and per subscription (requests per minute, for the account-wide limit), so we can apply your plan's limits and show your usage.
API call logs (time, key identifier, endpoint and status), to run the service, enforce limits and detect abuse.
IP addresses. Our application stores IP addresses only as keyed hashes, to limit sign-in attempts, bad keys and calls to the public status endpoint. An IP allowlist you set on a key is stored as you typed it. In addition, our hosting provider's web server access logs record the full IP address, time, requested URL and browser information of each request, for security and operations, and are kept for up to 31 days. Our hosting provider's own backup copies may also hold these logs, under its own retention schedule.
Sign-in with Google, GitHub or Microsoft, if you use it: which provider, the provider's identifier for your account there, and when you linked it and last used it. The first time, we use the email address the provider tells us it has verified to find your account, or to create one with that address. We do not store your provider password, access tokens, name or photo. While a provider sign-in is in progress we keep its single-use check values, with your IP address only as a keyed hash.
Two-step sign-in, if you turn it on: the authenticator secret, encrypted, and hashes of your recovery codes.
An audit log of account actions (sign-in, key created, key revoked, plan changes), with the time. It never holds a key, a token, a code or a password.
A record that you accepted the Terms and this notice: which versions, when, and whether at sign-in (with an emailed code or a provider) or checkout.

Payments

Polar is the merchant of record: it sells you the subscription, handles payment, tax and receipts, and uses Stripe to process cards. Your card details go only to Polar and Stripe, never to NPReq. Polar tells us your plan and its status, and we keep the Polar customer and subscription identifiers so we can match them to your account. Polar's handling of your data is described in its privacy policy: https://polar.sh/legal/privacy-policy.

Other services we use

Cloudflare Turnstile checks that the sign-in form is used by a person. It runs only on the sign-in page and collects device and browser signals under Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.
Google, GitHub and Microsoft, if you choose to sign in with one of them. You sign in on the provider's own page, so the provider learns that you signed in to NPReq, under its own privacy policy: Google https://policies.google.com/privacy, GitHub https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement, Microsoft https://www.microsoft.com/en-us/privacy/privacystatement. No provider script runs on our pages.
Namecheap hosts the portal, the API and their databases, keeps the server access logs described above, and sends our emails.

Where your data is stored

We and our hosting provider store and process your data in the United States.

How long we keep it

Per-minute usage counts: 1 hour. Failed sign-in and bad-key records: 24 hours.
Daily usage, API events and API call logs: 90 days.
Host server access logs (including full IP addresses): up to 31 days.
Access tokens: until 24 hours after they expire.
A started provider sign-in: deleted within 24 hours. A linked provider sign-in: until you remove it on the account page or delete your account.
Audit log: while your account exists. After your account is deleted, its audit entries are kept without anything that identifies the account.
Backups: up to 30 days, after which they are deleted. Our hosting provider also keeps its own backup copies under its own retention schedule.
Acceptance records: while your account exists; after deletion it no longer identifies you.
Your account data: while your account exists.

Deleting your account

The account owner can delete the account on the account page. Every key and token stops working at once, every linked Google, GitHub or Microsoft sign-in is removed, the subscription is ended at Polar and your customer record there is deleted, and your email address is removed from our active records.

Some records remain for a limited time after deletion: daily usage, API events and API call logs (up to 90 days from when they were created), host server access logs (up to 31 days), and backups (up to 30 days). Audit entries about the deleted account are kept without anything that identifies it. We keep these only for security, fraud prevention, billing disputes and legal compliance, and then delete them. Billing records that the law requires Polar to keep stay with Polar. We may also keep information where the law requires us to.

Sharing and what we never do

We do not sell your data, use it for advertising, or share it for cross-context behavioral advertising. We share it only with the services named above, which need it to provide NPReq, and in these limited cases:

to comply with law, regulation, a subpoena, court order or other legal process, or a lawful request from a government authority;
to protect the rights, property or safety of NPReq, our customers or others, including to detect and prevent fraud, abuse and security incidents, and to enforce our Terms;
in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, in which case this notice continues to apply to your data or we will notify you of any change; and
with your consent or at your direction.

Security

We protect your data with measures such as hashing of keys, tokens and sign-in codes, encryption of two-step secrets, encryption in transit (HTTPS), and access controls. No method of transmission or storage is completely secure. If we learn of a security breach affecting your personal information, we will notify you and any authorities as required by applicable law, including Indiana's breach notification law.

Children

NPReq is a business service and is not directed to anyone under 18. We do not knowingly collect personal information from children.

Your rights and state privacy laws

You can ask to see, correct or delete your data by emailing support@npreq.com. Depending on where you live, you may have additional rights under state privacy laws; we will respond to such requests as the applicable law requires.

Changes to this notice

We may update this notice. We will post the new version with a new effective date and, for material changes, notify account owners by email at least 30 days before the change takes effect.

Contact

Questions about your data, or a request to see, correct or delete it: email support@npreq.com.