Privacy policy

This is an English translation provided for convenience. The Azerbaijani text is the binding one: in the event of a dispute or conflict, the Azerbaijani text prevails.

Version: 2026-11-02. This version is in force from that date.

This document explains which data the huqsi API service (api.huqsi.az, the "Service") processes, for what purpose and on what legal basis, how long it is kept, and what your rights are.

1. Operator and scope

Owner and operator of the personal data: the operator providing services under the HuqSi brand ("we"). The paperwork for establishing the operator as a legal entity and for its state registration is in progress; its official name, legal form, tax ID (VÖEN) and address will be stated in this policy as soon as registration is complete. Contact: api@huqsi.az.

The huqsi.az website and the e-Katib application have their own privacy policies; this document does not cover the processing there.

This policy is based on Article 32 of the Constitution of the Republic of Azerbaijan, the Law of the Republic of Azerbaijan "On Personal Data" (11 May 2010, No. 998-IIIQ; the "Law") and the Law of the Republic of Azerbaijan "On Information, Informatization and Protection of Information".

Purpose: to create the account, recognize you, apply the plan and limits, and send service notices. Legal basis: you provide this data yourself in writing and consent to its processing (Articles 8.1 and 9.6.1 of the Law). An account cannot be created without an e-mail address. Name, surname, telephone number and personal ID number (FİN) are not required.

E-mail address, plan, time of account creation and of last sign-in: until the account is deleted.
Agreement to the terms (version of the documents and time): until the account is deleted. Proving consent is our duty (Article 8.4 of the Law).
Session: only a hash is stored in the database; 30 days or until "Sign out".
API key: only a hash, a prefix and the name you gave are stored in the database, not the key itself. The record of a revoked key also stays until the account is deleted.
Connected applications (OAuth): the application's name, return domain, and the time of connection and of last use stay until the account is deleted. Only a hash of tokens is stored, and it is deleted when they expire.

3. Request data

Purpose: to apply limits, show statistics in the dashboard and investigate faults. Legal basis: Articles 9.6.1 and 5.8 of the Law.

Request log (key or connection number, endpoint, status, time, duration) and daily count: 90 days, then deleted automatically. No IP address is written to this log.
Monthly request counter: until the account is deleted.
The text of a search query is not stored. It is processed in memory only until the response is prepared and is not written to the log or the database. If this rule changes, the policy is updated in advance.

The Service is not intended for processing personal data: do not write other people's personal data in search queries.

4. Technical data for security

Purpose: to prevent abuse and attacks and to investigate faults. Legal basis: Article 5.8 of the Law places on us the duty to take technical and organizational measures to protect data; this data is processed to the extent necessary for that duty (Articles 9.2 and 9.6.2 of the Law). We treat an IP address as personal data.

Sign-in attempt (e-mail, IP address, hash of the link and the code): deleted at most 2 hours after the attempt ends.
New account attempt (e-mail and IP address): 2 days, to limit the number of accounts opened from one IP address.
Per-IP request limit: the IP address is kept in memory for 60 seconds without being written to disk.
Application registration (OAuth): the information the application gives about itself and the IP address of the registration request. If no connection is created, it is deleted after 7 days.
Technical logs: the web server and the application record the time and address of a request, the response code, the browser type and errors. In refused registration attempts and in MCP requests without credentials, the IP address may also be recorded. These records are kept in a limited volume, and older ones are deleted as new ones are written. Records needed to investigate a specific incident may be kept until the investigation ends. The records are not processed to build profiles.

5. Cookies

The dashboard writes only the cookies necessary for it to work:

huqsi_session: session, HttpOnly, 30 days;
huqsi_login: binds a sign-in attempt to the browser, HttpOnly, at most 30 minutes;
huqsi_lang: the chosen language, 12 months.

There are no advertising or tracking cookies.

6. Visit statistics

On public pages (the home page and the docs), analytics running on our own server and writing no cookies (GoatCounter) keeps visit statistics: the page path (without the query string), the address of the referring page if you came from another site (domain and path only), screen size, browser and operating system type, and country. Analytics does not run in the dashboard, the sign-in flow, /v1 or /mcp.

Purpose: to understand which parts of the docs are read. The IP address is processed only during the request, to determine the country and to tell repeat visits apart, and is not kept in the statistics. The statistics are not processed to identify a person, are not combined with other data and are not given to third parties. These figures may be kept in aggregate for as long as the Service operates. If you do not want to be counted, you can block stat-api.huqsi.az in your browser; this does not affect the Service.

7. Location and disclosure of data

We do not sell your data or use it for advertising. Only the following may access the data:

Operator: a person authorized by us, under a duty of confidentiality (Article 5.5 of the Law).
Resend: the sign-in code and link are sent by e-mail through Resend (servers in the European Union, Ireland). Only your e-mail address, the code and the link go to it. Azerbaijan and Ireland are parties to Council of Europe Convention No. 108; the transfer complies with Article 14 of the Law. Resend's data processing terms apply.
Hosting provider: only to the technical extent necessary to provide the hosting service.
State authorities: only in the cases and manner established by law, on the basis of an official demand (Article 13.2.2 of the Law). Unless the law prohibits it, we inform you of such a demand.

Except for Resend, the Service's servers, database and encrypted backups are located in the territory of the Republic of Azerbaijan. DNS service for the domain name is obtained from Cloudflare; the Service's traffic does not pass through it.

Connected applications. When you yourself connect the Service to an external application such as Claude.ai or ChatGPT, your question goes to that application and we give it the response to the request. The application's processing is governed by its own rules. You can revoke the connection in the dashboard at any time.

8. Security

The Service works over an encrypted connection (HTTPS). Keys, sessions, tokens, sign-in links and codes are stored in the database only as hashes, and no passwords are used. Sign-in attempts are limited, the session cookie is HttpOnly, and access to the server is open only to an authorized person. Backups are encrypted. If a security incident may affect your rights, we inform you at your registered e-mail address without delay. These are the measures provided for in Article 5.8 of the Law.

9. Deletion

To delete your account, write from your registered e-mail address to api@huqsi.az. The account, keys, sessions, connections and counters are deleted within 7 working days at the latest. The request log is deleted when its own period (90 days) ends. Old data remaining in backups is deleted within at most 13 months through backup rotation and is not processed for any other purpose during that period.

10. Your rights

Under Article 7 of the Law you have the right:

to know whether we hold data about you, the identity of the operator, the purpose, legal basis, duration and methods of processing, and the range of persons with access to the data;
to see the content of the data collected about you and the source it was obtained from;
to require the data to be corrected or destroyed;
to object to the collection and processing of your data and to require a ban on it; no reasons need to be given, but since the Service cannot be provided without an e-mail address, the account is closed in that case;
to withdraw your consent (Article 13.3 of the Law);
when your rights are violated, to complain to the competent state authority for personal data or to a court, and to claim compensation for the damage through the courts.

To make a request, write to api@huqsi.az. We reply free of charge within 7 working days at the latest from the day the request arrives; if a third party must be contacted, the period may be extended by another 7 working days. A refusal is answered with reasons within 5 working days (Article 12 of the Law). So that data is not given to the wrong person, we may check that the request really comes from you. In accordance with Article 7.5 of the Law, you may also exercise your rights by a written application on paper with an identity document, or by an electronic request with an enhanced electronic signature.

11. Changes

A significant change is notified to your registered e-mail address at least 30 days before it enters into force, and the new wording is published on this page. Changes that are solely in your favour or that result from a requirement of law may be applied without a notice period.