Privacy

We store your email address, a hash of your API key and a short key prefix, account and key timestamps, and usage counts. These support email verification, key management and limits. The full key is shown once and is not stored.

Address, postcode, nearest and boundary lookups send no query text to any third party. Address matching runs against the service's copy of G-NAF. Usage counts do not contain the address text you look up.

The parse endpoint is the one exception. It reads messy text with a rule-based parser first. When that parser is not confident, the text you sent to parse, and nothing else, is passed to a language model hosted by OVHcloud on its AI Endpoints service to extract the address components. No API key, email address, account detail or IP address goes with it, the model's answer is checked against the text before it is used, and the service keeps neither the request nor the answer beyond the response. Send only text you are comfortable having processed that way, and keep personal details out of it. There is a daily limit on these calls, and when it is reached the rule-based result is returned instead.

Service logs record the route, response status, timing and client IP address for operations. Transactional email is delivered through an email provider. There is no newsletter.

The site loads fonts from Google Fonts. Where enabled, the sign-up form uses Cloudflare Turnstile to verify the submission. These services receive the browser requests needed to provide those features. They do not receive lookup query text.

Address data itself, the G-NAF release and the boundary files, is stored and served from the service's own infrastructure.

Your theme preference is stored in your browser. Signing in uses a secure session cookie.