Privacy policy
Last updated: 15 October 2026
This policy explains what personal data ReqRes collects, why, who we share it with and your rights. ReqRes (reqres.in, app.reqres.in and the ReqRes APIs) is run by Ben Howdle Limited, a company registered in England and Wales (company number 08781098, VAT GB267181684), 86-90 Paul Street, London, EC2A 4NE, United Kingdom. We are the controller of the personal data described here. Questions or requests: hello@reqres.in.
What we collect
- Account data: your email address and sign-in details (handled by our authentication provider), plus anything you choose to tell us during onboarding, such as your role, goal and team size.
- Billing data: your plan, invoices and payment status. Card details are handled by Stripe; we never see or store full card numbers.
- API request data: when you call the ReqRes API we log technical details of each request, including IP address, user agent, request headers, the path and parameters, request and response bodies, status and timing, and country (derived from IP). We also keep daily request counters per account or per hashed IP to enforce rate limits.
- Content you store: data you or your app put into ReqRes projects (collections, records, custom endpoints) and your app's own end users ("app users"), including their email addresses and sessions. For that data, you are the controller and we process it on your behalf (see "Your app's users" below).
- Website and product analytics: pages you visit, features you use, and device and browser information, collected with cookies or similar technologies (see "Cookies").
- Communications: emails and support messages you send us, and whether you open links in emails we send (click tracking).
Why we use it, and our legal basis
| Purpose | Legal basis (UK and EU GDPR) |
|---|---|
| Providing the service, your account, API keys, projects and support | Contract |
| Billing, invoicing, tax and accounting records | Contract; legal obligation |
| Security, abuse prevention, rate limiting, debugging and keeping the service reliable (including request logs) | Legitimate interests |
| Understanding and improving the product, including aggregate usage and audience statistics | Legitimate interests; consent where cookies require it |
| Product, account and lifecycle emails, and occasional relevant offers to account holders (for example, team licences for companies already using ReqRes) | Legitimate interests (you can unsubscribe at any time) |
| Answering your questions and requests | Legitimate interests; contract |
We use OpenAI to power AI features you choose to use, and to help write some personalised account emails based on how you use ReqRes. We do not sell personal data.
Who we share it with
We use these service providers (processors) to run ReqRes. They process data on our instructions:
- Heroku (Salesforce): hosting, database and cache (United States)
- Cloudflare: network, CDN and security (global)
- Clerk: sign-in and authentication (United States)
- Stripe: payments and invoicing (United States and others)
- Resend: sending email (United States)
- PostHog: product analytics (European Union)
- Sentry: error monitoring (United States)
- OpenAI: AI features and email personalisation (United States)
- Google Analytics, Ahrefs Analytics: website analytics
- ParityDeals: regional pricing on our pricing pages
We may also disclose data if required by law, to protect our rights or users, or to a buyer or successor if ReqRes or its business is sold, in which case this policy continues to apply to your data.
International transfers
Some providers process data outside the UK and EEA, mainly in the United States. Where they do, we rely on adequacy decisions (such as the UK-US data bridge and EU-US Data Privacy Framework, where the provider is certified) or the standard contractual clauses and UK addendum in their data processing terms.
How long we keep it
- API request logs: 1 to 90 days, depending on your plan's log retention; 7 days for the free demo endpoints.
- Agent sandbox projects created without an account: deleted after 72 hours unless claimed.
- Account data and project content: while your account is active. When you ask us to delete your account, we delete it and your projects, except where we must keep records (for example invoices, kept for at least 6 years for tax purposes).
- Unsubscribe records: kept so we keep honouring your choice.
Cookies
- Essential: keeping you signed in and secure, fraud prevention on payments (Stripe), and remembering your cookie choice (
rr_consent). These don't need consent. - Analytics (optional): Google Analytics, through Google Tag Manager, and PostHog. These cookies are only set if you choose "Accept analytics". Until then, PostHog counts page views without storing cookies on your device, and Google Tag Manager isn't loaded.
- Cookieless analytics: Ahrefs Web Analytics, which doesn't use cookies.
You can change your choice at any time with "Cookie settings" in the site footer, or block and delete cookies in your browser.
Your app's users
If you use ReqRes as a backend for your own app, you are the controller of your app users' data and of the content you store, and we process it as your processor to provide the service. You are responsible for having a lawful basis and telling your users about it. Please don't store special category data (such as health data) or payment card data in ReqRes. Data processing terms are available on request: hello@reqres.in.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. You can object to marketing emails at any time using the unsubscribe link in any email. To make a request, email hello@reqres.in; we'll respond within one month.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority, though we'd appreciate the chance to sort it out first.
Children
ReqRes is a developer tool and isn't intended for children under 13 (or the minimum age in your country).
Changes
We'll update this page when our practices change and revise the date at the top. For significant changes, we'll let account holders know by email.
See also our Terms of service.