agent-company
a615b7ebfd
Closes leeworks-agents/api-company#5 (docs-site Astro scaffold) Closes leeworks-agents/api-company#9 (metrics instrumentation standard) Closes leeworks-agents/api-company#10 (Gitea Actions openapi aggregation pipeline) Closes leeworks-agents/api-company#11 (docs-site Flux HelmRelease) Closes leeworks-agents/api-company#12 (SEO blog posts x3) Closes leeworks-agents/api-company#13 (legal docs ToS/Privacy/AUP) Closes leeworks-agents/api-company#14 (DNS documentation) ## Changes ### docs/legal/ - terms-of-service.md — API usage, liability, account termination, governing law - privacy-policy.md — request log retention (90d), no PII sold, data sharing - acceptable-use-policy.md — rate limit abuse, scraping prohibition, resale ban ### docs/metrics-standard.md - Defines api_requests_total, api_response_duration_seconds, api_data_freshness_seconds - Fastify (TypeScript) and FastAPI (Python) reference middleware implementations - Prometheus scrape config and Grafana dashboard guidance ### docs/registry.md - Decision: use Gitea built-in container registry (no new infra) - Image naming convention, auth, Kubernetes imagePullSecrets, ingress config ### docs/dns.md - Required A records for all 6 subdomains - cert-manager ClusterIssuer and Ingress TLS examples - Verification commands and human-operator action items ### docs-site/ - Astro 4 + MDX + sitemap scaffold - Base layout with nav linking all APIs, blog, RapidAPI, status - Landing page with API cards - Per-API Redoc viewer pages (zip-enrichment, holidays, air-quality) - Blog index + 3 SEO blog posts (~1000 words each with JSON-LD) - Dockerfile (multi-stage: node build + nginx serve) - nginx.conf with gzip, caching, health endpoint ### flux/ - gitea-runner/: gitea-act-runner HelmRelease (org-scope, dind) - monitoring/: kube-prometheus-stack + Gatus HelmReleases - Prometheus with pod annotation scraping - Grafana at grafana.leeworks.dev with persistence - Gatus status page at status.leeworks.dev, 90-day retention - docs-site/: Deployment + Service + Ingress via raw chart - api-company-source/: GitRepository + Kustomization reference manifests - kustomization.yaml: root kustomize entry point (build validated) ### .gitea/workflows/build-docs.yaml - Aggregates openapi.yaml from zip-enrichment, holidays, air-quality repos - Builds Astro docs-site - Pushes image to registry.leeworks.dev/leeworks-agents/docs-site - Triggered on push to main, schedule daily 02:00 UTC, workflow_dispatch
3.4 KiB
Privacy Policy
Effective Date: 2026-05-24
Contact: legal@leeworks.dev
1. Overview
leeworks.dev ("we", "us") operates the ZIP Enrichment, Holidays, and Air Quality APIs. This Privacy Policy describes what data we collect when you use our Services, how we use it, and your rights regarding that data.
2. What Data We Collect
2.1 Request Logs
When you make API calls, we log:
- API key identifier (hashed/truncated — not the full key)
- IP address of the requesting client
- HTTP method and endpoint path
- Response status code
- Request timestamp
- Response time (latency)
We do not log the full content of request or response bodies unless required for debugging.
2.2 Account Data (via RapidAPI)
If you subscribe through RapidAPI, your account data (name, email, billing information) is managed by RapidAPI, not by us. Please review RapidAPI's Privacy Policy.
2.3 Cookies and Tracking
The API endpoints themselves do not use cookies. Our documentation site (docs.leeworks.dev) may use minimal session cookies for navigation only — no analytics or tracking cookies.
3. How We Use Your Data
We use collected data to:
- Monitor API health and uptime
- Detect and prevent abuse (rate limit evasion, scraping)
- Debug issues and improve service reliability
- Generate aggregate usage statistics (anonymized)
- Respond to support requests
We do not sell your personal data to third parties. Ever.
4. Data Retention
| Data Type | Retention Period |
|---|---|
| Request logs (IP + endpoint) | 90 days |
| Aggregated usage metrics | 12 months |
| Billing records (via RapidAPI) | Per RapidAPI policy |
After the retention period, logs are automatically deleted.
5. Data Sharing
We share data only in the following circumstances:
- With RapidAPI: billing and subscription management
- Legal requirements: if required by law, court order, or government request
- Service providers: hosting infrastructure providers (under data processing agreements)
We do not share raw request logs with any third parties.
6. Security
We take reasonable technical and organizational measures to protect your data:
- API keys are transmitted over HTTPS only
- Access to log storage is restricted to authorized personnel
- Our cluster uses Kubernetes RBAC and network policies
However, no system is 100% secure. If you discover a security vulnerability, please report it to legal@leeworks.dev.
7. Your Rights
Depending on your jurisdiction, you may have rights to:
- Access the personal data we hold about you
- Request deletion of your data
- Object to or restrict processing
To exercise these rights, contact us at legal@leeworks.dev. We will respond within 30 days.
8. Children's Privacy
Our Services are not directed at children under 13. We do not knowingly collect data from children. If you believe a child has submitted data, contact us and we will delete it promptly.
9. International Transfers
Our services are hosted in the United States. By using the Services, you consent to the transfer and processing of your data in the US.
10. Changes to This Policy
We may update this Privacy Policy periodically. We will notify users of material changes by updating the effective date above and posting a notice. Continued use of the Services after changes constitutes acceptance.
11. Contact
For privacy inquiries: legal@leeworks.dev