Privacy Policy
Effective date: 21 June 2026
This Privacy Policy explains how ARAN.DEV LTD collects, uses, and protects personal data in connection with the Headcode API, its documentation, and its website (together, the “Service”). It sits alongside the Developer Terms of Service.
1. Who we are
Section titled “1. Who we are”ARAN.DEV LTD is the data controller for personal data processed under this policy.
- Company: ARAN.DEV LTD, a private limited company registered in England and Wales, company number 12805813.
- Registered office: 51 Thornhill Road, Huddersfield, West Yorkshire, HD3 3DA, England.
- Contact: [email protected].
2. Personal data we collect
Section titled “2. Personal data we collect”- Account and contact data — your name, email address, organisation, and the content of any access-request or support emails you send us.
- Billing data — when paid billing is available, your billing name, address, and payment details. Payment card details will be handled by a payment processor, not stored by us.
- API usage data — API key identifiers, request timestamps, endpoints called, request volume, and the IP address making requests. We use this for rate limiting, security, billing, and debugging.
- Communications — records of correspondence between you and us.
The Service is not designed to collect personal data about your own End Users; rail data returned by the API is operational, not personal.
3. How and why we use it
Section titled “3. How and why we use it”| Purpose | Lawful basis |
|---|---|
| Providing and operating the Service, issuing and managing API keys | Performance of a contract |
| Enforcing rate limits and protecting the Service from abuse | Legitimate interests (security and service integrity) |
| Billing and keeping financial records | Performance of a contract; legal obligation |
| Responding to your enquiries and support requests | Legitimate interests; performance of a contract |
| Sending service and security notices | Legitimate interests; legal obligation |
| Optional product updates or marketing, where applicable | Consent |
4. Who we share it with
Section titled “4. Who we share it with”We do not sell your personal data, and we do not share it with the upstream rail data providers. We currently have no third-party sub-processors. If that changes, we will update this section. We may share personal data with:
- Professional advisers, authorities, or successors where required by law, to establish or defend legal claims, or in connection with a business transfer.
5. International transfers
Section titled “5. International transfers”Where a processor handles personal data outside the UK, we rely on an adequacy decision/regulation or appropriate safeguards (such as the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses).
6. Retention
Section titled “6. Retention”- Account and contact data — kept while your account is active and for up to 30 days after it closes.
- API usage data — kept for up to 30 days.
- Financial records — once billing is live, financial records will be kept for six years to meet UK tax and accounting obligations. Until then, this does not apply.
7. Your rights
Section titled “7. Your rights”Under UK data protection law you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing relies on it. To exercise any of these, email [email protected].
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113, though we ask that you contact us first so we can try to resolve the matter.
8. Cookies and local storage
Section titled “8. Cookies and local storage”We do not use analytics, advertising cookies, or third-party tracking of any kind. The documentation site stores a theme preference (light or dark) in your browser’s local storage; this is not sent to our servers and is not used to identify or track you.
9. Security
Section titled “9. Security”We take reasonable technical and organisational measures to protect personal data, including access controls and encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
10. Changes to this policy
Section titled “10. Changes to this policy”We may update this policy from time to time. Material changes will be notified to account holders by email or through the documentation, and the effective date above will be updated.
11. Contact
Section titled “11. Contact”Questions about this policy or your personal data: [email protected], ARAN.DEV LTD, 51 Thornhill Road, Huddersfield, West Yorkshire, HD3 3DA, England.