THE FREE API

The shared company directory, readable by anything that can make an HTTP request. No key, no account. It answers one question especially well: which identity-verification providers a company routes its checks to, and what those providers' own policies claim.

Endpoints

GET https://convex-site.daetrax.com/api

The endpoint index, as JSON.

GET https://convex-site.daetrax.com/api/lookup?domain=<company-domain>

Look up a company: its industry, the fine print page for that industry, verified privacy contact routes, and its identity-verification chain, with each provider's category, its own retention claim, and its documented incidents.

Each lookup also carries an impact block for the company's industry: what a company of that kind typically holds, how long it realistically keeps it, what identity it demands, what it can profile about a person, what a leak costs, why the record is worth keeping, and the documented routes by which "anonymised" data of that kind has been tied back to a person, each route with the study that showed it, cited in the sentence. Its basis is always industry-typical: it describes the kind of company, never the named one, and reviewed is the date a person last reviewed that industry's profile. The verifier chain is the only company-specific, verified part of the payload.

GET https://convex-site.daetrax.com/api/reasoning

How DÆTRAX structures a privacy request, and why, as markdown.

Example response

Abridged, with illustrative values:

{
  "ok": true,
  "company": {
    "name": "Example",
    "domain": "example.com",
    "industry": "dating",
    "finePrint": "https://daetrax.com/fine-print/dating",
    "verificationProviders": [
      {
        "name": "Example Verifier",
        "domain": "verifier.example",
        "category": "orchestrator",
        "retentionClaim": "Retains verification artefacts for 12 months",
        "knownIssues": null,
        "dataRole": "processor"
      }
    ],
    "usedAsVerifierBy": 0,
    "contact": [{ "type": "email", "value": "privacy@example.com" }],
    "selfServeTools": true,
    "impact": {
      "basis": "industry-typical",
      "industry": "dating",
      "reviewed": "2026-08-23",
      "likelyRetention": { "band": "indefinite", "note": "Safety holds keep a minimum long after you close the account, and one owner often pools it across several apps." },
      "idDemand": { "level": "liveness_or_id", "likelihood": "likely", "note": "Liveness checks are common; some apps also ask for a government ID." },
      "leakSeverity": { "grade": "severe", "note": "..." },
      "profiling": [
        { "dimension": "sexuality", "likelihood": "highly_likely", "note": "..." }
      ],
      "reidentification": {
        "routes": [
          { "route": "location_traces", "confidence": "high", "evidence": "Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013)." }
        ],
        "note": "...",
        "sources": [{ "title": "Unique in the Crowd: The privacy bounds of human mobility", "venue": "Scientific Reports 3, 1376", "year": 2013, "url": "https://www.nature.com/articles/srep01376" }]
      },
      "trackingPriority": { "grade": "high", "note": "..." }
    }
  }
}

The rules it follows

Shared company data only; nothing about any person, ever. Contact routes appear only once verified. What companies claim in reply to requests is logged as a claim, never certified as fact.

The new reader

Almost nobody has ever read a privacy policy. There are too many and they are too long, so what they actually permit has gone mostly unread for as long as they have existed.

That is the part that changed. People now have a reader: an assistant that works for them, fetches the page, follows a clause to the regulator's ruling, and says in plain words what the retention section keeps and what the deletion section leaves behind. The fine print, the Dispatch issues, and this API were built with that reader in mind as well as the human one: dense text, primary sources linked, claims kept to what the documents say.

DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply. Start your record →