[whstl]

According to GDPR: you're fine if you're just calling an endpoint and not storing any PII anywhere.

According to ePrivacy: it is fine as your backend is storing this data, and not the user's computer.