Privacy Policy

1. Design principle: we collect very little

The Service is a read-only observability tool. It reads public blockchain data about wallet addresses you choose to add. It is built to hold as little personal data as possible, and most of what it stores is either your login email or information that is already public on a blockchain.

2. What we collect

2.1 Account data — your email address and authentication metadata handled by our authentication provider (Supabase Auth): account creation timestamp, last sign-in timestamp, session tokens, and password hashes or, where you use a third-party sign-in, the identifier returned by that provider. We do not see or store your password in readable form.

2.2 Wallet data you provide — the public blockchain addresses you add, the chain each is on, and any label you give them. These are public addresses only. Note that a wallet address can, in some circumstances, be linked to an identifiable person; where that is so, it is treated as personal data under this policy.

2.3 Public on-chain data — for each address you add, transaction data read from public ledgers and third-party RPC endpoints: transaction hash, counterparty addresses, token, amount, block, and timestamp. This data is public and exists independently of the Service; we ingest a copy of the parts relevant to your dashboard.

2.4 Configuration data — budget amounts and periods, alert thresholds, webhook URLs and related settings, and plan/tier status.

2.5 Payment data — for Pro, the Base-network address the USDC payment came from, the transaction hash, the amount, and the period it covers. There is no card processor, no stored payment instrument, and no card, bank, or identity document data.

2.6 Technical and operational data — server and application logs generated when you use the Service, which may include IP address, user agent, request paths, timestamps, and error traces, kept for security, abuse prevention, and debugging. Our hosting provider (Vercel) generates its own access logs and aggregate analytics.

2.7 Website analytics (Google Analytics 4) — we use Google Analytics 4 to understand which pages are read. It is off until you click Accept on the cookie banner; declining (the default) sets no analytics cookies. When accepted, Google sets analytics cookies and receives page views and interaction events along with your truncated IP address and browser data. We disable Google signals and ad personalization and do not send wallet addresses or email addresses to Google Analytics. Data is retained for 14 months. You can change your choice by clearing this site's local storage and cookies, which shows the banner again.

2.7 Correspondence — if you contact us, the content of your message and the address you sent it from.

3. What we never collect

We never ask for, receive, store, or transmit private keys, seed phrases, mnemonics, keystore files, hardware-wallet PINs, or wallet-approval signatures. The Service has no wallet-connect flow that requests signing authority and no technical ability to move, freeze, or authorise a transfer of your funds. We do not collect government identity documents, card numbers, bank details, biometric data, precise location, or any special-category data.

4. Why we use it, and on what legal basis

Where the EU/UK GDPR applies to a given processing activity, our bases are:

• Create and operate your account, authenticate you — 2.1 (Performance of a contract)
• Display your dashboard, totals, and history — 2.2, 2.3 (Performance of a contract)
• Evaluate budgets and send webhook/email alerts — 2.3, 2.4 (Performance of a contract)
• Process and verify Pro payments, keep payment records — 2.5 (Contract; legal obligation (record-keeping))
• Security, abuse prevention, rate limiting, debugging — 2.6 (Legitimate interests (keeping a small service running and secure))
• Respond to your messages — 2.7 (Contract; legitimate interests)
• Service and legal notices to your account email — 2.1 (Contract; legal obligation)
• Comply with legal, tax, and accounting obligations — 2.5, 2.7 (Legal obligation)

We do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

5. Who we share it with

We use a small number of processors, each only to run the Service:

- Supabase — authentication, database hosting, and storage. - Vercel — application hosting, edge network, and logging. - Public and third-party RPC endpoints / node providers — queried to read public chain data. These queries reveal the addresses being queried to those providers; they are not given your email or account identity. - Email delivery provider — to send transactional and alert email to your account address. - Webhook endpoints you configure — we send event data to the URL you supply. Once sent, that data is in your hands and governed by your own arrangements, not ours.

We may also disclose data where legally required — to comply with a valid legal obligation, court order, or lawful request from a competent authority, or to establish, exercise, or defend legal claims. If the business is reorganised, incorporated, merged, or sold, data may transfer to the successor under this policy.

We do not sell personal data to anyone.

6. International transfers

Our providers may process data outside the European Economic Area, including in the United States. Where that happens and EU law applies, transfers are made on the basis of the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism offered by the provider under its data processing agreement. Blockchain data is, by its nature, globally public and replicated; we do not control where it is stored or read.

7. Retention and deletion

7.1 Account data, wallet configuration, and ingested on-chain records are retained while your account is active.

7.2 On account closure, your data is deleted within thirty (30) days. Deletion cascades across the related records — account, wallets, ingested transactions, budgets, and webhook configuration — and this cascade behaviour has been tested rather than merely asserted. You can close your account yourself from the dashboard's danger zone; closure starts the 30-day countdown immediately, and it cannot be undone once those 30 days pass.

7.3 You may request deletion at any time, without closing your account first, via getagentcap.com/contact.

7.4 Two exceptions: (a) operational logs and provider-side backups may persist for a short additional period until they age out on their normal rotation; and (b) records we must keep for tax, accounting, or legal-defence purposes (principally Pro payment records) are retained for the period applicable law requires and are not used for any other purpose.

7.5 Nothing we do can delete anything from a blockchain. Public on-chain transactions are permanent, public, and outside our control. Deleting your account removes our copy and our indexing; it does not and cannot remove the underlying chain records.

8. Your rights

8.1 We deliberately hold very little personal data about you: an email address, the public wallet addresses you chose to add, your configuration, and a copy of public on-chain records relating to those addresses.

8.2 Where a data protection law applies to you — for example the EU or UK GDPR for users in those jurisdictions, or comparable laws elsewhere — you have the rights that law grants you. Typically those include the rights of access, rectification, erasure, restriction of processing, objection to processing based on legitimate interests, and data portability, and the right not to be subject to solely automated decision-making. Where we rely on consent for a specific purpose, you can withdraw it at any time without affecting prior processing.

8.3 This is a statement of what the law gives you, not a blanket claim of compliance with every provision of every data protection regime. We are a single-operator service and we describe our actual practices above so you can judge them.

8.4 Independently of any statutory right, and for every user regardless of location, you can at any time: view your data in the dashboard, correct or relabel any wallet, export your account data, and delete your account and its data.

8.5 To exercise any right, contact us via getagentcap.com/contact from your account email. We will respond within one month, or sooner where required, and will tell you if we need an extension or further information to verify the request. We do not charge for this unless a request is manifestly unfounded or excessive.

8.6 If you are in the EEA, you have the right to lodge a complaint with your national supervisory authority. The Portuguese authority is the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. We would appreciate the chance to resolve it with you first.

9. Security

Data is held with our providers under their security controls; access to production systems is restricted to the operator; authentication is handled by Supabase Auth and traffic is served over TLS. No system is perfectly secure, and we do not warrant that ours is. The strongest security property of the Service is structural rather than procedural: it holds no keys and no funds, so compromising it cannot move your assets.

10. Breach notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required by applicable law, within 72 hours of becoming aware of it, and we will notify affected users without undue delay where the law requires or where we judge that you ought to know.

11. Children

The Service is not directed to anyone under 18 and we do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. The "Last updated" date will change, and material changes will be notified by email or in-product notice before they take effect.

13. Contact

For any privacy question or request, including access, correction, export, deletion, or a complaint: getagentcap.com/contact.