Privacy Notice — humans and agents

_Last updated: 2026-10-14 · Controller: NONSYNTHETIC, an independent studio operated by a sole proprietor (no LLC). Contact for all privacy matters: nonsynthetic@proton.me_

0. Scope — every surface, both directions

This notice covers everyone who interacts with us, in either direction: human buyers, agent-to-agent (A2A) callers, machine-to-machine (M2M) / MCP clients, x402 payers, browsers of this site, and counterparties we contact. If you are an AI agent acting for a human principal, that human is the data subject and this notice applies to them; the agent's own identifiers (wallet, client id) are processed the same way.

1. What we hold (inbound)

Data	Source	Retention	Basis
x402 payer wallet address + tx hash	settlement receipt (KV x402:<tx>)	30 days, auto-expire	contract
Card checkout session id + event payload	checkout webhook (KV paid:/evt:) — Stripe checkout sessions (credit packs, passes, audit, SiteKiln) and PayPal IPN posts for goods/services orders	30 days, auto-expire	contract
Buyer-submitted audit target text	checkout field (KV audit:)	30 days, auto-expire	contract
GitHub App webhook event payloads (repo/PR metadata; commit author handles and emails may appear inside payloads)	app webhook (KV evt:gh:/gh:pr:)	30 days, auto-expire	contract / legitimate interest (integration)
Aggregate counters (settles, first/last ts)	derived	indefinite — no identifiers	legitimate interest
MCP tool-call arguments	request body	transient — processed, not persisted	contract
A2A task records (id, message text, state)	A2A adapter (KV a2a:task:)	24 hours, auto-expire	contract
Edge request metadata	Vercel/Cloudflare standard logs	provider-set (short)	legitimate interest
Rate-limit / abuse counters	SHA-256 of caller IP — day-salted in-memory map (chat daily cap) and edge-store rl: buckets (demand/abuse classifier); raw IP never stored	≤24h (in-memory, cleared daily) / 48 hours auto-expire (rl: buckets)	legitimate interest (abuse prevention)
Theme preference	localStorage (your device)	on-device, never transmitted	strictly necessary

2. What leaves our side (outbound to processors / counterparties)

Data	Destination	Why
Payment header + receipt	Coinbase CDP / x402.org facilitator	verify + settle
Card session metadata	Stripe and PayPal (hosted checkout — card details never touch this site)	payment processing
Buyer-submitted audit target	Cloudflare Workers AI (llama)	producing the verdict you bought
Free/pro chat prompt text	Groq, then OpenRouter (failover)	inference — don't put personal data in prompts
Tx hash + amount	Base / Solana public ledgers	settlement — permanent and public
Request traffic	Cloudflare, Vercel (edge hosting)	delivery

Public-ledger disclosure: blockchain settlement records are immutable and cannot be erased by anyone, including us. We minimize what touches the chain — the facilitator writes the tx; we never publish names, emails, or free-text on-chain. What is on-chain is pseudonymous (address + amount) and already public by the protocol's nature.

3. What we never do

No cookies, no analytics, no fingerprinting, no trackers — none exist on this site.
No sale or sharing of personal data for marketing.
No profiling or automated decisions with legal effect — audit verdicts are advisory outputs, labeled "heuristic screen — not an audit" in the payment descriptor itself.
No outbound payments — our rails are receive-only; nothing can move funds out.

4. Your rights (GDPR / CCPA / equivalents)

Access / portability: self-serve — GET /api/v1/paid/status?session=cs_… (Stripe checkout session id) or GET /api/v1/x402/status?tx=… (chain hash) returns your record as JSON.
Erasure: automatic — all personal records expire after 30 days. Faster erasure: email nonsynthetic@proton.me with the tx hash or session id. On-chain entries cannot be erased (see §2); nothing personal is written there.
Rectification / objection / restriction: email us; we respond within 30 days.
Agent principals: if an agent transacted on your behalf, the same rights attach to you — exercise them with the tx hash.
Complaints: you may lodge with your local supervisory authority (EEA/UK) or state AG (US).

5. Transfers & security

Processors are US-based (Cloudflare, Vercel, PayPal, Coinbase); their own DPAs/SCCs cover international transfer. Our side: KV access exists only through the worker; no public read; secrets live as worker secrets, never in code. Corpus products are scrubbed through a published denylist policy before sale — see the audit trail.

6. Changes & contact

Material changes bump the date above and ship with the site. Contact: nonsynthetic@proton.me.

NONSYNTHETIC — independent studio, sole proprietor. We hold less data than this page is long.