Privacy Policy

Stating this first, because it is the part people most want to know:

• We never have the private key to your smart wallet. It is created in your browser and held by you. There is no copy on our servers and no recovery path through us.
• We never see your identity documents or biometrics. Agent verification is carried out by Concordium in their own application. We receive only the resulting account address and badge reference.
• We never collect payment card details. Payment happens on chain in USDC.
• We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Account. Your email address, the account identifier issued by our login provider Privy, your wallet addresses (the owner address of your smart wallet, the derived legacy address and your agent delegate address), the time you created the account, when you were last seen, and which version of the terms you accepted and when.

Payments and activity. A record of each paid call and transfer: the amount, the service and provider, the capability called, the resource URL, the transaction hash, the authorization nonce, the network, the sending and receiving addresses, the HTTP status and the time. We also keep a signing ledger of every payment authorization made through our signing endpoint, which doubles as the spend-cap counter and the audit log.

If you list a service. Your service details, the upstream URL and the credentials we inject on your behalf (encrypted at rest with AES-256-GCM), your payout address and your per-service traffic.

If you use the chat assistant. Your messages, the assistant replies, the tool calls made and their results, stored so you can reload a conversation. If you save your own model API key, it is encrypted at rest and only the last four characters are ever shown back to you.

Referrals and rewards. Your referral code, who referred you, who you referred, and your points ledger.

Agent verification. Your Concordium account address, the badge and token identifiers, the related transaction hashes and the record that the fee was paid.

Email. Delivery records for the emails we send you, which categories you have turned off, and your unsubscribe token.

Technical. Your IP address and basic request metadata, used for rate limiting, abuse prevention and security. One-time-password send records are kept to enforce cooldowns.

We use a referral cookie (xdcai_ref) to credit the person who invited you, and browser local storage for interface preferences such as whether the sidebar is collapsed. Your login session is managed by Privy. These are needed for the Service to work as you would expect.

The public parts of the site also load Google Analytics 4, which sets its own cookies and tells us how pages are found and used. It is not loaded in development. You can block it with any standard browser control, tracker blocker or Google's own opt-out add-on, and the Service works normally without it.

Some information is public, and you should assume it is permanent. Being clear about which is which is part of how this product works.

• Everything on the blockchain. Your wallet address, balances and every payment are recorded on the public XDC network. Anyone can read them, we cannot delete or amend them, and that is outside the control of this policy and of us.
• Platform statistics are published in aggregate: total calls, volume and per-service usage. They do not name individuals.
• The leaderboard is pseudonymous. It shows a display name derived from your account identifier, never the identifier itself, and it publishes no email address and no wallet address.
• A service you list is public, including its name, description, pricing and payout address. Your upstream credentials are never published.

• To run the Service, settle your payments, show your history and support you. Legal basis: performance of our contract with you.
• To keep the Service secure: rate limiting, abuse and fraud prevention, spend caps, audit logging. Legal basis: our legitimate interest in a service that is not abused, and legal obligation where it applies.
• To send you service and security email, such as a new sign-in or a payment result. Legal basis: contract and legitimate interest. You can turn off non-essential categories; security notices always send.
• To understand how the site is used, through analytics. Legal basis: consent, which you can withdraw.
• To meet legal, tax, accounting and sanctions obligations. Legal basis: legal obligation.

We do not sell your data. We use these providers to run the Service, each under its own agreement:

• Privy - login, email verification and your embedded wallet.
• Vercel - hosting, serving and request logs.
• Neon (via Vercel Postgres) - the application database.
• Upstash - short-lived Redis cache and rate-limit counters.
• Postmark - sending email.
• Google Analytics - website analytics on public pages.
• Concordium - agent verification, if you choose to use it.
• AI model providers - if you use the chat assistant, your messages go to the model provider you selected (which may be Anthropic, OpenAI, Google, Moonshot or OpenRouter), or to our default provider if you have not chosen one.
• XDC network RPC providers - to read chain state and broadcast transactions.
• The marketplace service you call receives your request, because that is the point of the call. What it does with that request is covered by its own policy, not ours.

We may also disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of users and third parties. If the project is ever transferred to another operator, account data would transfer with it and we would tell you first.

When you connect XDC AI to ChatGPT, Claude or another assistant through our MCP connector or an API key, the assistant calls our tools on your behalf.

• We receive only the tool input the assistant sends, plus your session token. We do not receive your conversation with the assistant and we cannot read it.
• What we send back is the tool result: for example a marketplace listing, your own balance, or a payment receipt. That result then sits in your conversation with the assistant.
• The operator of the assistant is a separate controller under its own privacy policy. Data you give that assistant is governed by its policy, not by this one.
• We do not use anything received through a connector to train any model, and we do not sell it.

Depending on where you live, you may have the right to access your data, correct it, delete it, export it, restrict or object to processing, and withdraw consent. To exercise any of them, email privacy@xdcai.tech. We will respond within 30 days and may need to verify that you control the account.

Two honest limits. We cannot delete anything from the blockchain, because nobody can. And we may keep records we are legally required to keep, even after you ask for deletion; we will tell you if that applies.

If you are in the EU or UK you may complain to your local supervisory authority. If you are in California, we confirm we do not sell or share personal information as those terms are defined there, and you will never be discriminated against for exercising a right.