Privacy

Controller

Denis Scheller, a sole proprietorship (Einzelunternehmen) trading as "Agent GDP", Mürtschenstrasse 7, 8730 Uznach, Switzerland, is the controller for the processing described here. Email hello@agentgdp.io. This notice follows the Swiss Federal Act on Data Protection (nDSG / revDSG). Where the EU or UK GDPR applies to a person, it follows that law as well.

What this site processes

The application stores or sends the following. It does not store card numbers, and it does not store the raw API key.

• Account email. Sign-in is a magic link. Supabase Auth creates the link and the session; the email is delivered through Resend. There is no password.
• Email to us. When you write to hello@agentgdp.io, we process your address, the message, and any attachments to answer you. Incoming mail is forwarded by Forward Email and stored in our Gmail mailbox (Google).
• API key material: a SHA-256 hash, a short prefix, the last four characters, a name, the created time, the last-used time, and the revoked time. The full key is shown once at creation.
• Usage: a call count, and the number of those calls already reported as Scale overage, for the account and billing period. A counted call is a successful GET or HEAD to /api/v1 other than the x402 routes.
• Billing mirror: email, Stripe customer id, subscription id, price id, lookup key, plan, status, interval, period dates, and whether cancellation is set for the period end.
• Stripe, as merchant of record, collects the name, address, and payment details it needs for tax, the charge, the invoice, and the receipt. A usage report sent to Stripe contains the Stripe customer id and the number of calls.
• Enterprise form: name, email, company, and message. The form writes a row. This application does not send email from that form.
• Weekly report. Signup is double opt-in. We store your email, the consent time, the page and form you signed up from, and an unsubscribe token in Supabase. Resend sends the confirmation and, after you confirm, the weekly report. Nothing is sent before you confirm. Every report includes a link to unsubscribe.
• Sponsor inquiry: name, company, email, and message. The form stores the row in Supabase and Resend sends a copy to our mailbox.
• Rate limit: the IP address from the forwarding headers, held as a one-minute counter in the server process.
• Hosting logs at Vercel: IP address, user agent, URL, and time, as part of running the site.
• Vercel Web Analytics: page views, and on the pricing page a custom event with a tier (a plan, snippet, or enterprise), the billing interval, and an action (sign-in, checkout, the snippet name, or lead). The event does not include the email or the API key.
• First-party conversion counts: the event type, the page, and the time. The count has no personal identifier and sets no cookie. An upsell click is one of those events.
• Saved views: the name, the page path, and the filter JSON (chain, facilitator, asset, use case, time range, chart type). No browser identifier.
• Alerts: the rule, the account email, an unsubscribe token, and whether mail is still on. A delivery record stores the alert, the day, the time, and whether the send succeeded. The email body is the volume figure already published on the site.
• News: the title, URL, date, and source name from a public feed, plus an optional one-sentence summary. Collected public titles are sent to Vercel AI Gateway to write that sentence. No visitor data is involved.
• Vercel Speed Insights: performance timings for the route.
• x402: the payment is a USDC transfer on Base. The transaction is public on that network. It is not written into the account tables. When you pay via x402, we process the request IP, headers, the paying wallet address, and the transaction hash to verify payment and deliver the response.

Public on-chain data in the index

The index is built from public blockchain transactions (for example on Base), including wallet addresses, amounts, and times. A wallet address can relate to an identifiable person. We process this data on the basis of our legitimate interest in publishing aggregated market statistics (GDPR Art. 6(1)(f)). We do not try to identify the people behind addresses. The data comes from the public blockchains. You can object, or ask us to stop labelling an address, via hello@agentgdp.io. We cannot change or delete the underlying blockchain records.

Purposes and legal bases

Under the GDPR, where it applies, the bases are these. The nDSG requires the processing to be lawful and limited to these purposes.

• Account, API keys, usage counts, the billing mirror, saved views, alerts, and sign-in email: to perform the contract, or to take steps before a contract (GDPR Art. 6(1)(b)).
• Mail you send us, and the enterprise form: to answer a request before a contract (Art. 6(1)(b)).
• Sponsor inquiries: steps before a contract, and our legitimate interest in answering the request (Art. 6(1)(b) and Art. 6(1)(f)).
• The weekly report: your consent (Art. 6(1)(a)). You can unsubscribe from the link in every report.
• Rate limits, abuse prevention, and host logs: legitimate interest in keeping the service available and secure (Art. 6(1)(f)).
• Cookieless page measurement, speed measurement, and first-party conversion counts: legitimate interest in understanding which pages are used and whether they load (Art. 6(1)(f)).
• Stripe's own payment, tax, and invoice records: Stripe decides those as merchant of record. Where we send a customer id or a usage total, that is to perform the contract.
• Public blockchain records in the index: legitimate interest in publishing aggregated market statistics (Art. 6(1)(f)).
• News items and the one-sentence summaries written from public titles: legitimate interest in publishing a short news list (Art. 6(1)(f)). No visitor data is involved.

Processors and transfers

• Vercel hosts the site and runs Web Analytics, Speed Insights, platform logs, and AI Gateway. AI Gateway receives the collected news titles and returns a one-sentence summary. United States and the global edge network.
• Supabase hosts the Postgres database and Auth in the EU (Ireland). Supabase Auth creates the magic link and the session. Resend delivers the sign-in email.
• Resend sends sign-in emails, weekly-report emails when that mail is switched on, alert emails, and operational mail to our own address. It processes the recipient, the content, and delivery logs. United States.
• Forward Email forwards mail sent to our addresses. United States.
• Google stores our Gmail mailbox. United States and the EU.
• Stripe is merchant of record and reseller under Stripe Managed Payments. Stripe's terms apply to the purchase. Stripe handles tax, the charge, the invoice, and the receipt, and receives the usage totals for Scale. United States and Ireland. Stripe is an independent controller of the data it collects at checkout.

Switzerland and the EU recognise the United States as adequate for companies certified under the Swiss-US / EU-US Data Privacy Framework. For other recipients in countries without adequate protection, we rely on the European Commission Standard Contractual Clauses, as recognised by the FDPIC, with the Swiss amendments.

Retention

• Account, API key, and usage records stay while the account exists. We delete them within 30 days after you ask us to delete the account, or after we delete it. Saved views and alerts are deleted with the account, and you can delete a view or an alert yourself before that.
• Unsubscribing from an alert stops mail and keeps the row. That row still counts toward the limit of 20. Delivery records stay with the alert until the alert or the account is deleted.
• Accounts with no sign-in and no paid plan for 24 months are deleted.
• The billing mirror is kept for up to 10 years where we need it for accounting (Swiss Code of Obligations Art. 958f).
• Enterprise requests and emails are kept for 24 months after the last contact.
• Sponsor inquiries are deleted 24 months after the form was sent.
• A weekly-report subscription is kept until you unsubscribe, then for 30 days. A signup that never confirms is deleted 7 days after the consent time.
• Stripe webhook event ids are kept for 90 days so a repeated delivery is not applied twice. A daily job deletes older ids.
• News rows keep the public title, URL, date, source name, and any summary.
• The one-minute rate-limit counter expires after about a minute. The sign-in session lasts until you sign out or Supabase Auth ends it. This app does not set a custom lifetime.
• You can ask us to delete your account by emailing hello@agentgdp.io. Vercel, Stripe, Resend, Forward Email, and Google keep their own copies under their policies.

Cookies

The only cookie this application sets is the Supabase Auth session cookie. It is written after a magic link signs you in, on paths that refresh the session (`/account`, `/auth`, and `/news/review`). `/news/review` is an owner-only page and uses that same session. The same cookie is also refreshed on `/pro`, `/alerts`, and the data pages so a paid plan is recognized there: `/gdp`, `/chains`, `/chain`, `/facilitators`, `/facilitator`, `/sellers`, `/services`, `/service`, `/protocols`, `/use-case`, and `/resources`. The name starts with `sb-` and contains `auth-token`. It is there so the account page knows who you are. Signing out clears it. It is strictly necessary for the account.

The application code does not set an analytics cookie, a marketing cookie, or a consent cookie, and it does not use local storage. Vercel Web Analytics and Vercel Speed Insights load on each page. Those scripts, as integrated here, are not given a cookie by this code. Vercel describes both products as cookieless. The pricing custom event is sent with the page view data described above. First-party conversion counting records an event type, a page, and a time on our server. It sets no cookie and stores no personal identifier. You can object to cookieless measurement by emailing us or using a browser setting that blocks the scripts.

Your rights

You can ask for access, correction, deletion, and a copy of the personal data this controller holds, and you can object to processing that rests on legitimate interest. Where the GDPR applies, you can also ask for restriction and, when the processing is by automated means and based on the contract, for portability. You can revoke an API key yourself on the account page. We do not make automated individual decisions or profile you. We answer requests within 30 days. Providing your email is needed to create an account; without it we cannot provide a paid plan. Email hello@agentgdp.io.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. If the GDPR applies, you can also complain to the supervisory authority where you live or work.

The terms are at /terms. The operator details are in the legal notice.