Privacy Policy

Effective date: July 28, 2026

In plain language: we store your email, a one-way hash of your API key, and usage metadata (which tool, when, how many credits). We never store card numbers — Stripe holds those. Tool inputs are processed transiently and sent only to the upstream provider that powers the tool; we don't store request or response content, and we don't sell your data. You can delete your account and its data yourself, instantly, via DELETE /v1/agent. Anonymized payment records are kept only because tax law requires it.

This Privacy Policy applies to Arch Tools (archtools.dev), operated by MCMetaverse LLC, a South Carolina limited liability company — the data controller for the personal data described here.

1. What We Collect

We collect only what's necessary to operate the Service:

Email address — required for registration, verification, and account communication
API key (hashed) — your key is stored only as a bcrypt hash; we cannot read the key itself. Optional account fields (name, description, password) are stored as you provide them (passwords hashed).
Usage metadata — per-request logs of tool name, timestamp, response status, and credit cost. Request and response payloads are not stored.
IP address — processed for rate limiting, signup abuse prevention, and security
Session context — if you use the Session API (session-create, session-message), conversation context is held in-memory only, automatically deleted no later than 4 hours after the session is created, and never persisted to disk (server restarts also clear it)
Newsletter email — if you opt in to marketing email; you may unsubscribe at any time

1a. Tool Inputs & Upstream Providers

To fulfill an API call, the input you send is forwarded to the upstream provider that powers that tool (for example Anthropic or OpenAI for AI generation, ElevenLabs for text-to-speech, Resend for email delivery). Inputs are processed transiently: we do not store them, and we do not use your inputs or outputs to train models. Upstream providers process the data under their own terms; our current provider list is published at /subprocessors. If you use BYOK (your own provider keys), your key is used only for that request and never stored.

1b. PII-Handling Tools

Some tools (e.g. pii-detect) exist to analyze text that may contain personal data. These tools process input transiently and store nothing; responses include a notice and transparency headers — X-PII-Detected: true when personal data is found and X-Data-Retention: not-stored confirming nothing was retained. You are responsible for having a lawful basis (or the person's consent) to process any real personal data you submit through the API.

1c. x402 Payment Data

If you pay via x402 crypto micropayments, we record your sending wallet address, on-chain transaction hash, USDC amount, and network for credit attribution, billing, and fraud prevention. Blockchain transactions are inherently public: hashes, wallet addresses, and amounts are visible on-chain to anyone, and we cannot delete on-chain data. Our privacy obligations apply to data stored in our own systems.

1d. Agent Identity (KYA) Data

If you register an agent identity we collect wallet addresses, algorithmically computed reputation scores, aggregated usage statistics (not request content), and the agent metadata you provide (name, description, capabilities, contact). You may request an explanation of your score or dispute it via [email protected].

1e. Service Directory Data

Directory listings (service info, contact details, payment configuration) are public by design. You may request removal of your listing at any time.

2. What We Do Not Collect

We do not store the content of your API requests or responses (in-memory Session API context excepted, as described above)
We do not collect or store payment card numbers or billing addresses — Stripe handles card payments and holds those details
We do not store private keys or seed phrases — only public wallet addresses
We do not track you across other websites and do not use advertising cookies

3. How We Use Your Data — Lawful Basis

In short: we process your data to run the API you signed up for, keep the platform secure, meet tax obligations, and — only if you opt in — send you marketing email.

What we do	Data used	Lawful basis (GDPR)
Operate your account, authenticate API calls, meter and bill credits, send transactional email (key delivery, verification, credit alerts, renewal reminders)	Email, hashed API key, usage metadata, credit balance	Contract performance (Art. 6(1)(b)) — providing the Service you signed up for
Rate limiting, abuse and fraud prevention, signup-farming protection, security logging, prompt-moderation logging	IP address, usage metadata, wallet addresses, moderation events	Legitimate interest (Art. 6(1)(f)) — keeping the platform secure and available
Retaining anonymized purchase and payment records after account deletion	Anonymized transaction rows (no personal data)	Legal obligation (Art. 6(1)(c)) — tax and accounting law
Newsletter / marketing email	Email (if you opt in)	Consent (Art. 6(1)(a)) — withdrawable any time via unsubscribe
Aggregate, anonymized analytics (e.g. the public stats dashboard)	Aggregated usage counts — no personal identifiers	Legitimate interest (Art. 6(1)(f)) — improving the Service

4. Data Sharing

We do not sell your data. We share data only with the processors needed to run the Service — the live list with roles is published at /subprocessors. Principal categories:

Stripe — fiat payment processing (card and billing details live only with Stripe)
Upstream AI/tool providers (Anthropic, OpenAI, xAI, Google, ElevenLabs, Runway, search providers, etc.) — receive the tool inputs needed to fulfill your call, transiently
Resend — transactional email delivery
Render — application hosting; Cloudflare — CDN and edge network in front of all requests
Blockchain networks — x402 transactions are broadcast to the relevant public chain; on-chain data is public and immutable
Error/performance monitoring — frontend error monitoring may collect JavaScript errors and performance metrics; API request payloads are not sent to monitoring services

We may also disclose data if required by law, court order, or to protect the rights, safety, or property of MCMetaverse LLC or others.

5. Data Retention

In short: your data lives as long as your account does. Delete your account and everything personal is erased immediately — the only thing kept is anonymized payment records (required by tax law) and public blockchain data (which nobody can delete).

Account data and usage logs — retained while your account is active (used for billing, your usage dashboard, and abuse prevention); permanently erased when you delete your account
Financial records (Stripe purchases, x402 payment rows) — retained in anonymized form for as long as tax and accounting law requires; these rows contain no personal data (see Section 8)
Session data — in-memory only, deleted no later than 4 hours after session creation
Directory listings — retained until you request removal or your account is terminated
On-chain data — permanent and outside anyone's control

Details: Data Retention Policy.

6. Cookies & Analytics

We use browser localStorage solely to remember your API key for convenience on the dashboard. We do not use advertising cookies or cross-site tracking pixels. We may use basic analytics to understand aggregate traffic patterns (page views, referral sources) without personally identifying you.

7. Security

All traffic is encrypted in transit (HTTPS/TLS). API keys and passwords are stored only as one-way hashes. Authentication endpoints are rate-limited against brute force. We follow responsible disclosure practices — see our Security Policy.

8. Deleting Your Account (Right to Erasure)

You can delete your account and personal data yourself, without waiting on support:

Self-service API: call DELETE /v1/agent authenticated with your API key and the confirmation body {"confirm":"DELETE"}. The deletion is immediate and permanent: your usage history, OAuth grants and codes, and signup identity records are erased, and every personal field on your profile (email, name, key hashes, wallet address, tokens) is wiped.
By email: send a request to [email protected] from your account email.

What is retained, and why: anonymized purchase and payment records ({credits, amount, transaction id, network} — no name, no email, no address) are kept as required by tax and accounting law, under the GDPR Art. 17(3)(b) legal-obligation exemption. Card and billing details were never in our systems — deletion requests for those go to Stripe, which is a separate controller/processor with its own deletion process. On-chain transaction data cannot be deleted by anyone.

9. Your Rights

You have the right to: access the data we hold about you; correct inaccurate data; delete your account and off-chain data (Section 8); export your data in a portable format; request an explanation of your agent reputation score; request removal of your directory listing; and opt out of non-transactional communications.

9a. GDPR / UK GDPR — European Users

If you are in the EEA or UK, you additionally have the rights of restriction of processing and objection, and the right to lodge a complaint with your local supervisory authority. Our lawful bases are listed in the table in Section 3. Where we rely on legitimate interest, you may object based on your particular situation. To exercise any right, contact [email protected].

Note on blockchain data: GDPR erasure applies to data stored in our systems. On-chain transaction data is immutable and decentralized — we cannot modify or delete it. By using x402 payments, you acknowledge this limitation.

International transfers: we are a US company and process data in the United States. If you use the Service from outside the US, your data is transferred to the US.

9b. CCPA/CPRA — California Residents

California residents have the right to know what personal data we collect (Sections 1–2), request deletion (Section 8), correct inaccurate data, and opt out of the sale or sharing of personal data. We do not sell or share personal data as defined by the CCPA, and we do not use sensitive personal information beyond what is necessary to provide the Service. We will not discriminate against you for exercising your rights. To make a request, email [email protected].

10. Children

The Service is for users 18 and older. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it.

11. Changes to This Policy

We may update this policy as the Service evolves. We will update the effective date above and notify registered users of material changes via email.

12. Contact

Privacy questions or data requests: [email protected]

General support: [email protected]