Privacy Policy

Controller

The data controller is JadeMind GmbH, Keutschacherstrasse 116, 9220 Velden am Wörthersee, Austria · hello@flextrust.io, operating the FlexTrust service.

What we collect

Account data: e-mail address, password (hashed), optional organisation name and wallet address you provide.

Usage metadata: per-request timestamps, endpoint, status, the API key used, and — for paid calls — the network prefix of the caller (a /24, never the full address), the country we derive from the caller's address at the time of the call (using the DB-IP IP-to-Country Lite database, offline on our server — the address is not sent anywhere) and the price and VAT, kept on the receipt as evidence of where a supply took place (VAT).

Payment data: for x402 payments, the paying wallet address and the on-chain settlement reference; we never see card data. Prepaid packs are attributed to the paying wallet.

Waitlist entries: e-mail, chosen tier, optional use case.

Evidence about agents: public blockchain records (registrations, feedback, settlements) and furnisher-signed receipts about AI agents, identified by wallet addresses, registry ids and anchored keys. Where an owner claims an agent, the claim links that agent to the owner's account.

Where the data about agents comes from

Evidence about agents originates from two kinds of sources. Public blockchains: the agent registries (identity, reputation, validation) and the payment settlements on the networks listed at /methodology, read by our own indexers. Furnishers: organisations that report an agent's conduct to us with the agent's consent — by category, payment platforms, marketplaces and API providers. Furnisher categories are listed here and updated when one is added; no furnisher is live today. We do not buy data and we do not collect it from private channels.

How we use it — and on which legal basis (Art. 6 GDPR)

To provide and bill the service, enforce limits, issue trust receipts and send transactional e-mail — contract performance (Art. 6(1)(b)). Metering records, invoices and supply evidence — legal obligation (Art. 6(1)(c)). Abuse prevention, rate limiting, reliability, and the compilation and publication of evidence-based assessments of AI agents — our legitimate interest (Art. 6(1)(f)) in operating an independent, secure assessment service, balanced by the dispute and correction rights below.

Scored agents and their owners

Public pages show rounded, daily scores of agents identified by public identifiers. An owner who claims an agent can read the full file, set guardrails, receive alerts, and dispute any evidence item; an upheld dispute removes the item from scoring and is disclosed. A reviewed and confirmed manipulation pattern is shown to the owner and flagged to paying callers; nothing about detector internals is published. Scores are never changed by a classification. A score is never the sole basis of a decision about a person, and we make no decision about anyone on it (Art. 22 GDPR). See /safety and /citizens.

Trust receipts

A trust receipt stores the digest of what an agent signed — never the message — together with the attested standing. Receipt pages are unlisted capability URLs; whoever holds the link can read the attestation. Verification requests are counted, not attributed.

Cookies

Essential cookies only (session sign-in, security, the light/dark preference stored locally). No analytics, no tracking, no advertising cookies — which is why there is no cookie banner.

Processors

Hetzner Online GmbH (hosting and backups, EU data centres) · Resend (transactional e-mail delivery, USA) · FlexYield / JadeMind GmbH (blockchain RPC access — relayed requests without your identity) · an uptime monitoring service (health-endpoint probes only) · public blockchain RPC providers and an x402 payment facilitator (settlement verification; they see the paying wallet, not your identity). Transfers outside the EU/EEA rest on adequacy decisions or standard contractual clauses. We do not sell personal data.

Website visitor logs · Retention

Our servers record technical access data (IP address, time, page, referrer, browser) on the basis of our legitimate interest in a secure site; logs are capped and rotate within days and are not merged with account data. Raw request metadata is kept 30 days; aggregated usage for billing history; supply evidence and invoices for seven years under § 132 BAO. Evidence about agents is retained for as long as it is scored and committed — the tamper-evident record is the service. Account data is deleted on account closure, subject to statutory retention.

Your rights (GDPR) · Contact

You can request access, correction, export or deletion of your personal data, and object to or restrict processing, by writing to hello@flextrust.io. Owners of scored agents additionally have the dispute path in the console. You may lodge a complaint with your supervisory authority — in Austria the Datenschutzbehörde (dsb.gv.at). Data controller: JadeMind GmbH (details above).