Privacy notice

Who we are

This notice covers the D20DAO agent API at https://api.d20dao.org and the website at https://d20dao.org. Both are operated by D20DAO, an unincorporated project run by its contributors. "D20DAO" and "we" mean the D20DAO contributors who operate them. We are responsible for the data described here.

What we process and why

• Payment data: your wallet address, the payment authorization you sign (amount, network, nonce, validity and signature) and the paymentId derived from it. We use it to settle your payment, serve your call, stop a payment being used twice and make refunds.
• Request data: the operation and parameters you send, including any seed and item labels. We use it to open the request and build your result. Item labels do not go on chain; only their count does.
• IP address: we use it for rate limiting and to prevent abuse.
• Operational logs: times, routes, response codes, errors and, for some events, the paymentId and wallet address. Cloudflare's request logs can also include your IP address. We use logs to run, secure and fix the Service and to account for payments.
• Email: if you write to us, your address and message. We use them to answer you and to handle refunds.

We process this data to perform our contract with you (payments, results and refunds) and for our legitimate interest in keeping the Service secure and working (rate limits, abuse prevention and logs).

The website

The website sets no cookies of its own and runs no analytics or advertising scripts. Cloudflare, which hosts it, processes IP addresses and request data to deliver and protect it.

Public blockchain data

Payments and the requests we open are recorded on public blockchains. What is recorded there, such as wallet addresses, amounts, values derived from your payment and seed, and results, is public and permanent. No one, including us, can change or delete it.

How long we keep it

We keep operational logs for up to 90 days. We keep payment and request records only as long as we need them to serve your call and settle any refund. We keep data longer only when we need it to handle a dispute or abuse, or to meet a legal obligation. Rate-limit counters are held in memory only. We keep emails as long as we need them to handle what you wrote about.

Data on public blockchains is public and permanent. We cannot delete it.

Who we share it with

We do not sell your data or use it for advertising. We share it only as needed to run the Service:

• Circle, which settles payments through Circle Gateway under its own terms and privacy policy;
• Cloudflare, which hosts the API and the website and stores their logs;
• the blockchain node providers we use to send and read transactions.

We also disclose data when the law requires it. These providers may process data outside your country.

Your rights

Depending on where you live, you may have the right to access, correct or delete your data, to object to or restrict its use, and to complain to a data protection authority. Email contact@d20dao.org to use these rights. We cannot change or delete data on public blockchains.

Changes

We will post changes on this page and update the date at the top.

Contact

Email contact@d20dao.org.