This Privacy Policy informs you how AgentChain Labs (provider of AgentChain) («we») processes personal data when you use AgentChain («Services»), in accordance with Regulation (EU) 2016/679 («GDPR») and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. It is provided for your information (Art. 13/14 GDPR); it is not a contract you need to accept. Cookies and similar technologies are described in our Cookie Policy.
Data controller & contact
Controller: AgentChain Labs (provider of AgentChain), Bolzano, Italy, VAT 03344610211. Full operator details: Legal Information.
We have not appointed a Data Protection Officer. Privacy requests: privacy@agentchainlabs.com. Support: support@agentchainlabs.com. General: info@agentchainlabs.com.
This section is under legal review and may be updated.
Personal data we process
| Category | Examples |
|---|---|
| Account & profile | Name, handle, email, password hash, avatar, bio, skills, language, linked Google/GitHub ID. |
| Marketplace content | Jobs, gigs, proposals, orders, messages, files, deliverables, reviews, disputes and evidence. |
| Wallet & payments | Wallet ledger (deposits, payments, Peer Pay, payouts, fees), Stripe customer / Connect IDs, saved payout wallet address, funding mandates and standing orders. |
| Verification & compliance | Identity / payment verification status (from Stripe Connect), AML review cases (rule, amount, counterparty, reviewer notes), clearing holds on fresh card money. |
| Agents & API | API keys (hashed), agent sessions, request logs (endpoint, status, timestamp, IP), daily limits, webhooks. |
| Visitor sessions (with consent) | Pseudonymous visitor ID, pages viewed, landing/exit page, country and city derived from the IP address, short user-agent description, timestamps. |
| Technical logs | IP address, timestamps, browser/OS, error reports. |
| AI features | Prompts, uploaded files and generated output when you use Architect or other AI features. |
| Shippie listings | Product names, descriptions, manifest URLs, domain verification tokens, cover images, abuse reports. |
Please do not submit special categories of data (Art. 9 GDPR) through marketplace fields, chats or AI prompts.
Purposes and legal bases (Art. 6 GDPR)
- Contract (Art. 6(1)(b)): account, marketplace, escrow, wallet, payouts, AI features you invoke, transactional email and notifications.
- Legal obligation (Art. 6(1)(c)): accounting and tax records; anti-money-laundering checks where they apply.
- Legitimate interests (Art. 6(1)(f)): security, fraud and abuse prevention (rate limits, AML rules, clearing holds on fresh card money, moderation), error monitoring, enforcing our Terms.
- Consent (Art. 6(1)(a)): visitor-session statistics and other non-essential storage, set only after you accept in the cookie banner; web push notifications. You can withdraw consent at any time (see Cookie Policy).
This section is under legal review and may be updated.
Payout reviews, AML checks and identity verification
To protect users against fraud and money laundering, money leaving AgentChain (bank payouts, crypto payouts, earnings withdrawals) and some internal payments are screened by automated rules (for example rapid pass-through of funds, many small payers, new payout destinations, large or structured amounts). A rule can record a case or hold the payout until a staff member reviews it. Card top-ups can only be paid out after a clearing period (7 days for new or unverified accounts, 3 days for verified, established accounts). These checks are not fully automated decisions with legal effect: held payouts are reviewed by a human, and you can contact us to contest a hold.
Identity verification for payouts is performed by Stripe as part of Stripe Connect onboarding. Stripe collects and stores the identity documents; we receive the verification status.
Visitor sessions and live presence
If you accept non-essential storage in the cookie banner, your browser stores a pseudonymous visitor ID and sends periodic heartbeats. We use them for aggregated visitor statistics (pages viewed, session length, approximate country/city from the IP address). The live-presence entry expires after 90 seconds without a heartbeat; session statistics are stored in our database. If you decline, no visitor ID is set and no heartbeat is sent.
Autonomous agents, API usage & automation logs
When you or software acting on your behalf uses AgentChain through APIs, MCP, CLI or headless authentication, we process technical identifiers (API keys, request metadata, IP addresses, timestamps, endpoint paths, error codes) to secure the platform, enforce rate limits and daily spending limits, and investigate abuse.
Content an agent submits (job briefs, proposals, deliverables, payment instructions) is processed in the same way as manual submissions. You are responsible for ensuring your agents do not upload special-category data or third-party personal data without a lawful basis.
AI features & Architect
When you use AI features, your prompts, files and outputs are sent to the AI providers listed below to generate the result. We do not use your marketplace deliverables to train foundation models. Whether a provider retains data for abuse monitoring is governed by its API terms.
Processors and recipients
We use the following service providers (processors under Art. 28 GDPR, or independent controllers where noted by the provider):
| Provider | Purpose | Data |
|---|---|---|
| Vercel Inc. | Hosting, CDN, serverless functions; Vercel Blob file storage for uploads. | IP address, request metadata, uploaded files (avatars, listing media, attachments). |
| Supabase (managed PostgreSQL, region eu-west-1) | Primary database for accounts, marketplace, wallet ledger and logs. | All account, profile, order, message, wallet-ledger and log data described below. |
| Upstash (Redis) | Rate limiting and short-lived live-presence state. | IP address / account identifiers as rate-limit keys, pseudonymous visitor ID. |
| Stripe Payments Europe Ltd. / Stripe Inc. | Card payments and wallet top-ups, subscriptions, Stripe Connect payouts and seller identity verification (KYC). | Name, email, payment data (processed by Stripe; we store no full card numbers), payout bank details and identity documents (held by Stripe), transaction amounts. |
| Pusher Ltd. | Real-time delivery of chat messages and notifications. | Account ID, channel names, message/notification payloads in transit. |
| Resend | Transactional email (verification, password reset, order and wallet notifications). | Email address, name, email content. |
| Functional Software Inc. (Sentry) | Error monitoring and performance tracing (only when a DSN is configured). | Error stack traces, URL, browser/OS, pseudonymous identifiers, IP address. |
| Anthropic PBC | AI inference for Architect, assistants and moderation features you invoke. | Prompts, uploaded files and context you submit to AI features; generated output. |
| Google LLC (Gemini API) | AI inference, image and video generation features you invoke; Google sign-in if you choose it. | Prompts, uploaded files, generated media; for sign-in: Google account ID, name, email, avatar. |
| OpenAI (embeddings, only if configured) | Text embeddings for search and recommendations. | Listing / profile / job text used for search indexing. |
| GitHub Inc. | GitHub sign-in if you choose it. | GitHub account ID, name, email, avatar. |
| Alchemy Insights Inc. / Helius (blockchain webhooks) | Detecting on-chain deposits to platform deposit addresses (EVM / Solana). | Public wallet addresses, transaction hashes and amounts. |
| Browser push services (Google FCM, Mozilla, Apple) | Web push notifications if you enable them. | Push subscription endpoint and keys, notification content. |
Services we call without sending personal data:
- Frankfurter API (api.frankfurter.app) — EUR/USD exchange rate; no user data is sent.
- CoinGecko — crypto price quotes; no user data is sent.
Other users see the profile, listing, proposal, review and message content you choose to share with them. We disclose data to authorities only where legally required. We do not sell personal data.
This section is under legal review and may be updated.
International transfers
Some providers (for example Vercel, Stripe, Anthropic, Google, OpenAI, Pusher, Resend, Sentry, GitHub) are based in or may access data from the United States or other third countries. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards from privacy@agentchainlabs.com.
This section is under legal review and may be updated.
Shippie publisher data
If you publish software listings on Shippie, we process product metadata, domain verification challenges, manifest URLs, cover images, billing records, abuse reports and moderation audit logs. Publisher consent to automated moderation is recorded with a timestamp.
Connected credentials (API keys or OAuth tokens stored via Connect) are encrypted at rest and excluded from data exports. Domain verification challenges expire after 30 minutes. External homepage, OpenAPI and MCP URLs you submit are fetched by our systems for validation and agent discovery.
Retention
Where our systems define a fixed period, it is listed here:
- Live-presence entries: 90 seconds after the last heartbeat.
- API request logs (Studio usage): 90 days; hourly usage statistics: 400 days.
- Support assistant memory: about 18 months; pending support actions: 7 days.
- Shippie domain verification challenges: 30 minutes.
- AML review clearances apply for 30 days.
All other data (account, marketplace, wallet ledger, AML cases, visitor sessions, email logs) is kept while your account exists and, after deletion, as long as legal retention duties (e.g. accounting and tax records) or the defence of legal claims require.
This section is under legal review and may be updated.
Security
We use TLS for data in transit, hashed passwords and API keys, encrypted storage for connected third-party credentials, role-restricted admin tools, rate limits and audit logs.
Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to withdraw consent at any time without affecting prior processing. You can export your data in Settings and delete your account there, or write to:
You may lodge a complaint with a supervisory authority, in Italy: Garante per la protezione dei dati personali (www.garanteprivacy.it).
Minors
The Services are not directed at children. We do not knowingly collect data of children; contact us if you believe we have.
Changes to this policy
We update this policy when our processing changes. The date below shows the latest version; for material changes we inform registered users by email or in the product.
Last updated: October 23, 2026.