Femtos Privacy Policy

Last updated 2026-10-22.

This policy explains what personal data Femtos processes, why, for how long, who receives it and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés). It is also available in French at femtos.xyz/fr/privacy.

1. Controller

Femtos. Privacy contact: contact@femtos.xyz. Femtos is being registered as a company in France; its full legal identity (company name, registration number, registered office) will be added here as soon as the registration is complete. No data protection officer is appointed (not required for Femtos's activity).

2. Who this policy is about

Visitors of femtos.xyz and docs.femtos.xyz;
Customers and API users: people who hold an Account (email signup), operators of Agents (agent signup or x402 payment), and the people they let use their key;
Payers: people who pay in USDC to a deposit address or by x402;
People named in the wallet registry (section 9);
People whose public blockchain activity appears in the Data (section 10).

3. Data we process, purposes and legal bases

Data	Where it comes from	Purpose	Legal basis (GDPR art. 6)
Email address (optional: human signup; for agents, an optional `owner_email`, never verified and never written to)	you	Account, sign-in links, confirmations of key rotation / deletion / unfreeze, billing messages	contract (6.1.b)
Agent name (`agent_name`, free text you choose)	you	identify the Account in your dashboard	contract
API key: stored as a SHA-256 hash plus an encrypted copy (AES-256-GCM), last 4 characters for display. Management secret: SHA-256 hash only	generated by us	authentication, key files of the API servers	contract
IP address	your connection, via Cloudflare	rate limiting per address (in memory, minutes to an hour); the daily cap on free signups (a keyed hash, HMAC, of the address, not the address itself); security; it may also appear in server logs	legitimate interest in protecting the Services and preventing abuse (6.1.f)
Request data: method, path (keys redacted), status, latency, request id, Account name, timestamps	your calls	operation, debugging, security, support (you can quote a request id)	legitimate interest
Usage records: credits per Account, hour and class of call; monthly totals	your calls	metering, billing, limits, your usage history	contract; legal obligation for billing records (6.1.c)
Billing records: ledger of credits and debits, balances, plan and its status, spending cap, payment identifiers and amounts, refunds	you, public blockchains	billing, accounting, fraud handling	contract; legal obligation (accounting)
Wallet addresses and transactions: your Account's deposit address; the sender address, transaction hash, amount and block of deposits; the x402 payer address, network, transaction and amount	public blockchains, the x402 payment	crediting payments, preventing double crediting, accounting, binding an x402 wallet to its Account	contract; legal obligation
Webhook settings: endpoint URL, your description of it ("label", up to 200 characters), subscriptions and their filters (for example wallet addresses you watch), the signing secret (encrypted)	you	delivering events	contract
Webhook delivery log: request id, attempt, HTTP status, latency, the first 4 KiB of your endpoint's answer	your endpoint	delivery, retries, replay, support	contract
Support and contact emails	you	answering you	legitimate interest; contract
Admin log: changes made by Femtos staff to an Account (tier, grant, freeze…)	us	accountability, security	legitimate interest
Browser storage (section 11)	your browser	keep you signed in, preferences	necessary for the service you request

Payments are in USDC only today: we process no card data. Card payments will come later; this policy will be updated before they open, with the payment provider that handles them.

We do not sell personal data, do not use it for advertising, and do not use it to make decisions with legal or similarly significant effects on you.

Giving an email is optional (agent and x402 Accounts need none). Without one, sign-in by email and account recovery are not available, and some billing messages cannot reach you.

4. How long we keep it

As implemented today:

Data	Retention
Account data (email, agent name, owner email, key hash and encrypted key, management secret hash, bound x402 wallet, plan, grants)	until the Account is deleted; then removed from the live database at once
Sign-in and confirmation links	valid 15 minutes, single use; their hashes are deleted 24 hours after expiry, or with the Account
Signup IP hashes (daily free-signup cap)	48 hours
Proof-of-work salts	until they expire (10 minutes)
In-memory rate-limit counters (IP, key)	from a minute to an hour; lost on restart
Server logs (may include IP addresses and request data)	rotated by volume (5 files of 100 MB per service): older entries are overwritten as new ones arrive. A fixed maximum period will be set and published here
Webhook delivery log and outgoing messages	7 days
Webhook endpoints (URL, description, subscriptions, secret)	until you delete them; deleted automatically 30 days after the Account's key stops being active (Account deleted, or key no longer valid)
Usage records, billing ledger, monthly cycles, x402 payment records, deposit records	kept after the Account is deleted, linked only to an internal number, as accounting records: up to 10 years (article L123-22 of the French Commercial Code)
Deposit addresses	never deleted or reused (funds may still arrive after an Account is closed)
Database backups (encrypted keys, all of the above)	hourly, deleted after 30 days: deleted data disappears from backups within 30 days
Invoices and accounting documents	10 years (legal obligation)
Support emails	3 years after the last exchange

5. Recipients and processors

Personal data is accessible only to Femtos and to the following providers, within what they need:

Provider	Role	Data	Location
Amazon Web Services (AWS)	hosting: servers, databases, backups (Amazon S3)	everything in section 3	Tokyo region (ap-northeast-1), Japan
Amazon SES (AWS)	sending emails (sign-in and confirmation links)	email address, message content	Tokyo region (ap-northeast-1), Japan
Cloudflare	DNS, content delivery and hosting of femtos.xyz, secure tunnel to our servers, protection against attacks, access control of our admin pages, routing of emails sent to our addresses	IP address, request data, the content of requests and answers in transit, emails sent to us	global network; Cloudflare, Inc. is in the United States
Google (Gmail)	mailbox receiving the emails sent to contact@femtos.xyz	your emails to us	United States
Coinbase (Coinbase Developer Platform x402 facilitator), when used	settling x402 payments on Base and Arbitrum	payer address, signed payment authorisation, amount	United States
Public blockchains (HyperEVM, HyperCore, Base, Arbitrum, Elysium)	settlement of crypto payments	addresses, amounts and transactions are public by design and cannot be erased	decentralised

We may also disclose data to authorities when the law requires it, and to our accountants and legal advisers for billing and accounting records.

6. Transfers outside the European Union

Our servers are in Japan (AWS Tokyo region). Japan is covered by a European Commission adequacy decision (Decision (EU) 2019/419). Some providers are in the United States (Cloudflare, Google, Coinbase, Amazon's parent company): transfers to them rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses included in their data processing terms. You can ask us for a copy of the relevant safeguards.

7. Security

API keys and management secrets are never stored in clear in the database (hash plus encrypted copy for keys, hash only for secrets) and are never written to logs; sign-in and confirmation tokens are stored as hashes; the API servers listen only behind Cloudflare; backups are encrypted at rest; webhook signing secrets are encrypted. No system is perfectly secure: keep your key and management secret safe, and freeze your key at once if you think it leaked.

8. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to object to processing based on legitimate interest, to data portability, and to give instructions about your data after your death (French law). You can also lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07) or the authority of your EU country.

How to exercise them

Delete your Account yourself.
- Account with an email: dashboard (femtos.xyz/accounts/dashboard) or DELETE /accounts/me with your API key; we email a confirmation link, valid 15 minutes.
- Account without an email (Agents, x402): DELETE /accounts/me with Authorization: Bearer <API key> and X-Management-Secret: <management secret>; the deletion is immediate (HTTP 204).
- Deletion is refused while a plan is in force (cancel it first and wait for its end date) or while plan overage is unpaid. If your balance is positive, deletion goes ahead only after you explicitly confirm that you give up that balance (Terms, section 8.5).
- Deletion removes the Account data at once; the records listed in section 4 as kept after deletion stay, without the email, key or wallet binding; backups roll over within 30 days.
Other requests (access, copy of your data, rectification, objection…): write to contact@femtos.xyz. Since many Accounts have no email, we may ask you to prove you hold the Account, for example by calling an endpoint with your API key, giving the last 4 characters of the key, or signing a message with the paying wallet. We never ask for the full key or the management secret by email.
Rotate or freeze your key at any time (dashboard or API).

We answer within one month (extendable by two months for complex requests). Some data cannot be erased while we must keep it (accounting obligations, a pending dispute) or because it is on a public blockchain.

9. People named in the wallet registry

This section is the information notice of GDPR article 14 for people whose data we did not collect from them.

Femtos maintains a registry that associates some blockchain wallets with a named entity: public traders and commentators, funds, companies, projects. For each entity it may hold a name or pseudonym, a social media handle, aliases, categories (for example "trader", "fund"), the wallet addresses and chains attributed to it, a confidence level, the public source of the attribution and research notes.

Source: public lists, datasets and publications (on-chain analytics posts, public spreadsheets, statements by the person themselves), and our research on public blockchain data. We do not collect this data from the person.
Purpose: let our Customers see which public actor a wallet is attributed to, in market data and analytics.
Legal basis: our legitimate interest and that of our Customers in providing market information about public actors, balanced with the rights of the people concerned (GDPR art. 6.1.f).
Safeguards: the raw addresses of named wallets are replaced in our answers by stable pseudonymous handles; a name is presented as an attribution with its confidence, not as a verified identity; our Terms forbid using it to identify, track or harass private individuals.
Recipients: our Customers, through the API.
Retention: as long as the attribution remains relevant and sourced; entries are reviewed and removed when they no longer are.
Your rights: if you are named in it, you may ask for access, rectification (a wrong attribution) or erasure, and object at any time. We remove or correct the entry unless we have compelling legitimate grounds to keep it.

How to ask for a removal or a correction. Write to contact@femtos.xyz with the subject "Wallet registry", and give:

the name, pseudonym or handle shown, and the wallet addresses concerned if you know them;
what you ask: removal of the entry, removal of one attribution, or a correction (and what is wrong);
something that lets us check the request comes from the person named, when the request is about you: for example a message from the social media account named, or a message signed with one of the wallets. You do not need to send identity documents.

Anyone may also report an attribution they believe is wrong. We answer within one month, and tell you what we changed.

10. Public blockchain data

The Data we index comes from public blockchains: addresses and their transactions, balances, trades and positions. An address is a pseudonym, but it can relate to a person if it is linked to them elsewhere. We process this public data on the basis of our legitimate interest in providing blockchain data services. We cannot change or erase what is recorded on a blockchain. You may object to our processing of data about an address you control, by writing to contact@femtos.xyz; we will assess the request against the public nature of the data and our Customers' interest.

11. Cookies and browser storage

Femtos does not use advertising or analytics cookies and sets no cookie of its own on femtos.xyz. Our pages store in your browser's local storage: your API key once you sign in (dataapi.key, removed when you sign out), your theme and language, and the page to return to after a sign-in (30 minutes). These are strictly necessary for the service you ask for and need no consent. Cloudflare may set technical cookies used for security and protection against bots.