# Femtos Privacy Policy

Last updated 2026-10-22.

This policy explains what personal data Femtos processes, why, for how long, who receives it and how you can
exercise your rights under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act
(loi Informatique et Libertés). It is also available in French at https://femtos.xyz/fr/privacy.

## 1. Controller

**Femtos**. Privacy contact: contact@femtos.xyz. Femtos is being registered as a company in France; its full legal
identity (company name, registration number, registered office) will be added here as soon as the registration is
complete. No data protection officer is appointed (not required for Femtos's activity).

## 2. Who this policy is about

- **Visitors** of femtos.xyz and docs.femtos.xyz;
- **Customers** and **API users**: people who hold an Account (email signup), operators of Agents (agent signup or
  x402 payment), and the people they let use their key;
- **Payers**: people who pay in USDC to a deposit address or by x402;
- **People named in the wallet registry** (section 9);
- **People whose public blockchain activity** appears in the Data (section 10).

## 3. Data we process, purposes and legal bases

| Data | Where it comes from | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| **Email address** (optional: human signup; for agents, an optional `owner_email`, never verified and never written to) | you | Account, sign-in links, confirmations of key rotation / deletion / unfreeze, billing messages | contract (6.1.b) |
| **Agent name** (`agent_name`, free text you choose) | you | identify the Account in your dashboard | contract |
| **API key**: stored as a SHA-256 hash plus an encrypted copy (AES-256-GCM), last 4 characters for display. **Management secret**: SHA-256 hash only | generated by us | authentication, key files of the API servers | contract |
| **IP address** | your connection, via Cloudflare | rate limiting per address (in memory, minutes to an hour); the daily cap on free signups (a keyed hash, HMAC, of the address, not the address itself); security; it may also appear in server logs | legitimate interest in protecting the Services and preventing abuse (6.1.f) |
| **Request data**: method, path (keys redacted), status, latency, request id, Account name, timestamps | your calls | operation, debugging, security, support (you can quote a request id) | legitimate interest |
| **Usage records**: credits per Account, hour and class of call; monthly totals | your calls | metering, billing, limits, your usage history | contract; legal obligation for billing records (6.1.c) |
| **Billing records**: ledger of credits and debits, balances, plan and its status, spending cap, payment identifiers and amounts, refunds | you, public blockchains | billing, accounting, fraud handling | contract; legal obligation (accounting) |
| **Wallet addresses and transactions**: your Account's deposit address; the sender address, transaction hash, amount and block of deposits; the x402 payer address, network, transaction and amount | public blockchains, the x402 payment | crediting payments, preventing double crediting, accounting, binding an x402 wallet to its Account | contract; legal obligation |
| **Webhook settings**: endpoint URL, your description of it ("label", up to 200 characters), subscriptions and their filters (for example wallet addresses you watch), the signing secret (encrypted) | you | delivering events | contract |
| **Webhook delivery log**: request id, attempt, HTTP status, latency, the first 4 KiB of your endpoint's answer | your endpoint | delivery, retries, replay, support | contract |
| **Support and contact emails** | you | answering you | legitimate interest; contract |
| **Admin log**: changes made by Femtos staff to an Account (tier, grant, freeze…) | us | accountability, security | legitimate interest |
| **Browser storage** (section 11) | your browser | keep you signed in, preferences | necessary for the service you request |

Payments are in USDC only today: we process no card data. Card payments will come later; this policy will be updated
before they open, with the payment provider that handles them.

We do not sell personal data, do not use it for advertising, and do not use it to make decisions with legal or
similarly significant effects on you.

Giving an email is optional (agent and x402 Accounts need none). Without one, sign-in by email and account recovery
are not available, and some billing messages cannot reach you.

## 4. How long we keep it

As implemented today:

| Data | Retention |
|---|---|
| Account data (email, agent name, owner email, key hash and encrypted key, management secret hash, bound x402 wallet, plan, grants) | until the Account is deleted; then removed from the live database at once |
| Sign-in and confirmation links | valid 15 minutes, single use; their hashes are deleted 24 hours after expiry, or with the Account |
| Signup IP hashes (daily free-signup cap) | 48 hours |
| Proof-of-work salts | until they expire (10 minutes) |
| In-memory rate-limit counters (IP, key) | from a minute to an hour; lost on restart |
| Server logs (may include IP addresses and request data) | rotated by volume (5 files of 100 MB per service): older entries are overwritten as new ones arrive. A fixed maximum period will be set and published here |
| Webhook delivery log and outgoing messages | 7 days |
| Webhook endpoints (URL, description, subscriptions, secret) | until you delete them; deleted automatically 30 days after the Account's key stops being active (Account deleted, or key no longer valid) |
| Usage records, billing ledger, monthly cycles, x402 payment records, deposit records | kept after the Account is deleted, linked only to an internal number, as accounting records: up to 10 years (article L123-22 of the French Commercial Code) |
| Deposit addresses | never deleted or reused (funds may still arrive after an Account is closed) |
| Admin log (changes made by Femtos staff to an Account: what was changed, when, by which staff member, the state before and after, a note) | 36 months after each change, then deleted. When the Account is deleted, its rows stay with only what was done, when and by whom, linked to an internal number: the note and the last 4 characters of the key are erased |
| Database backups (encrypted keys, all of the above) | hourly, deleted after 30 days: deleted data disappears from backups within 30 days |
| Invoices and accounting documents | 10 years (legal obligation) |
| Support emails | 3 years after the last exchange |

## 5. Recipients and processors

Personal data is accessible only to Femtos and to the following providers, within what they need:

| Provider | Role | Data | Location |
|---|---|---|---|
| **Amazon Web Services** (AWS) | hosting: servers, databases, backups (Amazon S3) | everything in section 3 | Tokyo region (ap-northeast-1), Japan |
| **Amazon SES** (AWS) | sending emails (sign-in and confirmation links) | email address, message content | Tokyo region (ap-northeast-1), Japan |
| **Cloudflare** | DNS, content delivery and hosting of femtos.xyz, secure tunnel to our servers, protection against attacks, access control of our admin pages, routing of emails sent to our addresses | IP address, request data, the content of requests and answers in transit, emails sent to us | global network; Cloudflare, Inc. is in the United States |
| **Google** (Gmail) | mailbox receiving the emails sent to contact@femtos.xyz | your emails to us | United States |
| **Coinbase** (Coinbase Developer Platform x402 facilitator), when used | settling x402 payments on Base and Arbitrum | payer address, signed payment authorisation, amount | United States |
| **Hyperliquid** (api.hyperliquid.xyz) | public Hyperliquid data: our Hyperliquid-compatible API forwards some `/info` requests to it; the Hyperliquid-compatible page of femtos.xyz also sends the request you run there to it, straight from your browser, to compare the answers | forwarded requests: their content (for example the addresses queried), without your IP address or API key; the page's calls: your IP address, browser request data and the request's content | not published by Hyperliquid |
| **Public blockchains** (HyperEVM, HyperCore, Base, Arbitrum, Elysium) | settlement of crypto payments | addresses, amounts and transactions are public by design and cannot be erased | decentralised |

We may also disclose data to authorities when the law requires it, and to our accountants and legal advisers for
billing and accounting records.

## 6. Transfers outside the European Union

Our servers are in **Japan** (AWS Tokyo region). Japan is covered by a European Commission adequacy decision
(Decision (EU) 2019/419). Some providers are in the **United States** (Cloudflare, Google, Coinbase, Amazon's parent
company): transfers to them rely on the EU-US Data Privacy Framework where the provider is certified under it, and
otherwise on the European Commission's standard contractual clauses included in their data processing terms. You can
ask us for a copy of the relevant safeguards.

## 7. Security

API keys and management secrets are never stored in clear in the database (hash plus encrypted copy for keys, hash
only for secrets) and are never written to logs; sign-in and confirmation tokens are stored as hashes; the API
servers listen only behind Cloudflare; backups are encrypted at rest; webhook signing secrets are encrypted. No
system is perfectly secure: keep your key and management secret safe, and freeze your key at once if you think it
leaked.

## 8. Your rights

You have the right to **access** your data, to have it **rectified** or **erased**, to **restrict** its processing,
to **object** to processing based on legitimate interest, to **data portability**, and to give instructions about
your data after your death (French law). You can also lodge a complaint with the **CNIL** (www.cnil.fr, 3 place de
Fontenoy, TSA 80715, 75334 Paris Cedex 07) or the authority of your EU country.

**How to exercise them**

- **Delete your Account yourself.**
  - Account with an email: dashboard (https://femtos.xyz/accounts/dashboard) or `DELETE /accounts/me` with your API
    key; we email a confirmation link, valid 15 minutes.
  - Account without an email (Agents, x402): `DELETE /accounts/me` with `Authorization: Bearer <API key>` **and**
    `X-Management-Secret: <management secret>`; the deletion is immediate (HTTP 204).
  - Deletion is refused while a plan is in force (cancel it first and wait for its end date) or while plan overage
    is unpaid. If your balance is positive, deletion goes ahead only after you explicitly confirm that you give up
    that balance (Terms, section 8.5).
  - Deletion removes the Account data at once; the records listed in section 4 as kept after deletion (accounting records, deposit
    addresses, the admin log without its notes or key characters) stay, without
    the email, key or wallet binding; backups roll over within 30 days.
- **Other requests** (access, copy of your data, rectification, objection…): write to contact@femtos.xyz. Since many
  Accounts have no email, we may ask you to prove you hold the Account, for example by calling an endpoint with your
  API key, giving the last 4 characters of the key, or signing a message with the paying wallet. We never ask for the
  full key or the management secret by email.
- **Rotate or freeze** your key at any time (dashboard or API).

We answer within one month (extendable by two months for complex requests). Some data cannot be erased while we must
keep it (accounting obligations, a pending dispute) or because it is on a public blockchain.

## 9. People named in the wallet registry

This section is the information notice of GDPR article 14 for people whose data we did not collect from them.

Femtos maintains a registry that associates some blockchain wallets with a named entity: public traders and
commentators, funds, companies, projects. For each entity it may hold a name or pseudonym, a social media handle,
aliases, categories (for example "trader", "fund"), the wallet addresses and chains attributed to it, a confidence
level, the public source of the attribution and research notes.

- **Source**: public lists, datasets and publications (on-chain analytics posts, public spreadsheets, statements by
  the person themselves), and our research on public blockchain data. We do not collect this data from the person.
- **Purpose**: let our Customers see which public actor a wallet is attributed to, in market data and analytics.
- **Legal basis**: our legitimate interest and that of our Customers in providing market information about public
  actors, balanced with the rights of the people concerned (GDPR art. 6.1.f).
- **Safeguards**: the raw addresses of named wallets are replaced by stable pseudonymous handles in the answers of
  our own API (REST, WebSocket, MCP, webhooks); our Hyperliquid-compatible API (`/info` and its WebSocket) returns
  raw addresses, as Hyperliquid's own API does; a name is presented as an attribution with its confidence, not as a
  verified identity; our Terms forbid using it to identify, track or harass private individuals.
- **Recipients**: our Customers, through the API.
- **Retention**: as long as the attribution remains relevant and sourced; entries are reviewed and removed when they
  no longer are.
- **Your rights**: if you are named in it, you may ask for access, rectification (a wrong attribution) or erasure, and
  **object** at any time. We remove or correct the entry unless we have compelling legitimate grounds to keep it.

**How to ask for a removal or a correction.** Write to **contact@femtos.xyz** with the subject "Wallet registry", and
give:
- the name, pseudonym or handle shown, and the wallet addresses concerned if you know them;
- what you ask: removal of the entry, removal of one attribution, or a correction (and what is wrong);
- something that lets us check the request comes from the person named, when the request is about you: for example a
  message from the social media account named, or a message signed with one of the wallets. You do not need to send
  identity documents.

Anyone may also report an attribution they believe is wrong. We answer within one month, and tell you what we
changed.

## 10. Public blockchain data

The Data we index comes from public blockchains: addresses and their transactions, balances, trades and positions.
An address is a pseudonym, but it can relate to a person if it is linked to them elsewhere. We process this public
data on the basis of our legitimate interest in providing blockchain data services. We cannot change or erase what is
recorded on a blockchain. You may object to our processing of data about an address you control, by writing to
contact@femtos.xyz; we will assess the request against the public nature of the data and our Customers' interest.

## 11. Cookies and browser storage

Femtos does not use advertising or analytics cookies and sets no cookie of its own on femtos.xyz. Our pages store in
your browser's local storage: your API key once you sign in (`dataapi.key`, removed when you sign out), your theme and
language, and the page to return to after a sign-in (30 minutes). These are strictly necessary for the service you
ask for and need no consent. Cloudflare may set technical cookies used for security and protection against bots.

## 12. Minors

The Services are not directed to children. Paid services are for adults only (Terms, section 3.4).

## 13. Changes

We will publish any change to this policy here with its date, and notify Customers with an email address of material
changes.

## 14. Contact

Femtos. Privacy: contact@femtos.xyz.