LEGAL / PRIVACY

Privacy Notice

Andromalius minimizes what it collects: submitted audit artifacts are transient by default, sales records omit payer identity, and public blockchain activity remains public.

Effective July 27, 2026Founding beta · United States business users only

1. Scope and operator

Andromalius is a software product provided by Richard Kowalczyk, a New York sole proprietor. This notice covers the website, public merchant API, support communications, and founding-beta audit purchases. Privacy questions may be sent to privacy@andromalius.io. Public operator location: New York, United States.

2. Information processed

  • Caller-supplied x402 challenges or OpenAPI documents.
  • Operational metadata such as IP address, time, route, user agent, request size, errors, abuse signals, and short-lived rate-limit state.
  • Payment and accounting data such as product, amount, network, asset, receiving address, transaction hash, settlement status, and timestamps.
  • Support messages and contact details you choose to provide.

Do not submit private keys, recovery phrases, credentials, unnecessary personal data, confidential customer data, or material you lack authority to process.

3. How information is used

Information is used to deliver reports, secure and rate-limit the service, verify and reconcile payments, investigate failures or abuse, provide support, maintain accounting and tax records, improve reliability, enforce our policies, and comply with law. Where a law requires a legal basis, these purposes rely on contract performance, legitimate operational interests, consent where requested, and legal obligations as applicable.

4. Retention

  • Submitted audit artifacts are processed in memory and not retained by default.
  • The durable sales ledger retains transaction and accounting data, without payer identity or submitted artifacts, for up to seven years where needed for tax, accounting, fraud, dispute, and legal obligations.
  • Encrypted daily backups expire after 30 days and encrypted monthly backups expire after 365 days under the current founding-beta configuration.
  • Privacy-minimized Better Stack telemetry is currently subject to the configured provider retention, presently three days on the applicable free allowance.
  • Infrastructure providers may retain security, request, account, and transaction records under their own contracts and legal duties; Railway plan logs may be available for up to 30 days.
  • Support records are kept only as long as reasonably necessary for the request.

5. Service providers and public systems

We use service providers for website and API hosting, DNS and edge security, role-email routing, encrypted backups, telemetry, payment facilitation, and public discovery. Current providers include Railway, Cloudflare, Better Stack, Coinbase Developer Platform, x402scan, Poncho, the website hosting provider, and the domain registrar. Professional advisers and authorities may receive information when reasonably necessary or legally required.

Base blockchain transfers, receiving addresses, amounts, and transaction hashes are public and generally immutable. x402scan, Poncho, block explorers, and other third parties may independently index that public activity. We do not sell audit inputs or wallet-level behavioral profiles.

6. Security and international processing

We use access controls, encryption, data minimization, bounded inputs, secret redaction, rate limits, monitoring, and tested backups. No system or blockchain transaction is risk-free. Providers may process information in the United States and other locations where they operate, subject to their safeguards and applicable law.

7. Choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, or a copy of information associated with you. Send requests to privacy@andromalius.io. We may verify authority, preserve information required for accounting, security, disputes, or law, and cannot alter public blockchain records controlled by the network.

8. Business-only service and changes

The founding beta is not directed to children or people under 18 and is limited to United States business users. Material changes to this notice will be posted with a revised effective date.