Privacy policy

What we store, and for how long

agentsvc.io sells web, data and crypto services to AI agents, paid per call. There are no user accounts. This page explains which personal data that involves, under the EU General Data Protection Regulation (GDPR). Last updated 17 October 2026.

Who is responsible

The controller under the GDPR is the operator of agentsvc.io:

Write to this address for all privacy questions and requests.

In short

• No account, no name, no e-mail address is needed to use the services. Payments come from a crypto wallet or a prepaid token.
• No cookies, no tracking pixels, no advertising networks, nothing is stored in your browser.
• We keep IP addresses at most 90 days. Payments are kept 10 years for bookkeeping.
• What you send to a service is processed to answer that call. Some services pass it to a third party, listed below.
• We do not sell personal data and do not use it for advertising or to train AI models.

Using the services (HTTP, MCP, A2A)

When an agent calls a service we process: the IP address and user agent of the request, the time, the service and its input (for example a URL, a token address or a text), the result status, and for paid calls the payment: wallet address, amount, network and transaction. We need this to run the call, to verify and settle the payment, to stop abuse and to fix errors. Legal basis: performance of the contract you start with each call (Art. 6(1)(b) GDPR) and our legitimate interest in a secure, working service (Art. 6(1)(f)).

Inputs are not kept as part of the normal call record. They are kept in shortened form for 30 days in the payment journal, for 90 days when a request was rejected (to find out why), and the operator receives an e-mail for each sale that includes a short summary of the input. Wallet addresses and transactions are public on the blockchain.

Do not send personal data of other people (for example names, e-mail addresses or documents about them) to a service unless you are allowed to. For text that may contain such data, pii-redact removes it before it goes anywhere else.

Prepaid credit and OAuth

A credit token (asvc_cr_...) is shown once; we store only its SHA-256 hash, the paying wallet and the balance. When you connect a client such as Claude or ChatGPT with OAuth at /mcp/credit, we store the client name and redirect address it registered and hashes of the access and refresh tokens, linked to your credit. You enter the credit token on our page; it is not passed to the client.

agent-memory and agent-inbox

These services store what you put into them: values under a key, or messages sent to an inbox, until they expire (1 to 365 days, your choice, default 30; read messages 7 days). Access is protected by a secret that only you hold; we store only its hash and cannot recover it. Anyone who has the secret can read the data, so share it only with agents you trust. An inbox webhook receives each new message at the address you gave.

Website and statistics

The web server logs each request (IP address, user agent, path, status, time) for security and error analysis, kept 30 days in the database and then as an archive until day 90. For page statistics the site sends the page, referrer, browser, operating system, screen size and campaign parameters; we look up the country and city in a local database (DB-IP, no external request) and store the IP address shortened to its first three parts (IPv4) or first 48 bits (IPv6). There is no cookie and nothing in localStorage: an ID lives only while the page is open. Legal basis: legitimate interest in knowing which pages are used (Art. 6(1)(f)). Fonts are served from our own server.

E-mail

Messages to agents@agentsvc.io are received and stored by Google (Gmail). Replies may be drafted with the help of an AI model (Claude by Anthropic) and are sent from that address. Legal basis: Art. 6(1)(b) and (f) GDPR.

Who else receives data

• Hosting: Hetzner Online GmbH, Germany (server and encrypted backups). Processor under Art. 28 GDPR.
• Payment settlement: Coinbase (CDP facilitator, USA) and PayAI receive the signed payment (wallet address, amount) to verify and settle it on the blockchain. The blockchain is public.
• AI services (page-summarize, page-extract, answer-with-sources, research-report, agent-run, token-ai-verdict, prompt-injection-check, news-sentiment, image-alt-text, seo-meta, scam-message-check, invoice-extract, text-classify): the input or the fetched page is sent to Anthropic (Claude, USA) to produce the answer. Under Anthropic's commercial terms it is not used for training.
• Data sources the service asks for you: to answer a call we contact the source it needs, for example the web page you want to read, blockchain nodes (publicnode, Tenderly, Coinbase, Helius and others) for a wallet or token, the mail server of an address you verify, Crossref and OpenAlex for citations, package registries for package-check, GLEIF and the EU VIES service for companies, MET Norway for weather at your coordinates. They see our server, not you, and only the data of that request.
• Webhooks: the address you configured receives the results you asked for.

Transfers to the USA (Coinbase, Anthropic, Google) rely on the EU-U.S. Data Privacy Framework where the recipient is certified, otherwise on the EU standard contractual clauses (Art. 46 GDPR).

Retention

Server logs (IP address, user agent, path, status)

30 days in the database, then compressed archive; deleted after 90 days.

Service call records (service, time, result, IP address, user agent)

IP address removed after 90 days; rest kept for statistics without personal reference.

Rejected and unpaid requests (IP, headers, your input, payment attempt)

90 days; then IP, headers, input and payment data are removed.

Payment journal (your input, shortened, for reconciling payments)

30 days; deleted.

Payments (wallet address, amount, transaction hash, service)

10 years; required for bookkeeping; this data is public on the blockchain anyway.

Prepaid credit (hash of the token, paying wallet, balance)

180 days after the last top-up; then expired.

agent-memory values and agent-inbox messages

what you set: 1 to 365 days (default 30); read messages after 7 days; deleted earlier with op delete.

Watch states and webhook watches

30 days, or until the watch expires; deleted.

OAuth connections (client name, redirect address, token hashes)

30 days (access) and 180 days (refresh); deleted when expired.

Website statistics (pages, referrer, browser, country, shortened IP)

IP removed after 90 days; no cookies, nothing stored in your browser.

E-mails to agents@agentsvc.io

as long as needed to answer; in the mailbox at Google.

Tax law requires us to keep payment records for 10 years (Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB).

Your rights

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a common format, and you can object to processing based on legitimate interest (Art. 15 to 21 GDPR). Write to agents@agentsvc.io. Because there are no accounts, tell us what identifies your data, for example the wallet address, the IP address and time, or the inbox address. You can also complain to a data protection supervisory authority, for example in the EU country where you live.

Changes

When the services change, this page changes with them; the date at the top shows the last update. Related: terms of service, docs, credit, security contact.