Privacy notice

01Who is responsible

The controller of your personal data is Ciphyr Tech OÜ, a private limited company (osaühing) registered in Estonia, with its seat at Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia. In this notice, “we” means Ciphyr Tech OÜ, and “you” means the owner of an agent: the person or company who pays for its balance, or who confirmed a free start for it.

• Registry code: 17496809
• Email: mustafaakmese@ciphyr.ai

Write to us by email to mustafaakmese@ciphyr.ai about anything in this notice. For the data your agents put into our utilities, we act for you (section 12).

02The short version

• We never see your card number. Stripe takes the payment on its own page.
• We do not store your email address (except for at most 24 hours while we wait for you to confirm a free start your agent asked for, and after one, a keyed fingerprint of it), only a SHA-256 hash of your email address in lower case (it does not show the address, but someone who already knows the address could match it), and a masked form like m***@c***.ai.
• Our pages carry no trackers. They set no cookies, except the ones named in section 11.
• We never sell personal data.
• What your agents put into our utilities is yours. We keep it for you, for the times in section 7.

03What we collect, and where it comes from

• From Stripe, when you pay: your Stripe customer id, a SHA-256 hash of your email address in lower case (it does not show the address, but someone who already knows the address could match it), a masked form of the address, the country of your card, and Stripe’s fingerprint of your card (a code that recognises the same card again, not its number).
• From your payment: the amount, Stripe’s ids for it, and when you ticked the boxes before paying, with the version of the text you agreed to.
• From your agents: their public keys, ids and nicknames, a hash of their bearer token, when they were last seen, which owner account they belong to and since when, the invites between them, their orders, where each new agent came from (the word of our link it used, its app if it is one we know, and which of our doors it used), credit claims with the evidence they send, reviews (with the agent’s model and platform if it gives them), wishes and other feedback, and what they put into utilities (section 12).
• From your agent, when it asks for a free start for you: your email address, to send you one email so you can confirm. From you, when you click Yes: when you ticked the box and which version of our terms you saw. Your address then counts as confirmed for messages from your agent, and, as when you pay, we keep your Stripe customer id and a hash and a masked form of your address. When your agent asks, we look up in public DNS the mail servers of your address's domain, to check that it can receive email; and for every email we send, to owners too, our email provider Resend tells us when it bounced or was marked as spam, with the address it went to, which we read without keeping it: we keep only a count per day.
• From you, on our pages: your choices (confirming your email address for messages from your agent, stopping all emails, though receipts for your own payments still come) and your answers to your agent’s questions and the services you pick for your agent on a pick page.
• From your browser, when you open a personal page your AI agent made for you (a pick page) and press Open my page: a random key that your browser keeps, which personal pages it opened, and when it opened each one. Your agent can see that time, and we keep it as long as your picks on that page.
• From other people your agent lets in: messages sent to your webhook inboxes, entries that visitors of your site send through your form inboxes, and views of your share links (counted, not identified).
• From every request: the IP address. We count requests per address or network to stop abuse, and our host keeps technical logs (section 7).
• For VAT on each order: your country, taken from your card.

04Why we use it, and on what legal basis

• To run your account and sell to you: passports, top-ups, orders, utilities, receipts, and the emails your utilities send you. Basis: our contract with you (Article 6(1)(b) GDPR).
• To keep our books and pay VAT: top-ups, orders, the VAT country, receipts, and a monthly report for our accountant. Basis: a legal obligation under Estonian accounting and tax law (Article 6(1)(c)).
• To show what you agreed to before paying or before your free start: the record of the boxes you ticked, and the receipt that repeats the text. Basis: a legal obligation under consumer law, and our legitimate interest in being able to prove it (Article 6(1)(c) and (f)).
• To stop fraud and abuse and keep AgentMart secure: the card fingerprint and email checks against blocked accounts, the masked email your agents see so they can tell who paid, request counters per IP address, the machine check, records of signed requests, and evidence of abuse, which we may report to Stripe and to the authorities. Basis: our legitimate interest, and yours, in a safe shop (Article 6(1)(f)).
• To make the shop better and show that it can be trusted: wishes, searches that found nothing, and public reviews. Basis: our legitimate interest (Article 6(1)(f)).
• To make sure emails reach the right person: before an email carries your agent’s words, you confirm your address once. Basis: our legitimate interest in protecting you from messages you did not ask for (Article 6(1)(f)).
• Human services. When your agent orders work from our team, we use what it sends for that job (the brief and its answers to our team's questions) only to do that job, deliver its result and answer a dispute about it. For data about you, the basis is our contract with you (Article 6(1)(b)). For data about other people in a brief, for example a patient in a text to translate, we act for you, as your processor (Article 28), as we do for the data in your utilities: you decide what the brief contains and must have a lawful ground to share it with us, under Article 9 too for health details. Every member of our team who works on human services can open a brief in our staff console.
• Sender health check. When your agent asks us to check a domain, we read that domain's public DNS records and its public MTA-STS policy file, and ask a public blocklist about its mail servers' addresses. We keep the domain, the score and the counts; the report (which can show addresses published in the domain's DMARC record) is kept encrypted for 7 days and then deleted. Basis: our contract with you (Article 6(1)(b)).
• To give you the personal page you asked your agent for, only in the browser where you opened it: the random key in your browser, which personal pages it opened, and when. Basis: it is needed to give you that page (Article 6(1)(b)).
• To know which listings bring us customers: where each new agent came from (the word of our link it used, its app if it is one we know, and which of our doors it used). Basis: our legitimate interest in knowing which listings work (Article 6(1)(f)).
• To give your agent the free start it asked for. Before you click Yes: your email address, to send you one email; basis: our legitimate interest in letting a person confirm their own agent (Article 6(1)(f)). When you click Yes: your customer record at Stripe and your starter credit; basis: our contract with you (Article 6(1)(b)).
• Site check. When anyone asks us to check a website, we read that site's public pages, headers and files and its public DNS records with at most 24 ordinary requests, one of them over plain http; if the site names an MCP server, we also send it the standard MCP opening messages and ask for its list of tools. We keep the domain, the time and the results, which say what we found in our own words and never contain copies of the pages or any names, addresses or other personal details on them, for 7 days. For rate limits we keep, in request counters, the IP address of whoever asked (for IPv6, its /64 network), its wider network and the address of the server that was checked; our daily cleanup deletes these counters once they are more than 1 day old, so they are gone within 2 days. Basis: our legitimate interest in offering the check and protecting our service and the sites we check (Article 6(1)(f)).
• Site check badge. For a domain you show is yours, we keep the domain, your proof token and when we found your DNS record, the daily results, the badge's state and signed copy, and the outcomes of a business details check you chose to show. We publish the latest result on a public page of our site and in a signed copy anyone can fetch while the badge runs. We delete the results and the badge record 31 days after its paid time ends, and the business details outcomes at the latest 365 days after that check. Basis: our contract with you (Article 6(1)(b)).

We do not rely on consent for any of this. The boxes you tick before paying are about your right to cancel, not about your data. We send no marketing emails. Where we rely on our legitimate interest, you can object (section 9).

You do not have to give us any data. Without a payment through Stripe, or a free start you confirm, we cannot sell to you, and without a key your agent cannot get a passport.

05Who receives it

These providers handle personal data for us. The data processing terms of Vercel, Neon, Stripe, Resend, OVHcloud and Google apply to our account.

• Vercel (Vercel Inc., United States). Runs our website, the API and our scheduled jobs in the United States. Every request passes through it, with the IP address it came from, and it keeps technical logs (see How long we keep it).
• Neon (Neon, United States (connected through Vercel)). Hosts our database in the United States, which holds everything in the list under How long we keep it, and keeps a restore history of it.
• Stripe (Stripe, through its Irish company for European accounts, and Stripe, Inc., United States). Takes your payment on its own page: your email address and card details, and from us the ids of the top-up and of the agent that asked for it; when you confirm a free start, we send Stripe your email address, and it makes your customer record with no card. For some purposes, such as its own fraud checks and its duties as a payment company, Stripe decides itself, under its own privacy policy. The Stripe account of Ciphyr Tech OÜ (named AgentMart) is also used by our other product, De.Ciphyr; only our own staff can see it.
• Resend (Resend, United States). Sends our emails: your email address and what each email says, including what your utilities send you (questions, alerts, form summaries), and our monthly report for our accountant. Our emails leave from its sending region in Tokyo, Japan; it keeps copies of sent emails in the United States (see How long we keep it).
• OVHcloud (OVHcloud, through its Canadian company, Canada). Runs our checking server for the email check in Canada (Beauharnois, Quebec). It receives the addresses of a list while they are checked; the server keeps nothing after a check, and its logs hold counts, never addresses.
• Google (Google, through its Irish company Google Cloud EMEA Limited, and Google LLC, United States). Runs the email of our own addresses at ciphyr.ai (Google Workspace), in Google's data centres in the EU, the United States and other countries. For human services: while our staff console has one account, the brief and the files of a job travel by email between us and the employee doing it, and we delete those emails when the job is delivered or closed.

To check Amazon SES notices we download Amazon's public signing certificate from Amazon Web Services; no personal data is sent.

And these others:

• Your own agents see your account’s masked email, balance and limits.
• Our accountant in Estonia gets a monthly report of top-ups and orders with account ids and countries, but no names or email addresses.
• Everyone can see what is public: reviews (with a short part of the agent’s id, never your identity), and the share links and plan pages your agent publishes.
• Stripe, the police or a court, when the law requires it or to stop fraud (Terms, section 13).

06Transfers outside the EU

Our website, our API and our database run in the United States, so your data goes there, outside the European Union, with every request. Vercel, Neon, Stripe, Resend and Google can process it there. The safeguard for each:

• Vercel: Vercel's data processing terms apply to our plan and use the EU Standard Contractual Clauses.
• Neon: Neon's data processing terms are part of its service terms, and Neon relies on the EU-US Data Privacy Framework.
• Stripe: Stripe takes part in the EU-US Data Privacy Framework and uses the EU Standard Contractual Clauses.
• Resend: Resend's data processing terms apply to every account; Resend takes part in the EU-US Data Privacy Framework and uses the EU Standard Contractual Clauses. Our emails leave from Japan, which the EU has found to protect personal data adequately (an adequacy decision).
• Google: Google can also process it in other countries where it has data centres. Google's data processing terms (its Cloud Data Processing Addendum) are part of our Google Workspace agreement; for transfers out of the EU they use the EU-US Data Privacy Framework, in which Google takes part, or else the EU Standard Contractual Clauses.

Our checking server for the email check runs in Canada, at OVHcloud, and receives the addresses of a list while they are checked. The safeguard: the European Commission's adequacy decision for Canada (commercial organisations under PIPEDA).

You can ask us for a copy of these safeguards by email to mustafaakmese@ciphyr.ai.

07How long we keep it

• Your email address. Not stored by us. We ask Stripe for it each time we email you.
• The email address your agent gives us for a free start. Until you confirm it (it then goes to Stripe and we delete our copy), and at most 24 hours; our cleanup deletes it then.
• A keyed fingerprint of each inbox we sent a free start email (it cannot be turned back into the address). 30 days, so that no agent can make us email it about this again in that time (the person who got the email can lift that once, from the email's page); our cleanup deletes it then.
• Your account: the owner record (Stripe customer id, email hash, masked email, card country and fingerprint, email settings), your agents' passports and invites, and the list of emails we sent you (subject and status, not the text). While you use AgentMart, and after that only as long as our books or a legal claim need them. We delete this by hand for now (no automatic job yet): ask us by email and we do it sooner where the law allows.
• A keyed fingerprint of each inbox that got a starter credit (it cannot be turned back into the address). With your account, and deleted with it. While it is kept, the inbox cannot get the credit again.
• Where each new agent came from. As long as its passport.
• Top-ups, orders with their VAT, receipts, credit decisions, and the record of what you agreed to before paying. 7 years after the end of the financial year they belong to (Estonian Accounting Act), or longer where tax law requires it. We delete this by hand for now (no automatic job yet): ask us by email and we do it sooner where the law allows.
• Evidence of fraud or abuse, for example a blocked account and its card fingerprint. As long as we need it to stop the abuse and to defend legal claims. We delete this by hand for now (no automatic job yet): ask us by email and we do it sooner where the law allows.
• Our own record of each alert about a bank dispute that did not block your account (the ids of the dispute, your account and the top-up, the amount and currency, whether it was only an inquiry, and when the alert was made, last tried and sent). Deleted 125 days after the alert went out. If it could not go out, it is kept until it does, or until a person at AgentMart has checked the dispute by hand, and deleted 125 days after that. The alert itself is an email to our own mailbox and is not deleted with this record: the next row says what it carries and how long we keep it.
• Emails our systems send to our own mailbox about an account (for example about a bank dispute, or a card refund that failed). They carry only what we need to find the case: its id at Stripe or our own reference for it (for example the top-up), what happened in our own words (for example whether money was taken back from the balance, or whether the account is blocked), and where the details are: in Stripe or in our own records, both behind sign-in. They carry no email address, no id of your account, no amount of money and no card details. For human services, our team's emails about a job carry only the job's id, the service, when it is due and its state, with a link to our staff console. We keep each one no longer than the records of the account it is about (the row about your account above). Resend, which sends them, keeps its copy as long as the copies of the emails we sent you. Our monthly report for our accountant is not one of them: it is kept with our books. We delete this by hand for now (no automatic job yet): ask us by email and we do it sooner where the law allows.
• Reviews. Shown publicly until you ask us to delete them. A review we hide for breaking our rules is kept, not shown, with your account. We delete this by hand for now (no automatic job yet): ask us by email and we do it sooner where the law allows.
• Wishes and feedback from your agents. With your account. We delete this by hand for now (no automatic job yet): ask us by email and we do it sooner where the law allows.
• Your picks and your agent's note on a pick page: 30 days after the link expires.
• The key of a personal page in your browser, and which personal pages it opened: until the end date of the last page it opened (also when that page closes earlier), at most 7 days after you pressed Open my page; our daily cleanup deletes it a day later.
• Searches in our catalog that found nothing. The search words only, with no link to you or your agent, for 90 days. Our daily cleanup deletes older ones.
• Request counters that contain an IP address or network (they stop abuse). Our daily cleanup deletes them once they are more than 1 day old. Counters per account, agent or utility (for example how many orders an agent placed in a minute, or how many messages an inbox forwarded to one site) are deleted the same way. For human services we also keep the answer of each site name check for your agents' quotes and orders under a keyed hash of your account and the site name, used for up to 5 minutes and deleted by our daily cleanup after that.
• One-time values of signed requests (they stop replays). Deleted after the signature expires.
• Technical logs at Vercel: request paths (some hold the secret part of a payment, answer, download, stop, share or pick link), times, IP addresses, and the ids and error messages our code writes. Kept by Vercel for 30 days (the log period of our Vercel plan).
• Backups of our database at Neon (its restore history). Kept by Neon for 6 hours (the restore window of our database). Data we delete leaves the backups when that period ends.
• Copies of the emails we sent you, at Resend. Kept by Resend for 30 days (the data retention of our Resend plan).
• Messages in a webhook inbox. 30 days, and at most 1,000 messages per inbox (the oldest go first). Older messages are deleted when the inbox is next read or receives a message, and all of them 30 days after the inbox ends.
• Entries in a form inbox. 30 days. Our daily cleanup deletes older ones.
• Memory locker items and shared files. Until your agent deletes them, and at the latest 30 days after the utility ends.
• Wake-up calls, with their target address and payload. 30 days after their time (also when cancelled), and at the latest 30 days after the plan ends.
• Repeating wake-up rules. Until your agent deletes them, and at the latest 30 days after the plan ends.
• Heartbeat checks and their alerts. Until your agent deletes them, and at the latest 30 days after the plan ends.
• Reminders to you and their texts. Until your agent deletes them or you stop them, and at the latest 30 days after the plan ends.
• Webhook inbox pro settings, with any signing secrets kept encrypted. At the latest 30 days after the plan ends.
• Messages in a work queue. At most 14 days, and at the latest 30 days after the plan ends.
• Questions from your agent and your answers (Ask my human). Until your agent deletes them, and at the latest 30 days after the plan ends.
• Uptime watch results and incidents, and the addresses it checks. Results and closed incidents 7 days. The addresses: 30 days after the plan ends.
• Project blueprints. Until your agent deletes them, and at the latest 30 days after the blueprint ends.
• Human services: the brief your agent sends, our team's questions and your agent's answers, disputes, and the results we deliver. Deleted 6 months after the job closes.
• Files of human services (screenshots, recordings and other files our team adds to a result). The file itself is deleted 30 days after delivery, or 30 days after a job closed without one. We keep each file's name, caption, the item it proves, the page address it shows, its type, size and fingerprint (SHA-256), who of our team uploaded it and when, with the job, and delete them with it.
• Lists sent to the email check. Kept encrypted only until the list's check is finished (usually a few minutes, longer when mail servers ask us to come back later; never more than 2 hours once paid, and at most 25 hours while an order waits for your approval), then deleted. Like everything we delete, the encrypted copy stays in our database provider's restore history until that period ends (the row about backups at Neon above).
• Email check results (each address with its result; encrypted, and shown to your agent as they come in while the check runs). Deleted 7 days after the check. We keep the counts (how many were valid, invalid and so on) and your agent's statement that the list is your own opt-in contacts, without the addresses.
• Our checking server for the email check. Keeps nothing on disk: it holds a list's addresses in memory only while it works on them (its answers waiting for us hold no address and are dropped within an hour), and its logs hold counts, never addresses.
• Sender health check reports: 7 days after the check. The domain, the score and the counts: like your orders.
• Unsubscribe lists: while the plan runs and 30 days after it ends, then deleted with the list's key. You can delete a list and its key at any time (DELETE /v1/utilities/{id}/data). The network part of a visitor's IP address, for rate limits: at most 1 day.
• Site check results: 7 days after the check.
• Site check badge results, badge records and their public page: 31 days after the badge's paid time ends.
• Domain proofs for the site check badge: 30 days after the last proof, once no badge record uses them.
• Business details outcomes on a badge page: 365 days after the check at the latest, or with the badge record.

Where a line says we delete by hand, no automatic job does it yet: we do it ourselves when the time is up, or sooner when you ask us by email to mustafaakmese@ciphyr.ai. Stripe keeps payment data under its own rules.

08Automatic decisions

We do not profile you or score you. A few decisions are automatic, to protect balances: a bank dispute about a top-up the account holder made (the payment that opened the account, or a payment made with the card that opened it) blocks the account while we check, and a dispute about a top-up someone else made takes that amount back from the balance but does not block the account, and a person at AgentMart checks it; a payment with the card, or the confirmed email address, of a blocked account is not credited until a person at AgentMart has checked it; a payment made without ticking the box on Stripe’s page is never credited, no account is created or linked for it, and a person at AgentMart checks it and refunds it; and credit claims follow our own test results and monitoring (Terms, section 9).

You can ask a person at AgentMart to look at any of these decisions, and tell us your side by email to mustafaakmese@ciphyr.ai.

09Your rights, and how to use them

• See the data we have about you, and get a copy.
• Have wrong data corrected.
• Have data deleted, unless the law makes us keep it (for example our books).
• Have its use restricted while we check something.
• Object to a use based on our legitimate interest. We then stop, unless we have strong reasons or need the data for a legal claim.
• Get the data you gave us in a machine-readable form.

To use a right, write to us by email to mustafaakmese@ciphyr.ai. We do not keep your email address itself, so write from the address you paid or confirmed a free start with, or quote a top-up id from your receipt or one of your agents’ passport ids, so we can find your data. We may ask you to show that the account is yours.

We answer within 1 month, free of charge. If a request is complex, we may take up to 2 months more, and we tell you why before the first deadline.

Some things you can do yourself at any time: stop all emails (receipts for your own payments and security emails about your account, such as a lockdown, still come) with the link at the end of any email from us. Your agents can read, export and delete what they stored in utilities, also for 30 days after a plan ends; delete everything one utility holds at once (DELETE /v1/utilities/{id}/data); leave your account (POST /v1/me/leave); or end their passport (POST /v1/passports/revoke).

10Complaints

If you think we handle your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or to the data protection authority of the EU country where you live or work. We would like to hear from you first, but you do not have to.

11No sale, no tracking

We never sell personal data, and we do not share it for advertising. Our pages load no trackers, analytics or ads; even our fonts come from our own address. They set no cookies, except the ones named here. A personal page your AI agent makes for you sets one cookie that it strictly needs: when you press Open my page, it keeps that page open only in that browser, for at most 7 days, and does nothing else. We keep only a hash of it, with no IP address or device details. Our staff console at /staff, used only by AgentMart employees for human services, sets one sign-in cookie that it strictly needs, for at most 12 hours, and nothing else. Only while an attack on our site is being blocked, the attack protection of our host Vercel may set a short-lived security cookie. Our emails carry no open or click tracking: no tracking pixels and no tracked links. Stripe’s payment page is Stripe’s own site, with its own cookie notice.

12Data your agent puts into our utilities

Your agents may put personal data into our utilities: messages to your webhook inboxes, entries from your site’s visitors in your form inboxes, items in your memory locker, files you share, wake-up payloads, questions to you and your answers, the addresses your uptime watch checks, your project blueprints, repeating wake-up rules, heartbeat check names, reminder texts, queue messages, and messages your webhook inbox forwards to your agent’s own address.

For this data we act for you. You decide what goes in and why, and we process it only on your instructions, as your processor under Article 28 GDPR. The terms for that are in Terms, section 16. Your agents can delete it whenever you choose, one item at a time or all of one utility at once.

Email check. When your agent asks us to check a list of email addresses, we process those addresses (and nothing else about those people) only to check them, on your instructions, as your processor: you decide what the list is for and must be allowed to use it. To check an address we ask the receiving mail server of its domain whether the mailbox exists; that server's operator (for example the email provider of that person) learns that someone asked about that one address. We send nothing to the people on the list.

Unsubscribe list. When your agent uses our unsubscribe list, we process the email addresses of the people your emails go to only to record and check who asked not to get your emails (unsubscribes, complaints and bounces), on your instructions, as your processor. We store each address as a keyed hash under a key made for your list alone, never in the clear, except addresses your agent adds and asks us to keep, which we keep encrypted so you can export them. A person who opens an unsubscribe link sees only your site name; we do not show or keep their address in the clear.

If it holds other people’s data, for example from your site’s visitors, your own privacy notice must tell them about it. If such a person asks us about their data, we pass the request on to you.

Two things we still do for ourselves there: we count requests per IP address to stop spam (section 7 says for how long), and we keep the record of your purchase for our books.

13If you are not our customer

You may meet AgentMart without buying anything: by filling in a form on a website that uses our form inbox, opening a share link or a plan page, sending a message to a webhook inbox, sending us a wish or an abuse report without a passport, or getting one email because an AI agent asked for a free start for you.

• What you type into a form, or send to an inbox, belongs to the owner of that website or agent. We keep it for them, as their processor (30 days for form entries, 30 days for inbox messages), and never use it for ourselves. Their own privacy notice must tell you about it, and your rights are theirs to answer first.
• For ourselves, we count your requests per IP address or network to stop spam and attacks, and delete those counters after 1 day. Views of a share link are counted, without knowing who you are. Basis: our legitimate interest in a safe service (Article 6(1)(f)).
• A wish or an abuse report sent without a passport is kept as you wrote it, to act on it and plan what we stock, until we delete it by hand. Basis: our legitimate interest (Article 6(1)(f)).
• If an agent owner sent us a text about you for a human service (for example a document to translate), we process it for that owner, only to do that job, and keep it as section 7 says. Write to us: we pass your request to that owner and help them answer.
• If your AI agent makes you a personal page before you have topped up: when you press Open my page, your browser keeps a random key and we keep which personal pages it opened, and when (section 11 says what the cookie does, section 7 how long we keep it). Basis: it is needed to give you the page you asked your agent for (Article 6(1)(b)).
• If an AI agent asks for a free start with your email address and you do not confirm it, we send you that one email, delete the address within 24 hours, and keep only a keyed fingerprint of it (it cannot be turned back into the address) for 30 days, so that no agent can make us email you about this again in that time (you can lift that once, from the email's page, if your own agent should ask). Our email provider keeps a copy of that email for the period in section 7. Basis: our legitimate interest in letting a person confirm their own agent (Article 6(1)(f)).
• If someone asked us to check your website, we read only public pages and records, as described in section 4 (Site check). Our requests name us as AgentMart-Check. To stop checks of your domain by others, publish a TXT record agentmart-check=no on _agentmart-check.<your domain>; it covers your domain and every name under it. You can also write to us. Your robots.txt rules for AgentMart-Check limit what we read.
• If you open a page that shows an AgentMart site check badge, your browser loads the badge image from our site. We and our host Vercel then receive your IP address, the time and usually the address of the page you were on. We use them only to send the image: we do not store them in our database or use them to follow you, and they stay in Vercel's technical logs for its log period. Basis: our legitimate interest in showing the badge the site's owner chose (Article 6(1)(f)).
• Your rights in section 9 are yours too. Write to us by email to mustafaakmese@ciphyr.ai; when a request is about data we keep for a website or agent owner, we pass it on to them and help them answer.

14Changes

We post changes on this page with a new date. A new provider for the data in your utilities is posted here, and emailed to owners whose address is confirmed, at least 30 days before it starts (Terms, section 16).