We collect the minimum needed to provision API keys, settle payments, and keep the service reliable.
DataWhereNotes
Email address/signup, /pilotProvided by you to mint a key or request a finance pilot.
Wallet address/topupThe paying address you bind to credit USDC top-ups on Base.
IP addressall requestsCaptured by our hosting and edge layer for security and abuse prevention.
Usage analyticsAPI & siteEndpoint, timestamp, credit ledger events, and aggregate KPI counters. Raw claim text is not retained as analytics.
We do not require account names, phone numbers, or payment-card details. Pilot contact details are stored only for follow-up and are excluded from aggregate KPI output.
Purpose
Why we collect it
PurposeData used
Provision and authenticate API keysEmail, hashed key identifier.
Settle credit top-upsWallet address, on-chain transfer references.
Security, abuse prevention, rate limitingIP address, request metadata.
Operate, debug, and improve the serviceUsage analytics, aggregate KPI counters.
Respond to support and pilot requestsEmail, message contents you send us.
Minimization
Hashed identifiers
Identifiers used as internal lookup keys — including API keys — are stored as sha256 hashes, not in plaintext. We use the hash to authenticate and meter requests; we cannot recover the original value from the hash.
Retention
How long we keep it
DataRetention window
Account email & key recordsFor the life of the account, then up to 12 months after closure.
Credit ledger & wallet bindingsUp to 7 years where required for financial recordkeeping.
IP & request logsUp to 90 days for security, then deleted or aggregated.
Aggregate KPI countersRetained indefinitely in non-identifying form.
Retention windows are targets and may be shortened or extended to meet legal obligations.
PartyRole
Google Cloud Platform — Cloud RunHosting and infrastructure for the NumProof service.
Base (blockchain)Public ledger used to settle USDC credit top-ups. On-chain data is public and outside our control.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We disclose data only to the processors above, or when required by law.
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. Under the CCPA/CPRA you may also opt out of sale or sharing — though, as noted, we do not sell or share your data.
To exercise any right, email privacy@numproof.com. We will verify your request and respond within the timeframe required by applicable law. You may also lodge a complaint with your local data-protection authority.