DebitMyDataTest server. Payments here use test networks whose coins have no value, and DIDs issued here are test DIDs.
Privacy policy
This policy covers the DebitMyData Agent Gateway: its API at https://staging-api.debitmydata.io and its MCP
server, operated by Debit My Data, Inc. The gateway is built for software agents, but the
people and organizations that run them have rights over the data that concerns them.
DebitMyData's websites and apps are covered by the
DebitMyData privacy policy.
What we collect
What you send us
- In a quote: the display name, the participant type, the controller's public key and/or wallet address, the payment method chosen, and any metadata you add.
- During the registration: the signatures that prove control of your controller, the transaction references you report, and, for x402, the signed payment (which names the paying wallet).
- In an inference donation: the amount, the signed payment (which names the paying wallet),
and the donor name and DID if you give them. They appear in your donation receipt, which
anyone holding its
purchase_idcan read; they are not otherwise published.
What we see on blockchains
- The payments made for your quotes: transactions, amounts and addresses. Blockchains are public; we read them, we do not control them.
Technical data
- The IP address and browser or client name of each request, in our server logs and those of Cloudflare, which protects the gateway. Request limits are counted per IP address.
- Request IDs that link log lines to a request, so problems can be traced.
We do not ask for, and never want, private keys, seed phrases, passwords or payment card details.
What we publish
To make a DID work, some data is public by design: anyone can read it, and it cannot be made private again once published.
- The DID document: your DID and its controllers (public key and/or wallet address).
- The identity record: display name, participant type, controllers, status, registration ID, credentials and entitlements.
- The signed credential: all of the above, plus the payment it records (asset, network, amount and transaction IDs).
Quote metadata, IP addresses and logs are not published. Choose a display name you are happy to make public.
Why we use it
- To quote, verify payments and issue DIDs, credentials and entitlements.
- To keep the gateway secure and available: request limits, abuse prevention, fraud checks and troubleshooting.
- To keep an accurate, permanent record of payments and registrations for accounting, refunds and disputes.
- To meet legal obligations.
Who we share it with
- Cloudflare, which carries and protects all traffic to the gateway.
- Our hosting provider, which runs the servers and stores the database.
- The x402 facilitator (for USDC payments through x402), which receives your signed payment to submit it to the chain.
- Blockchain node providers, which the gateway asks about payments and wallets.
- Authorities, when the law requires it.
We do not sell personal data, and we do not use it for advertising.
How long we keep it
- Registrations, donations, payments, controller proofs and the audit trail are kept permanently. They are written once and never changed, because issued credentials, receipts, accounting and refunds depend on them.
- Server logs are kept only as long as security and troubleshooting need them, normally a few weeks.
- Data on blockchains is permanent and outside our control.
Cookies
The gateway sets one cookie, dmd-theme-id, and only when you pick the light or dark theme
with the button in the top bar: it holds that choice ("light" or "dark") for a year so the
pages open in it next time, and nothing else. It is not used to identify or follow you, and
it is not shared with other sites. Cloudflare may set cookies that are strictly needed to
protect the service. The interactive API docs page loads its viewer from a public content
network (jsDelivr), which sees your IP address when you open it.
Your choices and rights
You can ask us what data we hold about you, ask us to correct it, or object to how we use it, by writing to info@debitmydata.com. Some data cannot be deleted: what is on blockchains, and the records that back an issued DID and its payment. We can deactivate a DID at your request (see the DID policy); its record is then kept but the DID no longer resolves. Depending on where you live, you may also have the right to complain to a data protection authority.
Children
The gateway is not meant for children, and we do not knowingly collect data about them.
Security
We protect the data we hold with access controls, encrypted connections and separated systems: the gateway never holds the keys that can spend DebitMyData's funds. See the security page.
Changes
Each version of this policy has a date. We publish changes here before they apply.