Privacy Policy

This Privacy Policy explains how Seeking Data Labs ("we", "us", "our") collects, uses, discloses, and protects personal data when you visit seekingdatalabs.com, create an account, use our data API (including agentic pay-per-call over x402), or engage our research and consultancy services.

We operate from Switzerland. Two data-protection regimes apply to us in parallel and this policy is written to satisfy both:

• the Swiss Federal Act on Data Protection (revFADP / nFADP), in force since 1 September 2023, because we are established in Switzerland; and
• the EU General Data Protection Regulation (GDPR, Reg. 2016/679), which applies under Art. 3(2) because we offer services to, and process the data of, individuals in the EU/EEA.

Where the two regimes differ, we apply the stricter standard. The legal bases below are stated under the GDPR and mapped to the corresponding Swiss justification.

This document is provided in good faith for transparency; it is not legal advice, and you should have it reviewed by qualified counsel before relying on it.

1. Who is responsible (controller) and how to contact us

The controller responsible for your personal data is:

• Seeking Data Labs (trading name)
• [registered legal entity & address, to be completed]
• Privacy contact: [email protected]

Please direct all privacy questions and all requests to exercise your rights to [email protected].

Data protection officer. We have not appointed a statutory data protection officer. The revFADP does not impose a general DPO requirement, and the GDPR Art. 37 triggers (large-scale processing of special-category data, or systematic large-scale monitoring as a core activity) are unlikely to be met by our processing. The privacy contact above handles all matters. This assessment should be confirmed by counsel.

EU/UK representative. As a controller outside the EU that processes EU/EEA personal data, GDPR Art. 27 in principle requires an EU representative unless the Art. 27(2) exemption applies (processing that is occasional, does not involve large-scale special-category data, and is unlikely to risk individuals' rights). We are assessing this; if a representative is appointed, its name and address will be published here. Because we are established in Switzerland, the revFADP Art. 14 obligation to appoint a Swiss representative, which applies only to controllers based abroad, does not apply to us.

2. The personal data we process

We only process the categories of data our service actually involves:

• Account identity. Your email address (email/password sign-up and Google sign-in). For Google sign-in we also receive, from the openid email profile scope, your Google account identifier, display name, and profile picture.
• Authentication and security data. A salted password hash (we never store plaintext passwords); a signed session token held in anHttpOnly, Secure cookie; and, for login abuse-protection and rate-limiting, your IP address and email held transiently in memory.
• API usage and billing metadata. Your API key(s), plan or tier, request and usage logs, and timestamps.
• x402 payment data. For pay-per-call, the Solana wallet / public address that signs the USDC payment, transaction signatures, amounts, network, and on-chain settlement receipts. On a public blockchain these records are pseudonymous but permanent, irreversible, and outside our control.
• Profile data you choose to provide. An optional public nickname and any dashboards or analysis text you author.
• Technical and operational data. IP address, user-agent, and request metadata processed at our CDN/WAF edge and at the origin to deliver and protect the service.
• Communications. The content of emails you send us.
• Analytics data, collected only after you opt in (see section 11). We use Google Analytics 4 for privacy-respecting web analytics. It loads only after you grant consent through the banner, and until then no Google Analytics identifiers or_ga cookies are set.

We do not collect payment-card data, and we do not seek to collect special categories of data (health, biometrics, political opinions, etc.). Please do not send us such data.

How USDC payments work, and their on-chain footprint

We accept payment only in USDC on Solana, there is no card or fiat path. Two flows exist, and both write to a public ledger:

• x402 pay-per-call. Priced API calls are paid per request over the x402 HTTP-402 handshake: your wallet signs a USDC payment that a third-party facilitator verifies and settles on-chain. We never hold your funds or signing keys. We process the payer wallet address, amount, network, transaction signature, and settlement receipt.
• Subscription top-up. To activate a paid tier you send USDC to a shared deposit address with the transaction memo field set to your account id. Our payments watcher reads that memo to match the payment to your account and activate the tier for 30 days. We keep a stored payments ledger (transaction signature, amount, tier, status, timestamp) linked to your account.

Important, irreversible consequence. Because the memo (your account id) is written into the Solana transaction, it is recorded on thepublic, permanent Solana ledger alongside the paying wallet address. This creates a permanent, public on-chain link between your account id and the wallet you pay from that we, and everyone, cannot delete, rectify, or geographically confine. If you do not want that link to exist, pay from a wallet you are comfortable associating with your account, and never place other personal data in a memo.

Content you choose to make public

Some things you create are public by design. If you set anickname, it becomes your public profile handle (shown at a URL such as /u/<nickname>); any dashboards or analysis you mark as public are displayed to anyone and may be indexed and cached by search engines. We process this on the basis ofcontract (Art. 6(1)(b)), delivering the public-profile feature you asked for, and, for anything beyond what the feature requires, your consent (Art. 6(1)(a)). To keep content private, do not mark it public (or switch it back to private); to remove a nickname or take down published content, email[email protected]. Content already cached or indexed by third-party search engines may persist in their systems until they refresh.

3. Why we process it, and the legal basis

For each purpose we state the GDPR Art. 6 legal basis. Under the revFADP, which relies on lawful processing plus a duty to inform rather than an enumerated list of bases, the same justification applies.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and we have concluded the processing is limited to what is necessary. You have the right to object to legitimate-interest processing at any time (see section 9).

4. Our AI research pipelines, scope and limits

We describe ourselves as AI-driven research: automated agents operate our data collectors, verify readings against their sources, and publish the catalog. To be clear about what this does and does not involve:

• These AI/agent pipelines operate on public market, on-chain, and open-government data sources and on our own catalog, not on your personal data or account contents.
• We do not use your personal data, account contents, or the content of your dashboards to train or fine-tune AI or machine-learning models.
• If we ever introduce a feature in which a third-party AI/LLM provider processes user-submitted content (for example, to assist with support), that provider would become a processor and we would disclose it here before doing so.

5. Who we share data with (processors and recipients)

We do not sell your personal data. We share it only with service providers who process it on our documented instructions under a data-processing agreement (GDPR Art. 28 / revFADP Art. 9), and where required by law.

We may also disclose data to professional advisers, or to authorities and courts, where necessary to comply with the law, respond to lawful requests, or establish, exercise, or defend legal claims. If our business is reorganised or transferred, data may be disclosed to a successor under equivalent protections.

6. International transfers

Some recipients above are located in, or transfer data to, countries outside Switzerland and the EEA, in particular the United States. Where that happens, we rely on recognised safeguards:

• the EU Standard Contractual Clauses (2021/914) for EEA-origin transfers, and the FDPIC-recognised SCCs with theSwiss addendum for Switzerland-origin transfers;
• the EU–US and Swiss–US Data Privacy Framework where the recipient is certified (Google and Cloudflare are certified; we are confirming the facilitator's status and, absent certification, rely on SCCs);
• Switzerland's recognition of the EEA as providing adequate protection.

Microsoft Azure hosts our compute and databases and therefore holds the richest set of personal data we process (account data, billing metadata, usage logs, our databases). Our Azure resources are located in the[Azure region, to be confirmed]region. Microsoft is certified under the EU–US and Swiss–US Data Privacy Framework and additionally offers the Standard Contractual Clauses, on which we rely for any transfer of this data outside Switzerland and the EEA. You can request copies of the transfer safeguards by emailing[email protected].

On-chain payments are inherently international. The Solana blockchain is a globally distributed public ledger with no controllable transfer location; transactions on it cannot be erased or geographically confined. If you value the privacy of a wallet, do not use it to pay for calls, and do not place personal data on-chain.

7. How long we keep it

• Account data, kept for the life of your account, then deleted or anonymised within 90 days of account closure, subject to any legal hold.
• Billing and payment records, retained for approximately10 years to meet Swiss commercial bookkeeping (Code of Obligations) and tax obligations. This retention overrides erasure requests for those specific records.
• Security / rate-limiting data (IP + email), ephemeral, held only for minutes to hours.
• Operational, CDN/WAF, and security logs, a short rolling window of approximately 30 days.
• On-chain USDC transactions (including the account-id memo), permanent and outside our control; they cannot be deleted.
• Analytics data (Google Analytics 4), retained only from the point of consent; the _ga cookies expire after roughly13 months.

8. Security

We apply technical and organisational measures appropriate to the risk (GDPR Art. 32 / revFADP Art. 8), including:

• TLS/HTTPS for all traffic;
• passwords stored only as salted hashes, never in plaintext;
• the login session in an HttpOnly,Secure, SameSite=Lax cookie on the API host that page scripts cannot read (this "not exposed to page scripts" property describes that session cookie and the OAuth CSRF cookie, notevery credential: a separate, script-readable bearer token may be stored in your browser's localStorage for direct API calls, as theCookie Policy details);
• login rate-limiting and protections against account enumeration and timing attacks;
• a Cloudflare WAF and authenticated (mTLS) origin pulls between the edge and our servers;
• non-root, read-only-filesystem application containers and least-privilege access;
• a design in which we never custody payment signing keys, the x402 facilitator does.

No method of transmission or storage is completely secure, but we work to protect your data and to review our measures.

9. Your rights

Under the GDPR and the revFADP you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• request erasure ("right to be forgotten"), subject to the billing-record retention above, which we are legally required to keep;
• restrict or object to processing, including any processing based on our legitimate interests and any direct marketing;
• receive your data in a portable format (data portability);
• withdraw consent at any time for any processing based on consent (such as analytics), as easily as you gave it, without affecting the lawfulness of processing before withdrawal.

To exercise any right, email[email protected]. We respond without undue delay and within one month (extendable by two further months for complex requests, with notice). Requests are free unless manifestly unfounded or excessive. We may need to verify your identity before acting.

Right to complain. You may lodge a complaint with a supervisory authority:

• in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (edoeb.admin.ch); and
• in the EU/EEA, the supervisory authority in your country of residence or workplace.

10. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects about you by solely automated means. The only automated logic we apply is operational: rate-limiting, abuse/fraud detection, plan or tier gating (a locked metric returns an upgrade prompt), and x402 pricing of priced endpoints. These do not profile you.

Should any such control ever be treated as a significant automated decision within the meaning of GDPR Art. 22 or revFADP Art. 21, you have the right to obtain human review, to express your point of view, and to contest the decision, contact[email protected].

11. Cookies and analytics

The site uses strictly-necessary and functional cookies and local storage, plus consent-gated analytics, there is no advertising or third-party tracking. Our fonts are self-hosted, so your browser makes no request to Google Fonts. See ourCookie Policy for the full, itemised inventory.

For web analytics we use Google Analytics 4, and it loads and sets identifiers only after you give prior, informed opt-in consent through the consent banner. Nothing non-essential, no Google Tag Manager request and no _ga cookie, loads before you accept; rejecting is as easy as accepting, no boxes are pre-ticked, and you can change or withdraw your choice at any time via the"Cookie settings" control in the footer. IP addresses are handled under Google's EU/EEA data-processing measures (we setanonymize_ip). Analytics data is shared withGoogle LLC (United States) and processed there under the transfer safeguards in section 6 (the EU–US / Swiss–US Data Privacy Framework, the Standard Contractual Clauses, and the Swiss addendum).

12. Children

This is a professional developer and research service and is not directed to children. It is not intended for, and must not be used by, anyone under16 (or a higher minimum age set by local law). We do not knowingly collect data from children; if you believe a child has provided us data, contact[email protected] and we will delete it.

13. Data breaches

If a personal-data breach occurs, we will comply with our notification duties: notifying the competent EU supervisory authority within 72 hours where required (GDPR Art. 33), notifying the FDPIC as soon as possible where a breach is likely to result in a high risk (revFADP Art. 24), and informing affected individuals where the law requires it (GDPR Art. 34).

14. Changes to this policy

We may update this policy. We will change the "last updated" date above and, for material changes, notify account holders by email and/or a prominent site notice. We will not apply materially adverse changes retroactively to data already collected without a lawful basis. Prior versions are available on request.

15. Contact

Seeking Data Labs,[email protected].[registered legal entity & address, to be completed]