Legal
Privacy policy
Version 2026-10-30 · Last updated October 30, 2026
This policy explains what personal data Neptuv collects, why, how long we keep it and the choices you have. The controller of your data is Dewan Efaj Tahamid Rifat, an individual ("Neptuv", "we"). Contact: [email protected].
Neptuv collects as little as it can. There are no ads, no third-party analytics, no tracking pixels, and we never sell or rent personal data.
What we collect and why
| Data | Why (legal basis) | Kept |
|---|---|---|
| Your wallet address, sign-in times, and the version of the terms you accepted | To give you an account and record your agreement (contract) | Until you ask us to delete the account |
| API keys (stored only as a one-way hash), the names you give them and usage counts | To authenticate API calls and apply plan limits (contract) | Until revoked and the account is deleted |
| Invoices, transaction hashes, paying addresses and your no-refund confirmation | To confirm payments and keep accounting records (contract, legal obligation) | As long as accounting and tax law requires (normally up to 7 years) |
| Webhook URL and secret, Telegram chat ID you link | To send the alerts you asked for (contract) | Until you remove or unlink them |
| Claims, watchlists, policies, disputes, workspace name and the team wallet addresses you add | To provide those features (contract) | Until you delete them or the account |
| Decision log: each allow/deny answer for your API calls, with the agent, score and reasons | So you can audit decisions (contract) | Up to one year, then deleted automatically |
| Reports you file about agents, with any evidence link; replies you write to reports about your agents | To review reports and show replies (legitimate interest in a fair, accurate service) | While the agent is listed; confirmed findings and replies are public |
| Contact form messages (name, email, company, message) | To reply to you (legitimate interest) | Up to 2 years |
| Signed agent requests: the agent, a one-time nonce and the time | To block replayed requests (legitimate interest in security) | 15 minutes |
| Daily counts per IP address (free API calls, sign-in attempts, contact form, playground, test alerts) | To stop abuse (legitimate interest in security) | 30 days |
| Server logs: IP address, time, page requested, browser user agent | To keep the Service secure and fix errors (legitimate interest) | 30 days |
We don't knowingly collect special categories of data (such as health or religion) and you shouldn't put them in reports, disputes or messages.
Public blockchain data
Agent profiles are built from public ERC-8004 records: agent identities, owner and wallet addresses, feedback and validations. This data is already public on the blockchain; Neptuv organises and scores it (legitimate interest in providing trust information about AI agents). We can hide or correct how an agent appears on Neptuv, but nobody — including us — can change or delete data recorded on a public blockchain.
Who we share data with
Only with the services that run Neptuv, and only what each needs:
- Hosting: Personal.
- DNS, HTTPS certificates and, if enabled, Cloudflare's network protection.
- Blockchain RPC providers (they see the transaction hashes we look up to confirm payments).
- Telegram, when you link a chat; the x402 facilitator, when you pay per call.
- Authorities, when the law requires it or to protect the rights and safety of users and the Service.
- A company formed or acquired to operate Neptuv, which would continue under this policy.
Confirmed findings from the incident network are public by design, together with the owner's reply. Some of these providers process data outside your country; where the law requires, we rely on appropriate safeguards for those transfers.
How we protect it
Data is encrypted in transit (HTTPS), API keys are stored only as hashes, the database is reachable only from the server itself, backups are readable only by the app's own system account, and access is limited to what each part of the system needs. No system is perfectly secure; tell us at once about anything suspicious.
Your rights
Depending on where you live (for example under the EU/UK GDPR or California law), you can ask to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent. Write to [email protected] from the email you used, or while signed in with the wallet in question, so we can verify it's you. We answer within 30 days. You can also complain to your local data protection authority.
Many settings you can change yourself, any time: revoke API keys, remove your webhook, unlink Telegram, leave a team and delete policies from your dashboard. We do not sell or share personal data for cross-context advertising.
Cookies
We use one essential cookie and a little local storage, and nothing for tracking. Details: Cookie Policy.
Children
Neptuv is for adults and businesses. It isn't directed at anyone under 18 and we don't knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.
Changes
We'll post any change here with a new date, and announce material changes on the site before they take effect.
Contact
Dewan Efaj Tahamid Rifat · Bangladesh · [email protected]