Privacy Policy

Last updated: November 9, 2026

Who is responsible for your data

The controller of the personal data described here — the business that decides why and how it is processed — is KIZUNA Creation, a sole proprietorship established in Japan, which operates vet402. Contact the controller at support@vet402.com. In Japan, KIZUNA Creation is the business handling personal information under the Act on the Protection of Personal Information (APPI).

vet402 is operated by KIZUNA Creation. See our Legal Notice for how operator disclosure works. Privacy questions or deletion requests: support@vet402.com.

Data we collect

Account email address
API usage logs (agent IDs, wallet addresses queried, scores returned)
Customer whitelist/blacklist entries you configure
Billing metadata via Stripe (we do not store card numbers)
Request metadata for security and rate-limiting — including the IP address a request is made from — kept only as long as needed to run those controls
The public blockchain addresses and ERC-8004 agent identifiers we score, together with the on-chain activity we read about them and the scores we derive (see people we score who are not our customers below)
If you ask us to correct a score, whatever you send us to make that case — which may include an email address and a wallet signature you provide voluntarily
Record notifications you asked for (record_subscriptions): the email address you entered, which endpoint record it follows, what kind of notification it is, the free-text reason you gave if you gave one, the last verdict we notified you about, and a one-way hash of the IP address the request came from (used to rate-limit sign-ups, never stored in the clear)
Notification consent (record_subscriptions): a one-way hash of the link we emailed you to confirm or stop record notifications, and when you confirmed or unsubscribed. Nothing but the confirmation email is sent until you confirm, and every notification carries a one-click unsubscribe link
Waitlist entries (waitlist_entries): the email address you entered, which offering you registered interest in, and the free-text note you added if you added one
Pre-publication notices to sellers: the business contact email address we wrote to, the seller's name and endpoints, the measurement facts in the message, and any reply. See emails we send to sellers before we publish below
Key-less API call counts (client_usage_daily): for requests to the public resolve and decision APIs made without an API key, a count per UTC day, client name and API route. Since 2026-10-28 the same table also counts calls to the MCP server at https://vet402.com/mcp that are answered with HTTP 200, under the routes mcp:initialize, mcp:check_x402_seller, mcp:check_my_x402_endpoint and mcp:find_x402_sellers. The client name is one of a short fixed list: vet402-hermes/, vet402-sdk/ or vet402-mcp/ followed by a version number for the tools we publish, self-monitor for the monitoring tools we run ourselves, crawler, site for calls made by pages on vet402.com, browser, or other. MCP calls can also get cursor, grok-bot, claude, chatgpt or paybox. We read the User-Agent header, the client name an MCP client sends when it connects, and for browsers whether the request came from a vet402.com page, only to pick that name. We do not store the User-Agent text, the IP address, the URL or query being looked up, or any API key with these counts
Site usage counts (site_events_daily): when a page on vet402.com is opened, or a link, copy button or sign-up step on it is used, a count per UTC day, event name, page group (for example /docs/api or /blog/[slug]) and source group (for example google, github, direct or internal, taken from the hostname of the page that linked here). The browser reports this to vet402.com itself. vet402 reads the User-Agent and origin headers only to skip bots and requests from other sites, and stores no IP address, User-Agent text, full URL, query, cookie or identifier with these counts, so a count cannot be tied to a person
Keyed decision counts (decision_usage_daily): for decision answers made with an API key, a count per key, per UTC day and per chain of the listing looked up. The row holds no email address and no name, and it is kept apart from the usage meter for billing. An operator may label a key by hand as self, related, external or prezenti_grantee (api_keys.owner_relation) to tell calls by vet402 and people close to it from calls by others. prezenti_grantee is set for an owner matched by hand to a public record of a Prezenti grant, such as a post on the Celo Forum. Deleting an account replaces the key id on these rows with a new random id, and all rows of that account share one new random owner id, so the account still counts as one owner. The relation label stored at deletion (relation_snapshot) and the count for each UTC day remain. The billing count in api_usage keeps the original key id and is kept as a billing record.
Public monthly table (/usage/monthly, /api/v1/usage/monthly): for one chain on the published list, decision answers made with a key are summed by relation for a UTC month after that month has closed. The first read at or after 00:00 UTC on the 3rd day of the next month stores the figures, and later reads return that stored copy. The relations are self, related, external, prezenti_grantee, and unclassified. A labeled relation shows the number of owners and the number of calls. A labeled relation with fewer than 3 owners shows <3 and leaves the call count out. An unclassified relation shows the number of owners and leaves the call count out. Fewer than 3 unclassified owners shows <3. Calls made without a key are not counted per chain, so this table does not list them. The table leaves out the key, the email address, and the name.
Disputes (disputes): the endpoint the dispute is about, the subject and reason you wrote, and the wallet address plus the signed message and signature that prove control of it. This table holds no email address; if you write to support instead, that correspondence lives in the support inbox
Session analytics (Microsoft Clarity; details under session analytics): how pages are used, such as clicks, scrolling and page layout, with page text, images and form fields masked (the page address and title are not masked)

Wallet addresses

Wallet addresses are public blockchain identifiers. We treat them as pseudonymous data and do not intentionally collect direct personal identifiers beyond your email.

Legal basis (GDPR / UK GDPR)

Where the EU or UK GDPR applies, we rely on the following lawful bases. If you are in a jurisdiction with a different framework (for example Japan's APPI or a US state law), equivalent bases apply under that law.

Performance of a contract (Art. 6(1)(b)) — creating and running your account, authenticating API keys, metering usage, and answering support.
Legitimate interests (Art. 6(1)(f)) — scoring public blockchain addresses and agent identifiers so that operators can assess payment risk, together with securing the service and preventing abuse. The interest is providing an independent fraud-risk signal for on-chain payments; the data is already public on-chain; and anyone scored has a free route to object and to have factual errors corrected (see below). The same basis covers the pre-publication notices we email to sellers, whose interest is to hear about a result before it is published. You can ask us for our balancing assessment.
Legal obligation (Art. 6(1)(c)) — keeping billing and tax records for the period the law requires.
Consent (Art. 6(1)(a)): session analytics with Microsoft Clarity for visitors in the EEA, the UK and Switzerland. vet402 asks for it on a banner at the bottom of the page, and you can withdraw it at any time (see session analytics). Site usage counts are kept on vet402.com without cookies or identifiers and need no consent.

Emails we send to sellers before we publish

Before we publish results that name a seller, we may email that seller to tell them what we measured — for example that paid calls to their endpoint were not delivered — and when we plan to publish, so they can correct us or fix the problem first. These notices come from records@vet402.com and replies go to support@vet402.com. They report measurement facts; they are not advertising and we do not use them to sell anything.

Where the address comes from. We write to a business contact the seller has published: the contact in its public listing in an x402 discovery catalog, or the support or contact address published on the seller's own website or domain. We do not buy address lists and do not guess personal addresses.

How to stop them. Reply to a notice, or write to support@vet402.com, and say you do not want these notices; one person reads that inbox and we will not send further pre-publication notices to that address. Stopping notices does not stop the measurement or its publication, which follow our published methodology either way. We keep the message and any reply in the support inbox and in Resend's sending log; we do not add these addresses to any mailing list.

Retention

Query logs are retained per your plan (90 days Free, 1 year Pro+). You may request deletion of your account by contacting support.

Record notifications, waitlist entries and disputes are kept until you ask us to remove them, because each of them exists to be acted on later: a notification has to outlive the change it is watching for, and a dispute is part of the record of a correction. None of the three expires automatically — no scheduler deletes them — so the route is a person. Mail support@vet402.com and say which one you mean; we remove it by hand within 7 days and confirm to the same address. Replying to a notification email reaches the same inbox and counts as the same request. Where a dispute has already produced a published correction, we remove your contact details and keep the fact that a correction was issued, which is the entry other people rely on — the grounds for that are in people we score who are not our customers below.

Key-less API call counts are kept without an expiry date. Each row is a count for one day, client name and API route, and holds nothing that identifies who made the calls. Keyed decision counts are kept without an expiry date. Each row is a count for one key id, one UTC day and one chain, and a row whose key id was replaced with a new random id at account deletion still holds that count. The row holds no email address and no name.

Subprocessors and third parties

We use the providers below to run the service. Each processes only the data its function needs, under its own data-processing terms. We do not sell personal data, and we do not share it with anyone for their own marketing. For Clarity, Microsoft is also an independent controller of the data it receives. See session analytics.

Vercel (United States) — application hosting and edge delivery; sees request metadata including IP addresses.
Neon (United States) — the PostgreSQL database that stores accounts, API key hashes, usage logs, and scores.
Stripe (US) — billing and payment processing for paid plans; holds card data directly, which we never see or store.
Alchemy (US) — Base blockchain RPC and indexing; receives the public wallet addresses we read on-chain data for.
Blockscout — block-explorer API used to read public on-chain data; receives the public wallet addresses we query.
Tenderly public Base RPC gateway (base.gateway.tenderly.co). A fallback for reading public event logs on Base when our main RPC does not answer. It receives the read requests our servers send to the chain, which can include the ID of the agent being looked up and the payout addresses of sellers. Both are already public on that chain.
Solana Labs public mainnet RPC (api.mainnet-beta.solana.com) — used to re-read Solana settlements on-chain; receives transaction signatures and wallet addresses, all of which are already public on that chain.
Stellar Development Foundation public Horizon API (horizon.stellar.org). Read by vet402's servers for vet402's own purchases on Stellar: recent ledger close times when vet402 signs a payment, and vet402's payer balance and the payment transactions it checks. Those reads carry vet402's payer address and the hashes of those transactions. Its responses include the seller payout addresses on them. These are already public on Stellar. No visitor data is sent to it.
Ankr public Stellar RPC (rpc.ankr.com). Used by vet402's servers to read the latest ledger and simulate vet402's own payments to sellers on Stellar before signing them. Those requests carry vet402's payer address, the seller payout address, and the amount. The signed payment is sent to the seller, and the seller's payment service submits it to Stellar, not Ankr. No visitor data is sent to it.
Allnodes PublicNode public BNB Chain RPC (bsc-rpc.publicnode.com). Read by vet402's servers on BNB Chain for vet402's payer balance, for whether a payment authorization vet402 signed has been used, for the payments vet402 recovers, and for the index of USD1 payments that listed sellers receive. Those reads carry vet402's payer address, transaction hashes and the payout addresses of listed sellers. Their responses include the addresses of other payers to those sellers. These are already public on BNB Chain. No visitor data is sent to it.
BNB Chain public dataseed RPC (bsc-dataseed.bnbchain.org), run for BNB Chain. Read by vet402's servers to re-check the payments vet402 made on BNB Chain: the receipt of each settlement transaction it checks. Those reads carry transaction hashes. The receipts include vet402's payer address, the seller payout address and the amount. These are already public on BNB Chain. No visitor data is sent to it.
Offchain Labs public Arbitrum One RPC (arb1.arbitrum.io). Read by vet402's servers on Arbitrum One for vet402's payer balance, for whether a payment authorization vet402 signed has been used, for the payments vet402 recovers, and for the index of USDC payments that listed sellers receive. Those reads carry vet402's payer address, transaction hashes and the payout addresses of listed sellers. Their responses include the addresses of other payers to those sellers. These are already public on Arbitrum One. No visitor data is sent to it.
Avalanche public C-Chain RPC (api.avax.network). Read by vet402's servers on Avalanche C-Chain for vet402's payer balance, for whether a payment authorization vet402 signed has been used, for the payments vet402 recovers, and for the index of USDC payments that listed sellers receive. Those reads carry vet402's payer address, transaction hashes and the payout addresses of listed sellers. Their responses include the addresses of other payers to those sellers. These are already public on Avalanche C-Chain. No visitor data is sent to it.
Resend (United States) — email delivery for the record-change notifications you asked for, for replies about a dispute, and for the pre-publication notices we send to sellers (see above); receives the recipient email address and the body of that message. We do not use it for marketing email and we send no newsletter.
Microsoft Clarity (Microsoft Corporation, United States). Session recordings and heatmaps of how pages are used, with page text masked. It receives the data described under session analytics. Visitors in the EEA, the UK and Switzerland are recorded only after they accept.
GitHub (United States) — hosts vet402's public source code and issue tracker. If you open an issue or pull request there, it is published under your GitHub account and GitHub's own terms apply.

This list can change as the service evolves; the current list lives on this page, and we will update it here before a new subprocessor starts handling personal data. If you need it confirmed in writing for a procurement review, ask us by email.

Cookies

vet402 sets its sign-in cookie only after you log in to the dashboard: a strictly-necessary session cookie that keeps you signed in. It is set httpOnly, secure, and sameSite=strict, and it is used for nothing but authentication. Because it is strictly necessary, it needs no consent.

vet402 also sets vet402_analytics_consent to remember your answer under Privacy choices, and Microsoft Clarity sets _clck and _clsk when it runs. These are described under session analytics. vet402 sets no advertising cookies and tells Clarity that advertising storage is denied.

Where your data is stored

The operator administers the service from Japan. The data itself is stored and processed by the providers above, in these countries:

United States — the database (Neon, on AWS in the US East (Ohio) region), the application servers (Vercel, Washington, D.C. region; pages are also cached on Vercel's worldwide edge network), email delivery (Resend), billing (Stripe), and source code hosting (GitHub).
United States and other countries where Microsoft runs Azure: session analytics (Microsoft Clarity). Microsoft does not publish a single storage region for Clarity.
Japan — the support inbox is read, and the service is operated, from Japan.

Personal data originating in the EEA or UK is therefore transferred to and processed in third countries, including the United States and Japan. We rely on our providers' standard data-processing terms, including standard contractual clauses where they apply, for those transfers. Each of these countries has its own data-protection law, and the protection there may differ from the protection where you live.

How we protect your data

Responsibility. KIZUNA Creation is responsible for handling personal data in vet402, and access to the production database and hosting accounts is limited to the operator's accounts.
In transit. The site and API are served over HTTPS.
Stored secrets. API keys are stored as keyed hashes, not in the clear; the IP address behind a notification sign-up is stored only as a one-way hash; and secrets are redacted from server logs.
Retention. Query logs are deleted on the schedule in Retention by a scheduled job.
Facilities. We run no servers of our own; the data sits with the providers named above, in the countries named above.

Information your browser sends to a third party

When session analytics runs, your browser sends information to Microsoft Clarity, as described under session analytics below. Site usage counts go to vet402.com itself and are described under Site usage counts above. Microsoft Clarity is the only third party vet402's pages send information to from your browser, except when you open Stripe's own checkout or portal pages.

Session analytics (Microsoft Clarity)

vet402 uses Microsoft Clarity, a service of Microsoft Corporation, to see where pages are hard to use: which links are clicked, how far a page is scrolled, and where people stop. When it runs, your browser loads Clarity's scripts from clarity.ms and sends Clarity what Microsoft describes as the interactions on the page (mouse movements, clicks, scrolling, window resizing, text selection and input events), how the page is rendered (the layout and structure of its elements), page events such as page size and visibility, script errors and performance measures, the address and title of the page and the referring page, and your device type, browser, operating system and screen size. Microsoft also receives your IP address with each request and uses it to estimate your country. Clarity turns this into session replays and heatmaps that vet402 reads in the Clarity dashboard.

Masking. vet402 runs Clarity in its Strict masking mode, so the text and images on the page are replaced with placeholders before they leave your browser. The page address and title are not masked. Clarity always masks what you type into input boxes and dropdowns. On top of that, vet402 marks the whole dashboard, the API key shown at sign-up, and the sign-up, login, search, lookup and notification fields with Clarity's data-clarity-mask attribute. Clarity does not run on the two pages that notification emails link to, because their addresses carry a token. vet402 does not send Clarity your email address, your API key or your account ID.

Cookies. When Clarity runs, it sets two first-party cookies on vet402.com: _clck, which keeps a pseudonymous Clarity user ID for up to one year, and _clsk, which joins the pages of one visit into one recording and lasts one day. Microsoft lists further cookies on its own domains (CLID, MUID, MR, SM and ANONCHK), some of which Microsoft uses for advertising. vet402 tells Clarity that advertising storage is denied for every visitor. vet402 also sets vet402_analytics_consent, a first-party cookie that remembers your answer (granted or denied) for 180 days and holds nothing else.

Visitors in the European Economic Area, the United Kingdom and Switzerland. If your request appears to come from one of these places, or if vet402 cannot tell where it comes from, Clarity is not loaded and nothing is recorded until you choose Accept on the banner at the bottom of the page. If you choose Decline, Clarity stays off. vet402 relies on your consent for this (Art. 6(1)(a) of the GDPR and the UK GDPR, and consent under Swiss data protection law). You can withdraw it at any time under Privacy choices below. Withdrawing does not affect recording made before you withdrew.

Visitors everywhere else. Clarity runs by default, because session analytics is how vet402 finds and fixes what is hard to use. You can turn it off at any time under Privacy choices below. If your browser sends a Global Privacy Control signal, vet402 does not load Clarity, wherever you are and whatever you choose. Microsoft also offers its own opt-out for Clarity through the Digital Advertising Alliance at optout.aboutads.info.

Retention and Microsoft's own use. Clarity keeps recordings for 30 days, and keeps favorited recordings, a random sample of recordings and heatmaps for up to 9 months. vet402 cannot tell which recordings are yours, and Clarity can delete recordings only by deleting the whole project, so recordings expire on this schedule rather than on request. Microsoft stores Clarity data in its Azure cloud and is an independent controller of the data it receives, which it handles under the Microsoft Privacy Statement. Choosing Decline after you accepted deletes the _clck and _clsk cookies on vet402.com and stops recording. Cookies that Microsoft set on its own domains stay until they expire or you clear them.

Privacy choices. Open the banner again to accept or decline session analytics. Your answer applies to this browser.

People we score who are not our customers

vet402 scores blockchain addresses and agent identifiers that belong to third parties — people and businesses who never opened an account with us. If one of those addresses can be traced to you, the data-protection law where you live may treat our score as personal data about you, and you have rights over it even though you are not our customer.

The data involved is the public on-chain address, the public transaction activity we read about it, and the score we derive from that activity. We do not attach names, contact details, or off-chain identity to an address unless the person behind it gives them to us — for example by using the correction route.

How we handle erasure and objection, concretely. You can ask us to correct a score built on a factual error, and you can object to our scoring your address. The free route for both — no account, no fee — is section 8 of the Terms, and every factual correction we make is published on our corrections log. You also have the rights to erasure (Art. 17) and to restriction of processing (Art. 18), and we weigh every verified request individually — we do not refuse by policy, and "we never delete anything" is not an answer we give. Where a legal ground we may rely on — freedom of expression and information (Art. 85), the establishment, exercise, or defense of legal claims, or fraud prevention — outweighs your request in your specific situation, we respond with restriction rather than nothing: we stop publishing or stop scoring the entry concerned, annotate it, and correct anything inaccurate, instead of leaving it up unchanged. Where no such ground prevails, we delete or anonymize the data. What we will not do is silently rewrite our own record to hide a mistake we made — accountability for our errors and your rights over your data are not in conflict, and we intend to honor both. Either way we tell you our decision and our reasons, and if you disagree you can complain to your data-protection authority.

A score is an opinion, not an accusation of fact. A low score or a BLOCK is our read of a public record on a given day, not a statement that any person is a criminal or a fraudster; the distinction, and why we draw it, is set out in sections 6 and 7 of the Terms.

Your rights over your data

Depending on where you are, you may have the right to access the personal data we hold about you (GDPR Art. 15), to have it corrected if it is wrong (Art. 16), to have it deleted (Art. 17), to ask us to restrict a particular use of it (Art. 18), to object to processing based on our legitimate interests (Art. 21), to receive it in a portable format (Art. 20), and to withdraw consent where we relied on consent. We weigh each request on its own facts — none of these is answered with a blanket policy — and we do not make automated decisions with legal or similarly significant effects about you as a user of this site.

To exercise any of these, email support@vet402.com from the address on the account, or tell us which address it was. One person reads that inbox; we aim to acknowledge within 5 business days (Japan time) and to complete the request within 30 days. There is no charge. We will say no only where the law lets us — for example where we must keep billing records for tax purposes — and we will say which exception we are relying on rather than just declining. If you are unhappy with how we handled it, you can complain to your local data-protection authority.

Two things we cannot do, and would rather say plainly than leave you to discover. First, we cannot erase the blockchain: wallet addresses and their transaction history are public records on Base that we read, not records we created or control, so deleting your vet402 account does not remove anything from the chain. Second, if you believe a trust score about an address is wrong — which is a different problem from a privacy request — the route for that is in section 8 of the Terms: it is free, needs no account, and works whether or not you are a customer.