PRIVACY POLICY

THE BITCOIN CREDIT STACK

Version: 0.2 · Effective date: 21 October 2026

This English version is a translation of the French privacy policy. The French version is the reference text; in the event of any inconsistency, the French version prevails.

This policy describes the personal data Aletheia Analytics processes when a person, or software acting for them, uses The Bitcoin Credit Stack (the "Stack"): the site www.bitcoincreditstack.com, the REST API api.bitcoincreditstack.com and the MCP server mcp.bitcoincreditstack.com/mcp. It says what is recorded, why, on what basis and for how long, and what is not.

1. Controller

ALETHEIA ANALYTICS is a French simplified joint-stock company with a sole shareholder (société par actions simplifiée unipersonnelle) with share capital of 1,000 euros, registered with the Paris Trade and Companies Register under number 107 152 662 R.C.S. Paris, whose registered office is at 173 rue de Courcelles, 75017 Paris, France.

Aletheia Analytics is the controller of the processing described here.

Contact, including for data protection and the exercise of your rights: contact@aletheia-analytics.io.

2. Scope

This policy concerns:

• visitors to the site;
• persons and software (including artificial intelligence agents) that call the API or the MCP server;
• payers of a priced call, including where they are known only by their wallet address (Article 5);
• holders of an API key and, when they are offered, buyers of credits or a plan;
• persons who write to Aletheia Analytics.

It does not cover: the Gavel Protocol and the thegavel.io interface, which are governed by their own documents published on thegavel.io; the blockchains the Stack observes; the credit venues described in the data; or processing decided by a service the user chooses themselves (their browser, wallet, artificial intelligence client or x402 client).

3. What the Stack does not record

All three surfaces are read-only: none prepares, signs or broadcasts a transaction. The Stack creates no user account, offers no wallet connection, sets no cookie and uses no audience measurement, tracker, advertising pixel or third-party error-tracking tool.

The usage meter (Article 4.6) keeps no IP address. No wallet address is grouped with others, labelled or linked to an identity. Aletheia Analytics does not seek to know who is behind a call, an IP address or a wallet address, and does not sell or disclose personal data to third parties other than the service providers of Article 7.

4. The processing

Each processing is described with its data, purpose, legal basis and retention period. The table in Article 4.12 summarises them.

4.1. Serving the site

The site is hosted and delivered by Vercel. Most pages are generated in advance. To deliver a page, Vercel receives the browser's request: IP address, address of the page requested, timestamp, user-agent and referrer when sent; Vercel keeps logs of these requests. The share images of charts (/api/chart-card, /api/event-card, /x) are produced on request by Vercel functions, which record nothing for Aletheia Analytics.

• Purpose: deliver the site and protect it.
• Legal basis: Aletheia Analytics' legitimate interest in publishing an available and secure site.
• Retention: Vercel keeps these logs for the period its plan provides; Aletheia Analytics does not export or keep them.

4.2. Pages that query the API from the browser; the /positions/{address} reader

A few pages query the API from the visitor's browser (in particular the market explorer and /positions). The visitor's IP address then reaches the API server and is processed as described in Articles 4.3, 4.5 and 4.6. These calls are never charged.

The /positions/{address} reader displays the public on-chain state of an address typed by the visitor. The address appears in the page address, and so in Vercel's logs (Article 4.1), and in the path of the API call. The API's application log masks any wallet address of the form 0x followed by 40 characters (0x[addr]). The page carries the noindex, nofollow header. The address looked up is not kept anywhere else, nor linked to other addresses or to an identity.

• Purpose: display the data the visitor asked for.
• Legal basis: legitimate interest in providing, on request, a reader of public data.
• Retention: that of the logs concerned (Articles 4.1 and 4.3).

4.3. Access logs of the API and the MCP server

The API and the MCP server listen only on the server's local interface; every request passes through the nginx front server. nginx keeps an access log in a reduced format: IP address, timestamp, method and path requested (any wallet address masked, without the query string), status and size of the response, and the user-agent; the referrer is not recorded. Retention: 14 days.

• Purpose: run and secure the service; detect abuse and incidents.
• Legal basis: legitimate interest in the security and operation of the service.
• Retention: 14 days (daily rotation, 14 generations kept). An item needed to handle a security incident may be kept for as long as the incident is handled.

4.4. Application logs of the API and the MCP server

The API's application log records, for a slow or failed request, the method, the path (addresses masked), the status and the duration. It contains no IP address and no user-agent. Retention: 14 days.

The MCP server's log records, in production:

• when a session opens, the name and version the client declares about itself (for example "claude-desktop", "0.9.1") and the access tier;
• for each tool call, the tool's name and the access tier;
• for each API read made to answer, the path and parameters of that read, its status and its duration;
• errors.

It records no IP address, no user-agent, no API key and no response content. The tools of the Stack's MCP server take no wallet address as a parameter.

• Purpose: run the service, diagnose errors and measure which tools and which clients are used.
• Legal basis: legitimate interest.
• Retention of the MCP server's log: 14 days.

4.5. Rate limiting

To protect the service, the API and the MCP server limit the number of calls. These limits protect the infrastructure; they are not used for billing.

• API, caller without a key: a per-minute counter and a per-UTC-day counter, held in memory, keyed by the caller's network (the /64 prefix of the IPv6 address, or the IPv4 address). The per-minute counter is erased after two minutes of inactivity; the day's counter is erased when the UTC day changes.
• MCP server, caller without a key: a counter per one-minute window, held in memory, keyed by the IP address.
• Caller with a key: the counter is on the key (Article 4.10).

These counters are never written to disk; a restart of the service erases them.

• Legal basis: legitimate interest in protecting the service against overload and abuse.
• Retention: at most the current UTC day, in memory.

4.6. The usage meter

Every call to the Stack's API or MCP server is counted, per UTC day, in the usage meter. A meter row groups the calls of one day that share: the door (API or MCP); the route or tool called; its cost class; the class of the host called; the class of the originating page, read from the browser's Origin header (Stack site, Gavel site, none); the caller class (anonymous, key, payer, internal); the caller; the client family, read coarsely from the user-agent (for example "claude", "python", "browser"), never the full user-agent. The row carries the number of calls, their size and their value at list price.

No IP address is kept. A caller without a key is recorded under a daily pseudonym: a fingerprint (HMAC-SHA-256, truncated) of its network (the /64 in IPv6, the address in IPv4), computed with a secret key drawn at random, held only in memory and replaced at each UTC midnight. That key is never written. The same caller therefore receives the same pseudonym for one day and a different one the next; once the key is replaced, Aletheia Analytics can no longer recompute a past day's pseudonym from an IP address. The API and the MCP server each draw their own key: their pseudonyms do not match.

A key holder is recorded under its key's identifier (API) or a fingerprint of the key (MCP). A payer is recorded under its wallet address (Article 4.8).

Rows older than 90 days are folded into a daily summary that keeps only the totals and the number of distinct callers, without the "caller" field, and then deleted.

The API also keeps a daily count of calls per route and per originating page, under "anonymous" or the key's identifier, with no IP address and no query parameter.

• Purpose: know how the Stack is used, set the free allowance and the prices, establish revenue.
• Legal basis: Aletheia Analytics' legitimate interest in measuring the use of its service.
• Retention: rows with a caller, 90 days; summary without a caller, the life of the service.

4.7. The free allowance

Each anonymous caller has 100 free priced calls per UTC day. To apply it, the API holds in memory, for the day, the number of priced calls of each daily pseudonym (Article 4.6) and, to bound the use of a single IPv6 network, the number of /64 networks seen in each /48 prefix. These counters are erased when the UTC day changes and at every restart; they are never written. A failed call does not use the allowance.

• Legal basis: performance of the terms of use and of sale, of which the allowance is part; legitimate interest in preventing its circumvention.
• Retention: the current UTC day, in memory.

4.8. Payment by x402 (USDC on Base)

Past the free allowance, a priced API call may be paid in USDC on the Base blockchain through the x402 protocol. This payment is not yet open to the public; it opens after the Stack's documents are published.

How it runs, from the data's point of view:

1. The API answers 402 with the price and Aletheia Analytics' receiving address.
2. The payer's client sends the call again with a payment authorisation signed by its wallet. It carries the payer wallet's address, the amount, the receiving address, a validity period and a unique identifier.
3. Aletheia Analytics' server passes this authorisation to Coinbase's facilitator (Coinbase Developer Platform), which verifies it and settles the payment on the Base blockchain. It is Aletheia Analytics' server, not the payer's device, that calls Coinbase: Coinbase does not receive the payer's IP address through this flow.
4. The answer is delivered with the PAYMENT-RESPONSE header, which names the network, the transaction and the payer's address.

What Aletheia Analytics records:

• in the usage meter, the payer wallet's address in place of the pseudonym ("payer: 0x…"), with the number and value of the day's paid calls; 90 days, then folded without the address (Article 4.6);
• in its accounting records, the receipts, with the paying address and the transaction hash; ten years.

The settlement itself is recorded on the Base blockchain. It is public and permanent, and neither Aletheia Analytics nor anyone else can erase it (Article 6).

• Purposes: perform the sale; keep the accounts; answer a request for an invoice.
• Legal bases: performance of the contract (the terms of sale); legal obligation to keep accounting records.
• Retention: meter, 90 days; accounting records, ten years from the close of the financial year.

4.9. Payment by Lightning (may be offered)

Aletheia Analytics may offer payment for a call in bitcoin over Lightning, received by its own node, which only receives. If it is offered, Aletheia Analytics will record the Lightning invoice and its payment hash with its accounting records, for ten years (legal obligation). A Lightning payment does not reveal the payer's identity or address to Aletheia Analytics. This policy will be completed before that payment opens.

4.10. API keys; credits and plan (Stripe); OAuth connection to the MCP server (to be offered)

API keys. A caller may present an API key. Aletheia Analytics then keeps, for that key, its identifier, its access tier, its status, the date it was last used and the number of calls per day. Legal basis: performance of the contract. Retention: the life of the key, then five years, as evidence of the contract.

Credits and plan (to be offered). Aletheia Analytics may sell credits and a plan payable by card through Stripe. If they are offered: the card is entered on a Stripe page and its data does not reach Aletheia Analytics; Stripe passes to Aletheia Analytics the customer's email address, billing name and address, country and, where applicable, VAT number, and the state of their payments; Aletheia Analytics links the customer to their API key and credit balance. Legal bases: performance of the contract; legal obligation for invoices. Retention: the commercial relationship, then ten years for invoices and accounting records.

OAuth connection to the MCP server (to be offered). So that credits can be used from an artificial intelligence assistant, Aletheia Analytics may offer an OAuth connection to the MCP server. The data processed (account identifier, access tokens) and its retention will be described here before it opens.

4.11. Contact and exercise of rights

When you write to Aletheia Analytics, it processes your email address, your name if you give it, the content of your message and its attachments, and, if you provide them, a wallet address or a transaction hash (for example to ask for an invoice).

• Answering a request: legitimate interest; 3 years after the last exchange.
• Request for an invoice: performance of the contract and legal obligation; the invoice and the request are kept with the accounting records, ten years.
• Exercise of rights: legal obligation; the time needed to handle the request, then minimal proof for up to 5 years.

4.12. Summary

5. If you are known only by your wallet address

This Article is for the person, or the software acting for them, who pays for a call by x402 with no other relationship with Aletheia Analytics. The API's 402 answer and the site's /connect page link here.

A wallet address may be personal data where it can be linked to a natural person. Aletheia Analytics treats it as such.

• What is recorded: the payer wallet's address, the amount, the date, the transaction hash, and the number of paid calls per day (Articles 4.6 and 4.8). No name, email address or IP address is associated with that address.
• Why: to perform the sale; to keep the accounts, as the law requires; to issue an invoice if you ask for one.
• For how long: 90 days in the meter; ten years in the accounting records.
• Who receives it: Coinbase, which settles the payment (Article 7); and, because the payment is recorded on the Base blockchain, anyone who reads that blockchain.
• Your rights: those of Article 11. For a request concerning an address, Aletheia Analytics may ask you to prove that you control that address by signing a message, with no transaction (Article 12). Data the law requires to be kept in the accounting records cannot be erased before the end of the legal period.

Aletheia Analytics does not seek to identify the person behind a paying address.

6. Public blockchain data

An x402 payment is recorded on the Base blockchain; the /positions reader displays the public state of an address; the Stack's data is partly read from public blockchains. This information is public and permanent and is not under Aletheia Analytics' control: it cannot delete, modify or reverse a transaction recorded on a blockchain.

That does not remove the rights a person has over the processing for which Aletheia Analytics is responsible: copies, logs, counters and records kept in its own systems. Where a right applies, Aletheia Analytics acts on that data, without claiming to modify the blockchain.

The Stack publishes measurements aggregated by credit venue. It publishes no record per wallet address, and does not group or label the addresses it reads.

7. Recipients and service providers

Access to data is limited to the persons and providers who need it.

Artificial intelligence clients. When you query the Stack from Claude or another assistant or software, that third party processes your data under its own terms. Aletheia Analytics does not use these providers as processors and does not pass data to them on its own behalf.

No personal data is disclosed to the venues described in the data, to an advertiser or to a data buyer.

8. Transfers outside the European Union

The server of the API, the MCP server and the database is located in the European Union.

Vercel and Coinbase are established in the United States; Namecheap Private Email may involve processing in the United States; Stripe, if offered, may process data in the United States. Where data is transferred to a country that does not benefit from an adequacy decision of the European Commission, or to a recipient not covered by such a decision, Aletheia Analytics relies on the safeguards of Articles 44 et seq. of the GDPR, in particular the European Commission's standard contractual clauses.

You may ask for information on the safeguards applying to a transfer by writing to Aletheia Analytics.

9. Cookies and local storage

The site sets no cookie. It uses the browser's local storage (localStorage) to remember five display choices you make, in that browser only:

These values do not leave your browser and are read by no server. This storage is strictly necessary for the service you ask for by making the choice (Article 82 of the French Data Protection Act). You can clear it from your browser; the site then returns to its default choices.

The site uses the fonts already installed on your device; no font service is called.

If credits or an OAuth connection are offered, Stripe's payment pages and the sign-in pages may set their own cookies on their own domain; they will be described here before they open.

10. Security

Aletheia Analytics implements appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure. The API and MCP servers can be reached only through the front server; exchanges are encrypted (TLS). No measure guarantees zero risk. Aletheia Analytics does not publish details whose disclosure would reduce the security of its infrastructure.

Aletheia Analytics will never ask for your private key, your recovery phrase or your wallet password.

11. Your rights

Under the conditions laid down by the GDPR, you may ask for access to data about you, its rectification, its erasure, the restriction of a processing and portability, and you may object to a processing based on legitimate interest.

What these rights can reach in the Stack:

• Daily pseudonym. Once the day's key is replaced, Aletheia Analytics can no longer link a meter row to an IP address. It is not required to keep or obtain additional data to identify you (Article 11 GDPR), but you may provide information that allows it.
• Paying address. Access, rectification and objection apply; accounting records can be erased only at the end of the legal period.
• Blockchain. Aletheia Analytics acts on its own copies, never on the blockchain (Article 6).
• Portability. It does not cover the measurements and derived data Aletheia Analytics produces.

To exercise your rights: contact@aletheia-analytics.io (Article 1).

12. Verifying a request concerning an address

To prevent a fraudulent request, Aletheia Analytics may ask for the information reasonably needed to verify that the request comes from the person concerned. Where the request concerns a wallet address and no civil identification is needed, that proof may be a message signed by the wallet, which creates no transaction and moves no asset.

13. Automated decisions and profiling

The free allowance, the 402 answer and the rate limits apply automatically and in the same way to every caller, according to the day's number of calls. No other decision is based solely on automated processing. Aletheia Analytics does not profile callers, and nothing in the Stack assesses a person.

14. Minors

The Stack is not intended for persons under eighteen. Aletheia Analytics does not seek to collect their data.

15. Changes to this policy

Aletheia Analytics may change this policy to reflect a change in the processing, the architecture, a provider or the applicable law, and will do so before opening a processing it does not yet describe (Lightning payment, credits, plan, OAuth connection). Each version is dated. Where a future processing would require consent, it would be obtained before the processing starts.

16. Contact and complaints

ALETHEIA ANALYTICS, 173 rue de Courcelles, 75017 Paris, France — contact@aletheia-analytics.io.

You may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.