Privacy Policy

1. Overview

nanotoll.dev provides per-call billing for MCP tool calls. This Privacy Policy describes what data we collect, how we use it, and the rights you have regarding your data. We collect the minimum data necessary to operate a billing service. We do not collect email addresses, names, phone numbers, or any personally identifying information at registration.

2. Data We Collect

When you register and use our services, we collect the following:

Data	What it is	How stored
API key hash	SHA-256 hash of your API key	Hash only. Raw key never stored.
Funding address	Ethereum 0x address for USDC deposits	Plaintext (public on Base L2)
Billing logs	input_chars, amount charged, timestamp, idempotency key	SQLite, retained
Payment logs	tx_hash, amount credited, confirmations, status	SQLite, retained
Audit trail	Append-only hash chain of all balance operations	SQLite, append-only (no UPDATE/DELETE)
Request metadata	IP address (transient, in server logs only)	Container logs, rotated (max 10MB x 3)

3. Data We Do NOT Collect

• Email addresses
• Names or usernames
• Phone numbers
• Physical addresses
• Cookies (our API does not set cookies)
• Browser fingerprints
• Third-party analytics or tracking
• Advertising identifiers

4. How We Use Your Data

• API key hash: Authenticate your API calls without storing the raw key.
• Funding address: Identify USDC deposits on Base L2 and credit your balance.
• Billing logs: Track charges and enable usage queries.
• Payment logs: Verify on-chain deposits and prevent double-crediting.
• Audit trail: Maintain a tamper-evident record of all financial operations.
• Request metadata: Operational logging and abuse prevention. Log files rotate and are not retained indefinitely.

5. Data Sharing

We do not sell, rent, or share your data with third parties. We do not use third-party analytics or advertising services. Your data is used solely to operate the billing service.

On-chain payment data (tx hashes, funding addresses, amounts) is inherently public on the Base L2 blockchain. This is a property of blockchain payments, not a nanotoll disclosure.

6. Data Security

• API keys are stored as SHA-256 hashes. The raw key is never persisted to disk.
• The audit log is append-only — database triggers block UPDATE and DELETE operations.
• All traffic is encrypted via TLS 1.2+ with HSTS preload.
• Internal services are not exposed publicly.

7. Your Rights (GDPR / CCPA)

Under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have the right to:

• Access: Request a copy of your billing logs, payment logs, and audit records.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your account data, subject to financial record-keeping obligations (billing and audit logs may need to be retained for tax/accounting compliance).
• Portability: Export your usage data in machine-readable format via the API.
• Objection: Object to processing of your data.

To exercise these rights, contact: admin@nanotoll.dev

8. Data Retention

• Billing logs: Retained for the lifetime of your account.
• Payment logs: Retained for the lifetime of your account (required for on-chain reconciliation).
• Audit log: Append-only, retained indefinitely (cannot be deleted by design).
• Server logs: Rotated at 10MB x 3 files per container. Not retained long-term.
• API key hash: Deleted when you revoke your key.

9. Blockchain Payments

USDC payments are processed on the Base L2 blockchain. Transaction hashes, sender addresses, and amounts are public and permanent on-chain. This is an inherent property of blockchain technology. nanotoll watches on-chain transfers to credit your balance but does not control or alter on-chain data.

10. Children's Privacy

Our service is intended for developers and businesses. We do not knowingly collect data from children under 16. If you believe a minor has registered, contact us and we will delete the account.

11. International Data Transfers

Our servers are located in the European Union (Germany). If you access the service from outside the EU, your data is transferred to Germany. By using the service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the service after changes constitutes acceptance.

13. Contact

For privacy questions or data requests, contact: admin@nanotoll.dev