← Back to tryx402

Privacy Policy

Effective and last updated: September 5, 2026

1. Scope

This policy applies to the tryx402 website, dashboard, API, MCP server, and ChatGPT plugin. It explains what information we process, why we process it, where it goes, how long we keep it, and the controls available to you.

2. Data we process

• Account and authentication data: email address, Supabase user identifier, authentication status, and short-lived session or OAuth tokens. We never request or store crypto-wallet private keys or seed phrases.
• Wallet and billing data: internal wallet identifier, balance, currency, Stripe Checkout session identifier, payment status, amounts, and transaction timestamps. Stripe processes card and wallet-payment credentials; tryx402 does not receive full card numbers.
• Tool and transaction data: the selected provider URL or origin, HTTP method, quoted and charged amounts, budget limits, call status, timestamps, receipts, and spend-ledger entries.
• User-provided tool inputs: request parameters and payloads you ask ChatGPT or tryx402 to send to a selected API provider. Those inputs may include personal data if you put personal data in a request.
• Technical and support data: IP address and basic request metadata collected by our hosting providers, security and error logs, browser or device information made available in standard HTTP requests, and messages you send to support.

3. How we use data

We use this information to authenticate users, connect ChatGPT to the correct tryx402 account, enforce budgets, route requested API calls, process and reconcile payments, show balances and spend history, prevent abuse and fraud, troubleshoot failures, provide support, improve reliability, and comply with legal obligations.

Where the GDPR applies, our legal bases are performance of the service contract, our legitimate interests in securing and improving the service, compliance with legal obligations, and consent where applicable.

4. Sharing and subprocessors

We share data only as needed to provide the service:

• OpenAI: ChatGPT sends authorized tool inputs to tryx402 and receives tool results. OpenAI processes that information under its own terms and privacy policy.
• Supabase: account authentication, user sessions, and temporary OAuth authorization records.
• Vercel and Fly.io: application hosting, network delivery, and operational logs.
• Stripe: Checkout, payment processing, receipts, and payment-related fraud prevention.
• Selected API providers and payment networks: request content is sent to the provider you choose; payment or settlement details may be visible on the applicable blockchain or payment rail.
• Authorities or advisers: when required by law or reasonably necessary to protect rights, users, or the service.

We do not sell personal data or use it for third-party advertising.

5. Retention

• OAuth authorization codes expire after five minutes and are deleted after a successful token exchange; abandoned expired grants are removed automatically during subsequent authorization activity.
• Authentication access tokens follow the lifetime set by the authentication provider and are not returned in MCP tool output.
• Account and wallet data is kept while the account is active and then deleted or anonymized following a valid deletion request, except where retention is required for security, dispute resolution, or law.
• Billing, payment, and transaction-ledger records may be retained for up to five years, or longer if applicable law requires it.
• Routine infrastructure and security logs are generally retained for no more than 90 days unless a longer period is necessary to investigate abuse, resolve an incident, or meet a legal obligation.

6. Your controls and rights

You can disconnect tryx402 from ChatGPT in ChatGPT’s plugin or connection settings. You may also request access, correction, export, restriction, objection, or deletion of your personal data by emailing [email protected]. We may need to verify your identity before acting on a request. If you are in the EEA, you may lodge a complaint with your local data-protection authority.

7. Security and transfers

We use encrypted transport, short-lived authorization grants, scoped access, and access controls intended to protect data. No online service can guarantee absolute security. Our service providers may process data outside your country under their applicable transfer safeguards.

8. Children

tryx402 is a developer and business service and is not directed to children under 18.

9. Changes

We may update this policy as the service changes. We will change the date above and provide additional notice when required.

10. Contact

Privacy: [email protected]
Security: [email protected]
ARTAIFACT SAS, 92240 Malakoff, France