Privacy Policy — PowaAgent

Data controller

PowaAgent is operated by CertainData Ltd, a company registered in England & Wales under company number 17354647 (official name: CERTAIN DATA LTD), whose registered office is at Venture House, 2 Arlington Square, Downshire Way, Bracknell, Berkshire, RG12 1WA. CertainData Ltd is the data controller for the personal data described in this Policy. Supervisory authority: UK Information Commissioner's Office (ICO). Privacy contact: privacy@powaagent.ai.

This Policy explains what personal data PowaAgent collects, how it is used, and what rights you have.

1. Information we collect

Account information: your name, email address, company (where applicable), country, telephone number and authentication information.
Wallet information: your public Base wallet address and information necessary to provision and operate your wallet through Coinbase CDP. PowaAgent does not receive or store your wallet recovery key.
Transaction and usage information: sellers and endpoints contacted by your agent, transaction amounts, timestamps, transaction status, blockchain transaction identifiers, and host/path usage information. Query strings, prompts and response bodies are not stored as part of PowaAgent's normal usage records.
Spending-control information: your allow and deny lists, spending caps, ecosystem settings and approval decisions.
Security and technical information: authentication events, API activity, device/browser information, IP addresses and technical logs where required to secure and operate PowaAgent.
Support information: information you provide when you contact us for support.

2. How and why we use your information

We process personal data only where we have a lawful basis under applicable data-protection law.

To provide PowaAgent and perform our contract with you: including account creation, authentication, wallet provisioning, Delegated Signing, spending controls, transaction processing, receipts and account administration.
For our legitimate interests: including securing and protecting PowaAgent, preventing misuse and fraud, troubleshooting, support, improving service reliability and analysing aggregated service usage. Where we rely on legitimate interests, we consider those interests against your rights and freedoms.
To comply with legal obligations: including obligations relating to financial crime, sanctions, regulatory requirements, accounting, tax, law-enforcement requests and other legal obligations where applicable.
With your consent: where consent is required, for example for non-essential cookies, analytics or marketing communications. You may withdraw consent at any time.

We do not sell personal data.

3. Who we share information with

We use third-party service providers where necessary to operate PowaAgent. These may include:

Amazon Web Services (AWS) — cloud hosting, authentication and operational infrastructure.
Coinbase / Coinbase Developer Platform (CDP) — wallet infrastructure, key-management functionality and Delegated Signing services.
Base blockchain infrastructure — transaction information submitted to the Base network becomes part of the public blockchain.
Professional advisers, auditors, regulators, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

We require service providers handling personal data on our behalf to protect it appropriately and to process it in accordance with applicable data-protection requirements.

Operational data is hosted primarily in AWS eu-central-1 (Frankfurt, Germany).

4. International transfers

Some service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, we use an appropriate transfer mechanism as required by UK data-protection law, such as applicable adequacy regulations or approved contractual safeguards.

You may contact privacy@powaagent.ai for further information about the safeguards applicable to international transfers.

5. How long we keep information

Buyer transaction data is available in the PowaAgent portal for 60 days. Certain transaction, security and operational records may be retained internally for longer where necessary to operate and secure PowaAgent, comply with legal or regulatory obligations, maintain accounting records, investigate fraud or disputes, or establish, exercise or defend legal claims.

Other personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, including while your account is active and where necessary afterwards to meet legal, regulatory, accounting, security or dispute-resolution requirements.

Public blockchain records cannot be deleted by PowaAgent because they form part of the immutable Base blockchain.

When personal data is no longer required, we delete or anonymise it in accordance with our retention practices.

6. Your data-protection rights

Depending on the circumstances and the lawful basis for processing, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data;
request restriction of processing;
object to certain processing, including processing based on legitimate interests;
request portability of personal data you provided to us where the legal requirements are met; and
withdraw consent at any time where processing is based on consent.

These rights are subject to legal limitations and exemptions.

To exercise your rights, contact privacy@powaagent.ai.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

7. Automated processing

PowaAgent automatically evaluates payment requests against the spending controls configured for your account, including deny and allow lists, approval requirements, ecosystem permissions and spending caps. A request that does not satisfy those controls may automatically be refused or sent for approval.

These controls are used to implement instructions and limits configured for your account and to protect PowaAgent. You can change applicable spending controls through your dashboard.

8. Blockchain information

Payments are settled on the Base blockchain. Wallet addresses, transaction identifiers, transferred amounts and other information included in blockchain transactions are publicly visible and may remain permanently available.

PowaAgent cannot alter or erase information recorded on a public blockchain.

9. Cookies and similar technologies

We use strictly necessary cookies and similar technologies where required to operate and secure PowaAgent.

The PowaAgent site may also use non-essential analytics and marketing technologies, including Google Analytics 4 (GA4), Meta Pixel and LinkedIn Insight Tag where enabled. These technologies may collect information about how you use the site, your device and browser, and interactions with our pages so that we can understand site usage, measure campaigns and improve our communications.

Non-essential cookies and tags will only be used where the required consent has been obtained. You can manage your choices through the cookie consent controls made available on the site.

10. Children

You must be at least 18 years old to create or use a PowaAgent account. PowaAgent is not intended for children.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Where changes are material, we will take reasonable steps to bring them to the attention of registered users. The current version will always be available on this page.