Privacy

Poly Credit is operated by Polysystems, Inc., a company incorporated in Delaware, United States, operating from Wilmington, Delaware ("Poly", "we", "us"). For the personal data described here Polysystems, Inc. is the controller — the entity that decides why and how it is processed. Write to privacy@poly.inc about anything in this policy, to dpo@poly.inc for data-protection matters, or to legal@poly.inc about anything else.

This policy covers poly.credit: this application and the API behind it. Your Poly account itself, and the data poly.inc holds as the sign-in provider, are governed by poly.inc. We learn who you are when you sign in; we never receive your password.

From your sign-in: your username, email address, account identifier, and subscription status (whether you have Poly Pro). This comes from Poly when you sign in with GitHub or Google, and is re-checked while you use the service.

Your reservation and the username you chose. The username is public: it shows on the landing page and prints on the card.

If you claim one, your handle. A claimed handle is public and resolvable — anyone can ask the API which wallet address a handle receives at.

If you create a wallet: one encrypted blob (the ciphertext of your recovery phrase) and your wallet's public address. The ciphertext is useless without your passphrase; the address is public by nature. Storing the address next to your account links the two — someone holding our data could connect your Poly account to activity on a public blockchain.

If you publish agents for sale: the version of the seller agreement you accepted, and your listings. If you file a seller profile, that too (legal name, tax identification, country, address, entity type). Verification is optional: if you file one — legal name, date of birth, country and address, the kind and reference of the identity document, your self-certification, and the review decision — it is kept with your account. Your seller handle on a listing is public; a verified seller's registered name and country are public too, shown on the listing.

If you create API keys: their names, scopes, expiry, and a one-way hash. A hash cannot be read back into a key.

A ledger of amounts credited and spent on your account, and the usual technical records — IP address, user agent, the requests you make — to run and protect the service.

Your Poly password, your wallet passphrase, and your recovery phrase. The phrase is generated in your browser, encrypted there under your passphrase, and only the ciphertext ever leaves it. Transactions are signed in your browser; we hold no key that could sign for you.

This is a property of the design, not a promise about our conduct: a full compromise of our servers costs you the data in the previous section — it cannot cost you your keys.

To perform the service you asked for (contract): your account and reservation, your handle, your wallet vault, the marketplace, and the records that make balances, installs and listings work.

To keep the service safe (legitimate interests): technical logs, abuse and impersonation response. You may object to processing grounded in legitimate interests — see Your rights.

Because a law requires it (legal obligation): today, effectively nothing. If seller-reporting or anti-money-laundering obligations ever attach to your account — they do not today — keeping the seller profile you filed would rest on this basis.

To run the marketplace's trust-and-safety controls (contract and legitimate interests): your verification record exists so a listing can be traced to an identified, reviewed seller — we process it to decide verification, to show buyers who they are buying from, and to act when a listing is abused.

Consent is not currently a basis for anything we do, and we intend to keep it that way. Where you see a checkbox in this product, it records that you read an agreement — not a marketing permission.

GitHub or Google, when you sign in through them. They are controllers of their own data processing; what they do is governed by their policies, not this one.

poly.inc, which holds your account and issues your session.

Helius Labs, our Solana RPC provider, acting on our instruction. Every balance check and every transaction this app submits passes through them: the addresses queried, the signed transactions, and the rhythm of both. Checks run continuously — roughly every twenty seconds while a wallet screen is open. Helius sees our server's IP address, not yours. On devnet, Solana's public devnet endpoint plays this role instead.

Our hosting provider, which sees request metadata including IP addresses, as any host must.

The public: your username, your handle, the addresses you transact from, your seller handle on any listing — and everything on a blockchain. A chain is a public, permanent, append-only record that we cannot edit, delete, or recall. Treat every address you use as linkable to you.

Our providers are largely based outside the European Union, including in the United States. Where personal data leaves the EEA, it does so under the GDPR's mechanisms for international transfers — an adequacy decision or standard contractual clauses — with the provider concerned.

Chain data is not ours to transfer: once a transaction is public, it is global.

Data in your browser stays until you clear it, or remove the wallet from the device.

Account, reservation, handle, listing and seller-profile data are kept until you delete them or delete your account. Deletion from the live service is immediate; backup copies expire within thirty days.

Request logs are kept for at most ninety days, then they are gone.

Revoked API keys are kept as one-way hashes, so a revoked key can never be quietly reused — and no plaintext key ever existed to leak.

Accounting records of sales and spend can outlive your account in a form we cannot attribute: on deletion the linkage to you is destroyed, and what remains are figures with no owner. This tracks the GDPR's rule that erasure does not apply to records kept for legal compliance — with the honest note that no such obligation reaches this preview today.

If seller-reporting or anti-money-laundering obligations ever attach to your account, seller records are kept for as long as those laws require — up to five years after the relationship ends — and erasure gives way. If that day comes, this policy changes first.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, restrict or object to its processing, ask for a portable copy, and withdraw consent — though nothing currently rests on consent to withdraw. Write to privacy@poly.inc, or use Profile → Your data.

Profile → Your data does the two most common requests instantly: it downloads everything this application holds about you, and it deletes your account and your data from this service. Anything else is a human reading an email, answered within thirty days.

Erasure has the limits stated under How long: the chain keeps what it keeps, accounting figures persist unattributed, and any legally mandated records would outlive a deletion request.

You can complain to your local data-protection authority at any time. You can also write to legal@poly.inc first — a human will read it.

One cookie: poly_session, set by poly.inc when you sign in, HttpOnly, used only to keep you signed in. There are no advertising, analytics, or third-party cookies. Nothing stored is optional, which is why there is no consent banner: there is nothing to opt into.

Local storage, all strictly necessary: access_token, refresh_token and user keep your session; poly-credit-ledger keeps your branches and transaction history, including memos you wrote; poly-credit-wallet keeps the encrypted vault and public addresses, never the phrase; poly-credit-capability keeps what you installed and the price you agreed to. Session tokens live in browser storage because the app is browser-first; that is standard, and it means a compromised browser compromises the session.

The recovery phrase is encrypted in your browser with AES-256-GCM under a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations). The passphrase is never transmitted; the servers store only the ciphertext and a public address. Every transaction is signed in your browser.

The same property cuts both ways, and we would rather you knew: we cannot recover a passphrase for you, and we cannot undo a transaction you signed.

None. There is no profiling, no scoring, and no automated decision with legal or similarly significant effect. Entitlements are decided by Poly; refusals here are rule-based, and a human reads the appeal.

The service is for people old enough to form a binding contract where they live (see the Terms of service). It is not aimed at children, and we do not knowingly hold children's data.

This policy is versioned by the date at the top. A material change bumps that date. Where a change affects what you accepted as a seller, you will be asked to accept the new version — we will not deem you to have agreed to terms you never saw.