Privacy notice

1. Who is responsible

Florian Baraz, Gurlittstr. 6, 27474 Cuxhaven, Germany, is responsible for the processing described here (controller under Art. 4 (7) GDPR). Write to privacy@402lounge.com or by post to Florian Baraz, c/o Stiffel, Gurlittstr. 6, 27474 Cuxhaven, Germany.

2. Who this notice is for

This notice is for visitors of 402lounge.com, for agents and the companies that run them, for people who belong to a company account, for sellers whose services appear in the directory and the register, for people who write to us or report content, and for holders of wallets whose payments to listed sellers we read on Base.

Where we process personal data on behalf of a company, for example the email addresses of its people and its receipts, we act as its processor under our data processing agreement. This notice still tells you what happens to that data.

3. Visiting the website

When you open a page or call our API, your browser or client sends its IP address, the time, the address it asks for, the page it comes from and its browser type. Our host Cloudflare processes these to deliver the page and to protect it against attacks. Request logs are deleted after at most 7 days. Legal basis: our legitimate interest in a site that works and is safe (Art. 6 (1) (f) GDPR).

To stop abuse we count requests per IP address within short windows of at most 24 hours. To count how often a page or a listing is seen, we keep a hash of the IP address for 30 minutes, so that a reload counts once. After that only the number per day is left. Legal basis: Art. 6 (1) (f) GDPR.

If you allow it in the banner, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to see which pages people read and how they find us. Only then does your browser load Google's script. It sets the cookies _ga and _ga_<id> with a random identifier for at most 13 months and sends Google the pages you open, the page you came from, the time, your browser, device, screen size, language and the region your IP address points to. Google Analytics does not store the IP address itself. We have turned off Google signals and every use for advertising. Google deletes the data about single visits and visitors after 14 months, only totals in the reports stay. Google processes this data for us as a processor and can access it from the USA (section 11). Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Without it nothing from Google loads. You can withdraw it at any time with "Cookie settings" at the bottom of every page, and the cookies are deleted. Your choice itself stays in your browser's local storage, which is strictly necessary to respect it (§ 25 (2) No. 2 TDDDG).

The sign-in by email and the report form use Cloudflare Turnstile to tell people from bots. Turnstile processes the IP address and technical data about the browser for this check. Legal basis: our legitimate interest in forms that are safe from spam and attacks (Art. 6 (1) (f) GDPR). The check is needed for the form you choose to send (§ 25 (2) No. 2 TDDDG).

Apart from the Google Analytics cookies, which only come with your consent, the website sets no cookies of its own. Cloudflare can set a technically necessary cookie that tells people from bots and expires after at most 30 minutes. When you sign in to the dashboard, your browser keeps a sign-in token so that you stay signed in. Both are strictly necessary for the service you asked for (§ 25 (2) No. 2 TDDDG). Our fonts come from our own servers, so your browser does not contact Google or any other font service.

4. Agents, companies and the people in them

Account. When an agent signs up, we store its name, the wallet it proved and the signed message or the payment with which it accepted the terms, and we create a company for it. For every agent we store its role, its status, the apps it connected through, when an app last used the account, and its sessions. Session tokens are stored only as hashes. A token stops working after 90 days or when it is revoked.

Company. When you add company data, we store the name, legal form, address, country, the VAT ID with the result and time of its check, the VAT status (for example small business), the plan, the company email with the time it was confirmed, and your settings for currency, conversion method and chart of accounts. A new email address waits until its code is confirmed, and the confirmed address stays in use until then.

People. For people in a company we store their email address, their role, when they joined, when they last signed in, and which version of the terms and of this notice they accepted and when. They sign in with a link or a code we send by email, with their Google account or by signing a message with a wallet of their company. A person who turns on the two-step sign-in also types a code from an authenticator app, the key of that app is kept with the sign-in until they turn it off. With Google, Google tells us the email address, the name and the ID of the Google account, and Google learns that the person signs in to 402lounge. Google Ireland Limited acts as a controller in its own right for its sign-in. When a person is removed from a company and belongs to no other company, we delete their sign-in.

Wallets. We store the addresses of your company's wallets, their names, which agent runs them and since when, and the proof that they are yours. A wallet address is not a name, but it can sometimes be linked to a person, so we treat it as personal data.

Notices. We send notices to agents through their account and show them to the people of the company in the app. Important ones, such as decisions about your account, deadlines, payments and new terms, also go to the confirmed email address of the company.

Legal basis: the contract (Art. 6 (1) (b) GDPR) where you are our contract partner yourself, for example as a sole trader, and otherwise our legitimate interest and that of your company in running the account it asked for (Art. 6 (1) (f) GDPR). We keep signed acceptances and wallet proofs as evidence of the contract (Art. 6 (1) (f) GDPR).

For security we log sign-ups, sign-ins and failed attempts with the IP address hashed by a key that changes every day, and we delete these entries after 30 days (Art. 6 (1) (f) GDPR).

Every agent has an internal sign-in name of the form <id>@agents.402lounge.com. It is not a mailbox. It only exists so that the dashboard can start a session.

5. Payments, receipts and documents

Payments over x402 are transfers of USDC on Base, a public blockchain. Every transfer shows the sending and the receiving wallet, the amount and the time, and anyone can see it. Nobody can change or delete it, including us.

We read the transfers of your company's wallets on Base and write a receipt for each one. A receipt holds the transfer, the seller as far as the register knows it, what was bought according to the seller's prices or your agent's report, and the value in EUR with the rate used. Once your company data is in and its email is confirmed, we write a monthly document per seller with your company data, the seller's data and the payments: an overview on Free, a voucher with a tax note on Books. A wrong document is cancelled with a cancellation document, and payments that arrive later get a supplement. To read the chain we use a node of Coinbase Developer Platform, and our requests to it contain the wallet addresses we look for.

When you enter a VAT ID, we check it with VIES, the VAT information exchange system of the European Commission, which asks the tax authority of the country concerned. We store the result and the time of the check. If VIES gives no answer, we ask again at night, and we check every VAT ID again once a month.

We also count the payments of companies at 402lounge in totals for sellers: the share of the x402 payments to a seller's wallets on Base that comes from companies at 402lounge. We show it only when at least five companies paid in the period, and never which company paid what (Art. 6 (1) (f) GDPR).

Legal basis: the contract (Art. 6 (1) (b) GDPR) and our legitimate interest in correct documents (Art. 6 (1) (f) GDPR). Receipts and monthly documents are records for bookkeeping. Your company has to keep them for eight years from the end of the year in which they were issued (§ 147 AO, § 14b UStG), and it can download them at any time. We keep them for your company as long as it has a paid plan or the archive. A company without a paid plan can book the archive for €5 a month or €50 a year. Without either, the receipts and documents of a year are deleted on 31 January of the next year, so December still gets its documents and there is a month to download them. When a paid plan or the archive ends, at least 30 days pass before anything is deleted, and we send a notice before every deletion. A closed company's receipts and documents are deleted on the first 31 January after the closing, or, with a paid archive, on the first 31 January after the archive ends. Invoices and credit notes issued in a seller's name are records of that seller too, which it has to keep (§ 14b UStG). While the seller keeps its records with us, they stay for the seller after the buyer's copies are deleted, on the basis of the seller's legal duty and our legitimate interest in serving it (Art. 6 (1) (c) and (f) GDPR). Every issued document also lies as a file in our archive at Cloudflare R2 in the EU. The files are never overwritten and are deleted together with the document. The documents keep the company data as they were issued. When an agent is deleted, its receipts stay with the company and point to a "Deleted agent".

Backups. We back up the database every night. GitHub runs the backup for us and encrypts it before it leaves GitHub, with a key that only we hold, and the backup is stored at Cloudflare R2 in the EU. Daily backups run out after 35 days, the backup of the first day of each month after twelve months. We use backups only to restore the database, and data that was deleted before a restore is deleted again. Legal basis: our legitimate interest and that of the companies in data that is not lost (Art. 6 (1) (f) GDPR).

6. Payments to us

A wallet that cannot sign messages pays 0.001 USDC to our wallet as proof. Plans, sponsored places and the seller check can also be paid in USDC, by an agent over x402 or by a transfer from any wallet. Payments over x402 are settled through the x402 facilitator of Coinbase Developer Platform, which receives the paying wallet, the amount and the signed payment authorisation to submit the payment on Base. Coinbase processes this as a controller in its own right, under its own privacy notice.

For a payment in USDC we store the offer (what it is for, the price, the VAT, the exchange rate and the amount in USDC), who in the company asked for it, and the payment that paid it: the transaction, the paying wallet and the time. We look at every transfer that reaches our wallet to find the offer it pays. A transfer that pays no offer stays with us so we can clear it with the sender. For each payment we issue an invoice with your company data as they were on that day. Legal basis: the contract (Art. 6 (1) (b) GDPR) and our duties under tax law (Art. 6 (1) (c) GDPR).

Paid plans and sponsored places are sold through Polar. When you buy one, Polar Software, Inc. is the seller (merchant of record): Polar takes the payment, charges VAT where it applies and issues the invoice, as a controller in its own right under its own privacy notice, and uses payment processors such as Stripe for the card payment. We receive from Polar your company name, email address, billing address, country, VAT ID, the plan and whether the payment went through, never card or account numbers. Legal basis: the contract (Art. 6 (1) (b) GDPR).

We keep our invoices and payment records for eight years, our books for ten years and business letters for six years, as tax law requires (Art. 6 (1) (c) GDPR with § 147 AO and § 14b UStG). Our invoices for payments in USDC and the payments behind them stay for that time even when your company is closed and its data are deleted.

7. Sellers, the directory and the register

We list services that accept x402 from public sources: the service's own 402 answer, its website and public catalogues of x402 services. A listing shows the name, description, prices, wallets and logo and, where the seller has made it public, its company and location. We use this to tell buyers who is behind a wallet before they pay (Art. 6 (1) (f) GDPR). Most listings are about companies. Where a listing is about a person, for example a sole trader, that person can object at any time (section 13).

When a seller claims its listing, we store a contact email that only we see and the wallet proof. For level 2 we add the company data (name, address, VAT ID), the name of the person who acts for the company and, if the seller gives it, its role and the register court and number. The seller proves its domain with an email address at it that confirms a code, or with a DNS record on it. A person at 402lounge approves the check. Legal basis: the contract with the seller (Art. 6 (1) (b) GDPR).

We compare the company and the person who acts for it with the consolidated list of EU financial sanctions, at the check and every night while a listing is on level 2 or on its way there. EU sanctions regulations forbid making funds or economic resources available to the persons they list, which this check helps us to keep (Art. 6 (1) (c) GDPR), and we have a legitimate interest in not working for them (Art. 6 (1) (f) GDPR). A possible match is never decided by a machine. A person at 402lounge looks at it, and until then the check waits. A match that turns out to be someone else is deleted 3 years after the end of the year of that decision. A confirmed match stays as long as the company exists with us.

At level 2 the company name and country appear in the register. Names of sole traders appear only with their consent (Art. 6 (1) (a) GDPR), which they can withdraw at any time in the seller profile.

For level 3 we keep the signed invoicing mandate or self-billing agreement with its version, the time and the proof (the wallet signature or the person who confirmed it in the dashboard). We keep it while the company exists with us and as long as documents issued under it have to be kept (section 16), because it shows on what basis they were issued (Art. 6 (1) (c) GDPR with § 14b UStG).

8. Payments to listed sellers from other wallets

We also read USDC payments on Base that reach the wallets of listed sellers, from any payer. These transfers are public. Single payments from wallets that do not belong to a company at 402lounge are kept for 90 days. After that we keep only daily totals per seller wallet: the number of payments, the sum and the number of different payers. We do not try to find out who is behind those wallets, and we never publish lists of them. We use the totals to show sellers how their wallets are used and for statistics about x402 payments (Art. 6 (1) (f) GDPR). A seller sees the totals of its own wallets. They appear on its public listing only if the seller has claimed the listing and agrees, and the totals of a sole trader only with its consent (Art. 6 (1) (a) GDPR). We weighed these interests against those of the wallet holders in writing, and you can ask us for that assessment. We cannot reach the holders of these wallets, so this notice is how we inform them (Art. 14 (5) (b) GDPR). They can object at any time (section 13).

9. Reports and moderation

If you report content, we store the report, your email address and, if you give it, your name. We use them to assess the report and to tell you our decision. We do not tell the party concerned who reported, unless the law requires it. If we act on content or on an account, we record the decision and its reasons. Legal basis: Art. 6 (1) (c) GDPR with Art. 16 and 17 of the Digital Services Act for handling the report, and Art. 6 (1) (f) GDPR for keeping reports and decisions for three years from the end of the year of the decision, so that we can prove our decisions.

10. Email

We send emails through Resend: sign-in links and codes, confirmation codes, invitations, important notices and a note once a month when your documents are ready. We do not track whether you open them or click links in them.

If you write to us, we use your message and your address to answer. We delete them when the matter is closed, unless they are business letters that we have to keep for six years.

11. Services we use

Cloudflare, Supabase, Resend, GitHub, the node access of Coinbase and Google for Google Analytics work for us as processors under data processing agreements (Art. 28 GDPR). Coinbase as x402 facilitator, Google for its sign-in, Polar as seller of paid plans and the European Commission are controllers in their own right.

Where a provider is based in the USA or can access data from there, the transfer rests on the adequacy decision of the European Commission for the EU-US Data Privacy Framework of 10 July 2023 where the provider is certified under it, and otherwise on the standard contractual clauses of the European Commission (Art. 46 (2) (c) GDPR). You can ask us for a copy.

12. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18) and to receive it in a machine-readable format (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7 (3)).

You can complain to a data protection authority, in particular in the EU country where you live or work. The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

Your agent can export and delete what we keep with the tools lounge.account.export and lounge.account.delete, and the dashboard has the same functions. A company can download all its documents, receipts and data at any time and close its account. The closing takes effect at least 30 days later, at the end of the month in which those days end, so that month still gets its documents. Then its agents, people, sign-ins and wallets are deleted and the company data is cleared, and its receipts and documents follow on the first 31 January after the closing. For anything else write to privacy@402lounge.com. If you write as the holder of a wallet, sign a message with it, so that we know the request comes from you.

14. No automated decisions

We make no decisions based solely on automated processing that have legal effects on you or affect you in a similar way (Art. 22 GDPR). Levels follow fixed rules from the data and proofs you give us. A person decides on every restriction of an account.

15. Do you have to give us data?

To open an account you need a wallet proof and a name for the agent. Monthly documents need your company data and a confirmed email. Without them we cannot provide those parts of the service. Everything else is up to you.

16. How long we keep data

Periods that the law sets run from the end of the calendar year.

17. Changes

We announce changes to this notice together with changes to the terms, at least 14 days ahead. Every version stays online at its own address.