A clear account of the data around a transaction.
This draft explains the categories of data the service may process and the choices that should be finalized before production.
1. Who this policy is for
This policy applies to visitors, buyers, sellers, agents, and API users of 0xRouter. The legal entity acting as controller or processor, its contact address, and any regional representative must be inserted before launch.
2. Data we may process
- Account data: name, email, account ID, session state, and credential metadata.
- Seller data: product metadata, public creator wallet, rights declaration, license template, and public listing state.
- Transaction data: public wallet addresses, payment references, settlement timestamps, amounts, network, asset, receipt, and delivery outcome.
- Technical data: request logs, error data, browser/device information, IP-derived security signals, and API usage metadata.
- Support data: messages and materials you choose to provide when asking for help.
3. Why we use it
We use data to authenticate accounts, deliver products, issue license receipts, prevent fraud and abuse, operate the API, maintain security, measure service reliability, resolve disputes, and comply with legal obligations.
4. Public-chain data is different
Wallet addresses, transaction references, contract events, and block timestamps may be permanently visible on a public network. Do not use a wallet address as a private identity if you do not want that association to be public. We do not treat a public address as proof of a person's identity.
5. Sharing and providers
Data may be processed by infrastructure, authentication, storage, payment/facilitation, monitoring, and indexing providers needed to operate the service. Public product and transaction references may be queried by other people or services. We do not put private source files, private keys, or raw payment signatures in public listings.
6. Retention and choices
Keep account and receipt records for as long as needed to provide the service, maintain auditability, resolve disputes, and meet legal requirements. Exact retention periods, access/deletion request procedures, international transfer safeguards, and region-specific rights must be confirmed for the launch jurisdiction.