Privacy Policy

This Privacy Policy explains how Seeking Data Labs ("we", "us", "our") collects, uses, discloses, and protects personal data when you visit seekingdatalabs.com, create an account, use Sightline and its reporting API (including agentic pay-per-call over x402 for reports), or engage our research and consultancy services.

We operate from Switzerland. Two data-protection regimes apply to us in parallel and this policy is written to satisfy both:

• the Swiss Federal Act on Data Protection (revFADP / nFADP), in force since 1 September 2023, because we are established in Switzerland; and
• the EU General Data Protection Regulation (GDPR, Reg. 2016/679), which applies under Art. 3(2) because we offer services to, and process the data of, individuals in the EU/EEA.

Where the two regimes differ, we apply the stricter standard. The legal bases below are stated under the GDPR and mapped to the corresponding Swiss justification.

This document is provided in good faith for transparency; it is not legal advice, and you should have it reviewed by qualified counsel before relying on it.

1. Who is responsible (controller) and how to contact us

The controller responsible for your personal data is:

• Seeking Data Labs (trading name)
• [registered legal entity & address, to be completed]
• Privacy contact: hello@seekingdatalabs.com

Please direct all privacy questions and all requests to exercise your rights to hello@seekingdatalabs.com.

Data protection officer. We have not appointed a statutory data protection officer. The revFADP does not impose a general DPO requirement, and the GDPR Art. 37 triggers (large-scale processing of special-category data, or systematic large-scale monitoring as a core activity) are unlikely to be met by our processing. The privacy contact above handles all matters. This assessment should be confirmed by counsel.

EU/UK representative. As a controller outside the EU that processes EU/EEA personal data, GDPR Art. 27 in principle requires an EU representative unless the Art. 27(2) exemption applies (processing that is occasional, does not involve large-scale special-category data, and is unlikely to risk individuals' rights). We are assessing this; if a representative is appointed, its name and address will be published here. Because we are established in Switzerland, the revFADP Art. 14 obligation to appoint a Swiss representative, which applies only to controllers based abroad, does not apply to us.

2. The personal data we process

We only process the categories of data our service actually involves:

• Account identity. Your email address (email/password sign-up and Google sign-in). For Google sign-in we also receive, from the openid email profile scope, your Google account identifier, display name, and profile picture.
• Authentication and security data. A salted password hash (we never store plaintext passwords); a signed session token held in an HttpOnly, Secure cookie; and, for login abuse-protection and rate-limiting, your IP address and email held transiently in memory.
• Report usage and billing metadata. Your API key(s), plan, credit balance, the reports you run, request and usage logs, and timestamps.
• Payment data. For report pay-per-call and prepaid credit, the Solana wallet / public address that signs the USDC payment, transaction signatures, amounts, network, and on-chain settlement receipts. On a public blockchain these records are pseudonymous but permanent, irreversible, and outside our control.
• Profile data you choose to provide. An optional public nickname and any report notes or analysis text you author.
• Technical and operational data. IP address, user-agent, and request metadata processed at our CDN/WAF edge and at the origin to deliver and protect the service.
• Communications. The content of emails you send us.
• Analytics data, collected only after you opt in (see section 11). We use Google Analytics 4 for privacy-respecting web analytics. It loads only after you grant consent through the banner, and until then no Google Analytics identifiers or _ga cookies are set.

We do not collect payment-card data, and we do not seek to collect special categories of data (health, biometrics, political opinions, etc.). Please do not send us such data.

How USDC payments work, and their on-chain footprint

We accept payment only in USDC on Solana, there is no card or fiat path. Two flows exist, and both write to a public ledger:

• x402 pay-per-call. A report can be paid for per request over the x402 HTTP-402 handshake: your wallet signs a USDC payment that a third-party facilitator verifies and settles on-chain. We never hold your funds or signing keys. We process the payer wallet address, amount, network, transaction signature, and settlement receipt.
• Prepaid credit and subscriptions. To add report credit or activate a paid plan you send USDC to a shared deposit address with the transaction memo field set to your account id. Our payments watcher reads that memo to match the payment to your account and credit or activate it. We keep a stored payments ledger (transaction signature, amount, plan or credit, status, timestamp) linked to your account.

Important, irreversible consequence. Because the memo (your account id) is written into the Solana transaction, it is recorded on the public, permanent Solana ledger alongside the paying wallet address. This creates a permanent, public on-chain link between your account id and the wallet you pay from that we, and everyone, cannot delete, rectify, or geographically confine. If you do not want that link to exist, pay from a wallet you are comfortable associating with your account, and never place other personal data in a memo.

Content you choose to make public

Some things you create are public by design. If you set a nickname, it becomes your public profile handle (shown at a URL such as /u/<nickname>); any report or analysis you mark as public are displayed to anyone and may be indexed and cached by search engines. We process this on the basis of contract (Art. 6(1)(b)), delivering the public-profile feature you asked for, and, for anything beyond what the feature requires, your consent (Art. 6(1)(a)). To keep content private, do not mark it public (or switch it back to private); to remove a nickname or take down published content, email hello@seekingdatalabs.com. Content already cached or indexed by third-party search engines may persist in their systems until they refresh.

3. Why we process it, and the legal basis

For each purpose we state the GDPR Art. 6 legal basis. Under the revFADP, which relies on lawful processing plus a duty to inform rather than an enumerated list of bases, the same justification applies.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and we have concluded the processing is limited to what is necessary. You have the right to object to legitimate-interest processing at any time (see section 9).

4. Our AI research pipelines, scope and limits

We describe ourselves as AI-driven research: automated agents run the Sightline audit, gather evidence from a target's public surfaces, and produce the report. To be clear about what this does and does not involve:

• These AI/agent pipelines operate on the public surfaces of the domain being audited and on the resulting report, not on your personal data or account contents.
• We do not use your personal data, account contents, or the content of your reports to train or fine-tune AI or machine-learning models.
• If we ever introduce a feature in which a third-party AI/LLM provider processes user-submitted content (for example, to assist with support), that provider would become a processor and we would disclose it here before doing so.

5. Who we share data with (processors and recipients)

We do not sell your personal data. We share it only with service providers who process it on our documented instructions under a data-processing agreement (GDPR Art. 28 / revFADP Art. 9), and where required by law.

We may also disclose data to professional advisers, or to authorities and courts, where necessary to comply with the law, respond to lawful requests, or establish, exercise, or defend legal claims. If our business is reorganised or transferred, data may be disclosed to a successor under equivalent protections.

6. International transfers

Some recipients above are located in, or transfer data to, countries outside Switzerland and the EEA, in particular the United States. Where that happens, we rely on recognised safeguards:

• the EU Standard Contractual Clauses (2021/914) for EEA-origin transfers, and the FDPIC-recognised SCCs with the Swiss addendum for Switzerland-origin transfers;
• the EU–US and Swiss–US Data Privacy Framework where the recipient is certified (Google and Cloudflare are certified; we are confirming the facilitator's status and, absent certification, rely on SCCs);
• Switzerland's recognition of the EEA as providing adequate protection.

Microsoft Azure hosts our compute and databases and therefore holds the richest set of personal data we process (account data, billing metadata, usage logs, our databases). Our Azure resources are located in the [Azure region, to be confirmed] region. Microsoft is certified under the EU–US and Swiss–US Data Privacy Framework and additionally offers the Standard Contractual Clauses, on which we rely for any transfer of this data outside Switzerland and the EEA. You can request copies of the transfer safeguards by emailing hello@seekingdatalabs.com.

On-chain payments are inherently international. The Solana blockchain is a globally distributed public ledger with no controllable transfer location; transactions on it cannot be erased or geographically confined. If you value the privacy of a wallet, do not use it to pay for calls, and do not place personal data on-chain.

7. How long we keep it

• Account data, kept for the life of your account, then deleted or anonymised within 90 days of account closure, subject to any legal hold.
• Billing and payment records, retained for approximately 10 years to meet Swiss commercial bookkeeping (Code of Obligations) and tax obligations. This retention overrides erasure requests for those specific records.
• Security / rate-limiting data (IP + email), ephemeral, held only for minutes to hours.
• Operational, CDN/WAF, and security logs, a short rolling window of approximately 30 days.
• On-chain USDC transactions (including the account-id memo), permanent and outside our control; they cannot be deleted.
• Analytics data (Google Analytics 4), retained only from the point of consent; the _ga cookies expire after roughly 13 months.

8. Security

We apply technical and organisational measures appropriate to the risk (GDPR Art. 32 / revFADP Art. 8), including:

• TLS/HTTPS for all traffic;
• passwords stored only as salted hashes, never in plaintext;
• the login session in an HttpOnly, Secure, SameSite=Lax cookie on the API host that page scripts cannot read (this "not exposed to page scripts" property describes that session cookie and the OAuth CSRF cookie, not every credential: a separate, script-readable bearer token may be stored in your browser's localStorage for direct API calls, as the Cookie Policy details);
• login rate-limiting and protections against account enumeration and timing attacks;
• a Cloudflare WAF and authenticated (mTLS) origin pulls between the edge and our servers;
• non-root, read-only-filesystem application containers and least-privilege access;
• a design in which we never custody payment signing keys, the x402 facilitator does.

No method of transmission or storage is completely secure, but we work to protect your data and to review our measures.

9. Your rights

Under the GDPR and the revFADP you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• request erasure ("right to be forgotten"), subject to the billing-record retention above, which we are legally required to keep;
• restrict or object to processing, including any processing based on our legitimate interests and any direct marketing;
• receive your data in a portable format (data portability);
• withdraw consent at any time for any processing based on consent (such as analytics), as easily as you gave it, without affecting the lawfulness of processing before withdrawal.

To exercise any right, email hello@seekingdatalabs.com. We respond without undue delay and within one month (extendable by two further months for complex requests, with notice). Requests are free unless manifestly unfounded or excessive. We may need to verify your identity before acting.

Right to complain. You may lodge a complaint with a supervisory authority:

• in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (edoeb.admin.ch); and
• in the EU/EEA, the supervisory authority in your country of residence or workplace.

10. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects about you by solely automated means. The only automated logic we apply is operational: rate-limiting, abuse/fraud detection, plan gating (a request beyond your plan returns an upgrade prompt), and x402 pricing of priced report requests. These do not profile you.

Should any such control ever be treated as a significant automated decision within the meaning of GDPR Art. 22 or revFADP Art. 21, you have the right to obtain human review, to express your point of view, and to contest the decision, contact hello@seekingdatalabs.com.

11. Cookies and analytics

The site uses strictly-necessary and functional cookies and local storage, plus consent-gated analytics, there is no advertising or third-party tracking. Our fonts are self-hosted, so your browser makes no request to Google Fonts. See our Cookie Policy for the full, itemised inventory.

For web analytics we use Google Analytics 4, and it loads and sets identifiers only after you give prior, informed opt-in consent through the consent banner. Nothing non-essential, no Google Tag Manager request and no _ga cookie, loads before you accept; rejecting is as easy as accepting, no boxes are pre-ticked, and you can change or withdraw your choice at any time via the "Cookie settings" control in the footer. IP addresses are handled under Google's EU/EEA data-processing measures (we set anonymize_ip). Analytics data is shared with Google LLC (United States) and processed there under the transfer safeguards in section 6 (the EU–US / Swiss–US Data Privacy Framework, the Standard Contractual Clauses, and the Swiss addendum).

12. Children

This is a professional developer and research service and is not directed to children. It is not intended for, and must not be used by, anyone under 16 (or a higher minimum age set by local law). We do not knowingly collect data from children; if you believe a child has provided us data, contact hello@seekingdatalabs.com and we will delete it.

13. Data breaches

If a personal-data breach occurs, we will comply with our notification duties: notifying the competent EU supervisory authority within 72 hours where required (GDPR Art. 33), notifying the FDPIC as soon as possible where a breach is likely to result in a high risk (revFADP Art. 24), and informing affected individuals where the law requires it (GDPR Art. 34).

14. Changes to this policy

We may update this policy. We will change the "last updated" date above and, for material changes, notify account holders by email and/or a prominent site notice. We will not apply materially adverse changes retroactively to data already collected without a lawful basis. Prior versions are available on request.

15. Contact

Seeking Data Labs, hello@seekingdatalabs.com. [registered legal entity & address, to be completed]