Privacy Policy and Legal Notice

ZadQ is a seller-verification service for x402 endpoints. It is a service of Conectia OÜ, a private limited company (osaühing) incorporated in Estonia, registry code 16847069, entered in the Estonian Commercial Register (registration department of Tartu County Court), registered address Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, VAT number EE103042910. Contact for legal and data-protection matters: hello@zadq.net.

In this policy, "ZadQ", "we" and "us" mean Conectia OÜ acting through the ZadQ service.

Conectia OÜ is the controller of the personal data described here, under Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act. It has not designated a data protection officer, as it is not required to; hello@zadq.net is the contact for every data-protection matter. This document is the Privacy Policy of the ZadQ website, its developer documentation and its dashboard, and the Legal Notice of the website.

1. Data-protection policy

We apply the principle of accountability: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality. The service is designed so that most of what it does needs no personal data at all, and this policy says plainly where it does.

This document tells you what we do with your personal data, how it is collected, what it is used for, how long it is kept, the rights you have, and the legal information current regulations require.

2. What we collect, and from whom

Website visitors: usage data collected by Google's analytics tag (pages visited, device type, approximate location), as described in section 9. Nothing else runs on the website.
People who write to us: the address they write from and the content of the message.
Dashboard accounts, held by business customers only: the responsible person's given name, family name, work e-mail and preferred language; the organisation's or the sole trader's legal name, trading name, legal form, country, registered address, business-register number, EU VAT number and national tax number (in Spain, the NIF), and an e-mail for invoices; the passkeys that open the account (a public key and a label, never the fingerprint, face or PIN that unlocks it on your device); the session a passkey opens; the record of the Terms accepted (version, fingerprint and time), the Privacy Policy read, the declaration of acting for a business or profession, and the marketing choice; and the account's activity (sign-ins, approvals, payments recorded, changes). The dashboard asks for no date of birth, no identity document and no document number.
Payment wallets bound to an account: the wallet address whose control is proven by signature (a pseudonymous identifier that is public on the payment rail), the endpoint identifiers registered with it, the state of their verification and attestations, and the signature with which the Terms are acknowledged for an endpoint.
The register-interest form: which side you are on (vendor or agent operator) and, optionally, a resource URL or a fleet size band. The form has no field for a name or a contact address; submissions are counted, nothing more.
Identity verification of accountable operators: Conectia OÜ also operates the issuer on the MintID identity network that verifies vendors and signs their attestations (the "Issuer"). The Issuer verifies persons. To verify the person who contracts for an endpoint, an identity-verification provider acting for the Issuer collects from that person their identity details and the identity document and, where the check compares a live image with the document, a facial image and the biometric data derived from it. These data and the results of the checks are held only inside the Issuer's boundary, separated from ZadQ: they never enter ZadQ's systems, logs or analytics, and nobody working on ZadQ can read them. ZadQ keeps attestation metadata only, that is, opaque session handles, assurance grades, validity windows and statuses.
Customers acting for a company: the person who contracts is identity-verified as described above. The company's legal name, business-register number and country, and that person's role as the one who acts for it, are declared by that person and held by ZadQ as account data. They are the company's details, not the personal data of anyone else, and the role is the person's own declaration. In this phase, the company's representatives and beneficial owners are not verified. An attestation for a company states that an accountable, identity-verified person stands behind the endpoint and has declared to act for the named company; it does not state that the company was verified. Business verification of companies (KYB) is not available yet; before it opens, this policy will be updated.
Billing: the customer record above is passed to the billing provider, Stripe, to create the customer and issue invoices; card details are entered on Stripe's hosted page and never reach ZadQ. ZadQ keeps the billing state, the price lines and an opaque customer reference.
Requests to release an identity: the dispute process of the MintID identity network is specified and not yet activated, and ZadQ operates no claims procedure of its own. Until one is activated, every request to release the identity behind an attestation is refused, and we record who asked, when and about which endpoint. Before any claims procedure collects further data, this policy will be updated.

Between the parties to an attested payment, no personal data changes hands unless a dispute is escalated. An attestation names an accountable operator through the Issuer's signature; a checking party obtains a verdict about an endpoint, never about a natural person.

3. Purposes and legal basis

To answer messages sent to us (legal basis: our legitimate interest in answering you, Art. 6(1)(f) GDPR, or the steps you ask for before entering into a contract, Art. 6(1)(b)).
To create and run your account, identify the responsible person who acts in it, and keep the customer record accurate (legal basis: performance of the contract, and steps taken at your request before entering into it, Art. 6(1)(b)).
To operate the seller dashboard, issue and re-verify attestations and keep the record of each attestation's lifecycle (legal basis: performance of the operator agreement, Art. 6(1)(b), and our legitimate interest in the integrity of the verification system, Art. 6(1)(f)).
To verify the identity of the person who answers for an endpoint (legal basis: performance of the contract for the person who contracts, Art. 6(1)(b); for the comparison of a live image with the identity document, your explicit consent, Art. 9(2)(a), given on ZadQ's page, by its own button, before the verification). ZadQ records your consent and its text version; the Issuer records the version on the verification it backs.
To invoice the service, keep the invoices and the customer record they cite, and confirm an EU VAT number with the European Commission's VIES service (legal basis: performance of the contract, and compliance with accounting and tax obligations, Art. 6(1)(c)).
To keep the account secure: sign-in records and the account's activity log (legal basis: our legitimate interest in the security of the service and of your account, Art. 6(1)(f)).
To send product news by e-mail, only if you ticked the box for it (legal basis: your consent, Art. 6(1)(a), which you withdraw at any time from the account or by writing to us).
To measure, in aggregate, how this website is used (legal basis: our legitimate interest in knowing how the site is used, Art. 6(1)(f), with Google's advertising features and signals switched off; you may object at any time, as section 9 explains).
To record refused requests to release an identity, defend our rights and comply with requests from competent authorities (legal basis: legal obligation, Art. 6(1)(c), and our legitimate interest, Art. 6(1)(f)).

Where we rely on legitimate interest, you may object at any time (section 11). We do not use your data for advertising, and we do not sell it.

4. Recipients

The identity-verification provider that runs the identity checks (KYC) inside the Issuer's boundary, as the Issuer's processor, bound by a data-processing agreement.
The MintID identity network: the reference and the status of each attestation are recorded on the network's public record. The record is pseudonymous; it names no person and no company.
Stripe Payments Europe, Limited (Ireland), which receives the part of the customer record an invoice needs (legal name, registered address, tax numbers, invoicing e-mail) and creates the invoices as our processor. For the payments made on its hosted page, Stripe also acts as an independent controller to meet its own legal obligations (fraud prevention, anti-money-laundering and financial regulation), under its own privacy policy.
The European Commission's VIES service, which receives an EU VAT number to confirm that it is registered.
Amazon Web Services EMEA SARL, which hosts the website, the documentation, the dashboard and the service in regions of the European Union, as our processor.
Google Ireland Limited, for the website analytics tag, as our processor (section 9).
Our accountant and legal advisers, bound by professional confidentiality, for the invoices and records they need.
Competent authorities, on a lawful request.

Outside a dispute escalation, no personal data is shared between a vendor and a checking party in either direction.

We keep strict criteria for selecting processors and bind each of them contractually to data-protection obligations.

5. International transfers

Website analytics data may be processed by Google LLC in the United States, and the payment and invoicing data Stripe holds may be processed by Stripe, Inc. in the United States. Both transfers rely on the EU-US Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses. Amazon Web Services stores the service's data in the European Union; any access from outside it for support or security is covered by the same safeguards in its data-processing terms. Everything else stays in the European Union. Where any other transfer outside the European Economic Area is ever needed, we apply the safeguards the GDPR requires.

6. Security

The service holds the customer record and attestation metadata: no identity documents, no results of identity checks, and none of your keys. The account opens with a passkey, whose private key never leaves your device; the session it opens is a cookie the dashboard's own code cannot read. A vendor's credential lives in the vendor's own infrastructure; the dashboard shows state, never secrets. Access to the service's records is limited to authorised staff and logged, and the logging layer rejects personal-data fields by construction, the customer record's included.

7. Retention

Messages sent to us: for the time needed to handle them, and deleted twelve months after the last exchange unless they lead to a contract.
Account and customer record: for the duration of the contract. After its end or an erasure request, the data are blocked and used only for the purposes below: the details an invoice cites are kept for seven years from the end of the financial year of the last invoice, as the Estonian Accounting Act requires; the consents, the declaration of acting for a business and the account's activity history are kept for three years, the general limitation period for claims arising from transactions under Estonian law.
Invoices: seven years from the end of the financial year in which they were issued.
Sign-in and security records: twelve months.
The record of the Terms accepted and the signed acknowledgement for an endpoint: for the duration of the operator agreement and three years after its end.
Wallet addresses, endpoint identifiers and attestation metadata: for the duration of the operator agreement and three years after its end.
The network's public record: the reference and status of an attestation recorded on the MintID identity network are permanent by design and cannot be erased; they name no person and no company.
Identity-verification data held by the Issuer: kept while the verification session backs an attestation or credential, then for three years (the recourse period), then deleted at the Issuer and at the identity-verification provider.
Refused requests to release an identity: three years.
The marketing choice: until you withdraw it; the record of the withdrawal, for three years, so that we can prove it.
Register-interest submissions: the optional details are cleared after twelve months; the count remains.
Billing state and customer reference: for the duration of the agreement and seven years after the last invoice; Stripe applies its own retention to what it holds as controller.
Analytics data: for the retention period configured in Google Analytics, fourteen months at most.

8. Automated decisions

Verdicts are computed automatically from the standing of an attestation on the MintID identity network. They concern endpoints and organisations, not natural persons, and produce no legal effects on individuals. A verdict is information for the checking party's own decision.

The identity check that precedes an attestation may be decided automatically by the identity-verification provider. If a check you took part in was not passed, you may ask for it to be reviewed by a person, give your point of view and contest the outcome, by writing to hello@zadq.net.

9. Cookies and analytics

The website and the developer documentation are static pages. The only code that runs on them besides the pages themselves is Google's analytics tag (gtag.js), on the production website only. It sets Google cookies (_ga and _ga_<property>, which last up to two years) and reports usage to Google Analytics so that we can see, in aggregate, how the site is used. Google's advertising features and signals are switched off, and our pages send the tag no form value, wallet address or other personal data. No cookie banner is shown; you can refuse these cookies at any time by blocking or deleting them in your browser, or with Google's Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout); the website works the same either way.

The dashboard runs its own code to talk to the service and, when you connect one to sign, to your wallet. When you sign in, the service sets one strictly necessary cookie that holds your session: the dashboard's code cannot read it, it ends after a period of inactivity and at sign-out, and it is used for nothing else. Because it is needed to provide the service you ask for, it does not require consent. A wallet session, when you connect a wallet, is kept in your browser's session storage for that tab. The dashboard runs no analytics: it sets no analytics cookie and runs no third-party code.

10. Minors

This website and the service are not directed at minors; the service is offered to businesses and professionals only. If we learn that we have inadvertently obtained personal data from a minor, we delete it as soon as possible.

11. Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw any consent at any time without affecting the processing carried out before. Signed in to the dashboard, you correct your details on the Account and Billing pages, download your data as a file, change your marketing choice, and ask for the account to be closed and erased; or write to hello@zadq.net, identifying yourself and the right you exercise. These rights extend to the identity-verification data the Issuer holds, which you request at the same address.

Before a download or an erasure, the dashboard asks you to sign in again with your passkey. Where the service holds only a wallet address about you, we will ask you to prove control of it by signing a message. We answer within one month, which may be extended by two further months for complex requests, in which case we tell you why. An erasure keeps what accounting and tax law require, blocked, for the periods set out in section 7.

If you consider that your rights have not been respected, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority of the EU member state where you live, where you work or where the alleged infringement took place.

12. Legal notice

Intellectual and industrial property. The design of this website, its source code, logos, marks and other distinctive signs belong to Conectia OÜ and are protected by the corresponding rights. Integration code published under the Apache-2.0 licence is governed by that licence.

Content liability. Conectia OÜ is not responsible for the legality of third-party websites linked from this website, nor for the use that third parties make of the information published on it.

Applicable law. The relationship between the user of this website and Conectia OÜ is governed by the laws of the Republic of Estonia, without prejudice to the mandatory rules that protect consumers in the country where they live. Conectia OÜ reserves the right to bring the actions it deems necessary for improper use of the website or its contents.

13. Changes to this policy

We may modify this policy when appropriate. The new version is published on this website with its date. When a change matters to a customer's privacy, we tell the responsible person in the dashboard and by e-mail before it applies.

14. Contact

For any matter related to this policy, write to hello@zadq.net.