Last updated: March 1, 2026 · Effective: April 1, 2026
PayClaw LLC (“PayClaw,” “we,” “us,” “our”) provides a technology platform for AI agent identity and payment. We offer two products:
This Privacy Policy explains how we collect, use, and protect your information when you use our website, dashboard, API, and MCP server (collectively, the “Service”). We collect only the information necessary to provide the Service.
PayClaw LLC is the data controller for the personal data described in this Privacy Policy. We determine the purposes and means of processing your personal data in connection with the Service.
For data protection inquiries, contact us at privacy@payclaw.io.
When you create an account via OAuth (Google or GitHub), we receive your email address and name from the OAuth provider. We do not collect or store passwords — authentication is handled entirely through your OAuth provider. You may optionally provide additional information such as your full name for display purposes. If you enable Spend, our card issuing partner Lithic, Inc. may collect additional identity information (name, address, date of birth, and government-issued identification) as required by applicable Know Your Customer (KYC) regulations.
We store a one-way cryptographic hash (SHA-256) of your API keys. We cannot see or recover your raw API key after creation. We also store the first 8 characters of each key for display and identification purposes, along with a user-assigned label and timestamps for creation, revocation, and last use.
Every time you generate an API key, we log the consent event, including: your user ID, the consent type (Badge or Spend), the version of the disclosure text shown to you, metadata about where consent was given (browser and page), and the timestamp. These records document that you reviewed and accepted the disclosure before authorizing your agent.
When your agent requests identity verification, we generate a cryptographic verification token (HMAC-SHA256). This token is derived from your user ID, a timestamp, and a server-side secret. The token cannot be reversed to reveal your identity without our server-side secret. We also store: a session identifier provided by the agent, the verification layer (identity or payment), optional merchant context if the agent provides it, and token creation and expiration timestamps. Tokens expire after 24 hours.
After a verification token is issued, we record events about the outcome of your agent's interaction with the merchant. This includes: the event type (identity presented, trip complete, trip success, or trip failure), the outcome (accepted, denied, inconclusive, or no sampling), the merchant name (if provided by the agent), and a brief detail about the outcome. Badge events can only be created when a valid verification token exists — no token means no tracking.
If you use Spend, we record: wallet balance, deposit records (amount, Stripe payment intent ID, status), purchase intent declarations (merchant, estimated amount, description, policy result), card records (Lithic card token and last four digits only — we do not store full card numbers), and transaction records (amount, merchant, status, reconciliation result). This data powers your dashboard, our intent authorization engine, and our compliance obligations.
We collect standard server logs (IP address, request timestamps, user agent) for security monitoring, rate limiting, and abuse prevention. We maintain an audit log of all significant actions on your account, including key generation, card issuance, deposits, and settings changes.
If you join our waitlist or submit feedback, we collect your email address, user type, and any feedback content including the page URL and browser information at the time of submission.
Badge operates on a token-based consent model. When you generate an API key, you are shown a disclosure describing exactly what your agent will present to merchants and what data will be recorded. Generating the key after reviewing this disclosure constitutes your consent for the declared scope.
How Consent Works
We log the version of the disclosure text shown to you at the time of key generation, so there is a permanent record of what you consented to.
When your agent presents its Badge identity to a merchant, the merchant receives: a cryptographic verification token (which cannot be reversed to identify you), the agent type, the authorized scope, and a contact email (agent_identity@payclaw.io).
Merchants cannot derive your identity from the token alone. If a merchant contacts us to verify a token, we will confirm only whether the token is valid, expired, or revoked. We will not disclose your identity to a merchant without your explicit consent.
We process your information on the following bases:
We share data with the following partners, solely to operate the Service. Each partner operates under a data processing agreement with PayClaw.
Supabase
Hosts our database and authentication system. Stores your account data, verification tokens, Badge events, transaction records, and hashed API keys. Data stored in the United States. Subject to Supabase's Privacy Policy.
Google & GitHub (OAuth Identity Providers)
Handle authentication only. When you sign in, we receive your name and email address from the provider you choose. We do not receive or store your Google or GitHub password. Subject to Google's Privacy Policy and GitHub's Privacy Statement.
Lithic, Inc. & Sponsor Bank
Our card issuing partner and sponsor bank (Spend only). Receives identity information for KYC verification and card issuance. Processes virtual card transactions. Subject to Lithic's Privacy Policy.
Stripe
Processes account deposits (Spend only). Receives your payment card details directly on Stripe's hosted checkout page. PayClaw does not see or store your payment card number. Subject to Stripe's Privacy Policy.
Vercel
Hosts our web application. Collects standard request logs (IP, timestamp, user agent, path) and anonymous performance metrics. No personally identifiable information is collected by Vercel Analytics. Subject to Vercel's Privacy Policy.
Resend
Sends transactional emails (account verification, transaction notifications, security alerts). Receives your email address and notification content. Subject to Resend's Privacy Policy.
When your agent completes a Spend purchase, virtual card credentials are shared with the merchant to process the transaction. When your agent presents Badge identity, the verification token and disclosure are shared with the merchant. These are inherent to how the Service works and are not a “sale” of your data.
We do not sell your data to third parties. We do not share your data for cross-context behavioral advertising. We do not use your data for advertising or marketing targeting. We do not use Google Analytics, Facebook Pixel, retargeting pixels, or any third-party marketing analytics.
We retain your data for the minimum period necessary to provide the Service, comply with legal obligations, and resolve disputes. The following table describes our retention periods by data category:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data (profiles) | Until account deletion + 30-day grace period | Contractual necessity |
| API keys (hashed) | Until revoked + 90 days | Security audit trail |
| Consent records | Permanent (never deleted) | Proof of consent (GDPR Art. 7(1)) |
| Verification tokens | Tokens expire at 24 hours; records archived at 90 days | Consent boundary proof |
| Badge events | 2 years, or until account deletion (whichever is earlier); anonymized on deletion | Legitimate interest |
| Spend transactions | 7 years | Financial record-keeping (BSA/AML, tax) |
| Audit logs | 7 years | Legal obligation |
| Server logs (Vercel) | Per Vercel's retention policy | Hosting provider policy |
| Waitlist and feedback | 1 year after conversion or last contact | Legitimate interest |
You may request account deletion by contacting us. Upon deletion, we will remove your account data and anonymize associated Badge events (by removing the user ID linkage). We will retain data where required by law, including: financial transaction records and audit logs (7 years), consent records (permanent), and any data subject to an active legal hold or investigation.
Anonymization satisfies erasure requirements — once data can no longer be attributed to an identifiable individual, it is no longer personal data.
We use strictly necessary cookies to maintain your authenticated session. These cookies are set by our authentication provider (Supabase) and are required for the Service to function. They cannot be disabled while using the Service.
We do not use cookies for advertising, cross-site tracking, or behavioral profiling. Our hosting provider (Vercel) may collect anonymous performance metrics using cookieless analytics.
You can control cookies through your browser settings, but disabling session cookies will prevent you from using the Service.
PayClaw's intent authorization engine uses automated processing to evaluate purchase requests from your AI agents (Spend only). This includes checking purchase intents against your configured spending limits, merchant whitelists, and per-intent caps. Transactions may be automatically approved or declined based on these rules.
Our post-purchase auto-audit system automatically flags transactions where the actual charge deviates from the declared intent by more than 20%.
You may request human review of any declined transaction or audit flag by contacting support@payclaw.io.
In the event of a security breach involving your personal information, we will notify you in accordance with applicable law. Where required by GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach involving personal data, and will notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms. Notification will include: the nature of the breach, the types of information involved, the steps we are taking to address it, and steps you can take to protect yourself.
We maintain a written security incident response plan and will cooperate with applicable regulators as required.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact us using the methods listed in Section 19.
Response timelines: For requests under GDPR (EU/EEA/UK residents), we will respond within 30 days, extendable by 60 days for complex requests with notice. For requests under CCPA (California residents), we will respond within 45 days, extendable by 45 days with notice.
Right to lodge a complaint: If you are in the EU/EEA, you have the right to lodge a complaint with your local supervisory authority if you believe our processing of your personal data violates applicable law.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):
To exercise these rights, contact us at privacy@payclaw.io or write to us at the mailing address in Section 19. We will verify your identity before processing your request and respond within 45 days.
In the preceding 12 months, we have collected the following categories of personal information:
Badge requires an OAuth account (Google or GitHub), which requires users to be at least 13 years old. Spend requires users to be at least 18 years old. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@payclaw.io.
Your data is primarily stored and processed in the United States by our service providers (Supabase, Vercel, Stripe, Lithic).
If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data transfer restrictions, your personal data will be transferred to the United States for processing. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other valid transfer mechanisms, to ensure that your personal data receives an adequate level of protection when transferred outside the EEA.
If any sub-processor processes data outside the United States, they do so under appropriate data transfer safeguards as required by applicable law.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website at least 30 days before changes take effect. Your continued use of the Service after changes constitutes acceptance.
For privacy questions, data requests, or concerns:
For transaction disputes or unauthorized activity, contact support@payclaw.io.
For agent identity verification inquiries (merchants), contact agent_identity@payclaw.io.