AestheticData Privacy Policy

Effective date: 2026-10-05

This Privacy Policy explains what information AestheticData (https://api.aestheticdata.io, the "Service") processes, why, and what rights you have. The Service is operated by Hephaestus SASU (SIREN 930 576 111), 14 rue Bausset, 75015 Paris, France ("we", "us"), who is the data controller for the processing described here.

1. The short version

• No accounts, no names, no API keys.
• We process your paying wallet address, transaction hash and basic request logs, to bill, prevent fraud and run the Service.
• Logs are stored in a private bucket in the EU (DigitalOcean, Frankfurt region).
• We do not sell data. We use no ads and no trackers.

2. What we collect

Because you pay per call via x402 in USDC on Base mainnet, we do not need to know who you are. We process:

• Payment data: the payer wallet address and the transaction hash. These are already public on the Base blockchain.
• Request metadata: the endpoint called, query parameters, timestamp, response status and a request id.
• Payment records: which request was paid for, the amount and the related transaction.
• IP addresses: your client IP address may be processed transiently for security and rate limiting.

We do not ask for or collect names, email addresses or account details. If you email us, we will receive whatever you include in your message.

3. Why we use it

We use this information only to:

• bill for requests and match payments to requests;
• prevent fraud and abuse, including payment bypass attempts and excessive scraping;
• operate the Service, including debugging, handling refund requests for failed requests, security and rate limiting.

Under the GDPR, we rely on performance of the contract (providing the paid request you asked for) and our legitimate interests (keeping the Service secure, preventing fraud and running it reliably).

4. Where it is stored

Request logs and payment records are stored in a private storage bucket in the EU, hosted by DigitalOcean in the Frankfurt region. We keep them only as long as we need them for the purposes above.

5. Who we share it with

We use a small number of service providers:

• DigitalOcean — hosting and storage.
• Cloudflare — DNS.
• Coinbase CDP — payment facilitation (verifying and settling x402 payments).
• Base blockchain — payments are recorded on a public blockchain, where wallet addresses and transactions are visible to anyone.

We do not sell your data, share it with advertisers or use advertising or tracking tools. We may disclose information if required by law.

6. Your rights

If the GDPR or similar laws apply to you, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data, where possible;
• restrict or object to certain processing;
• receive a copy of your data in a portable format;
• complain to your local data protection authority.

About onchain data: wallet addresses and transaction hashes recorded on the Base blockchain are public and permanent. We cannot delete or change them, and neither can anyone else. We can delete or restrict the copies held in our own logs where we are not required to keep them (for example, for billing or fraud prevention).

As we have no accounts, we identify your data by wallet address or request id. To make a request, email us from any address and include the relevant wallet address or request id. We may ask you to prove control of the wallet (for example, by signing a message).

7. Security

We keep logs in a private bucket with restricted access and use rate limiting and abuse protection. No system is perfectly secure, but we take reasonable steps to protect the data we process.

8. Changes

We may update this Policy. The effective date at the top shows the latest version.

9. Contact

Privacy questions or requests: alphaglobalus@proton.me

Hephaestus SASU (SIREN 930 576 111) 14 rue Bausset, 75015 Paris, France