所有法律文件仅提供英文版，且仅英文版具有法律约束力。
使用 Google 翻译进行翻译在新标签页中打开；仅供参考What personal data Agined Attestor collects, why, who receives it, how long we keep it and how to exercise your rights.
Last updated November 7, 2026.
Avonao, Inc., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA (a corporation formed in the State of Delaware, entity file number 10121895) is the controller of the personal data described in this policy.
Privacy questions and requests: privacy@agined.com or the privacy request form. People in the European Economic Area, the United Kingdom and Switzerland use the same channels, and we handle their requests at that address.
Our representative and data protection officer in the European Union. Our representative in the European Union under Article 27 GDPR, and our data protection officer for the European Union, is NUICORN, Chausseestraße 86, 10115 Berlin, Germany. You can contact them, and us at privacy@agined.com, on all matters about your personal data.
This policy applies to the Agined Attestor website, API, MCP server and dashboard (the "Service"). Read it with the Terms of Service, the Cookie Policy and the list of Sub-processors.
Avonao ID. Sign-up and sign-in to the Service are handled by Avonao ID, a separate account service. The Service has no sign-in methods of its own. Avonao ID, not the Service, collects and keeps your email address, name, sign-in methods, security log, country and age confirmation, under its own privacy policy. The Service receives only the OpenID Connect claims described in section 2, and reports your subscription state back to Avonao ID (section 5). Avonao ID is operated by Avonao, Inc. and is an independent controller for its own account data, including sign-up and sign-in data; its privacy policy is at https://id.avonao.com/legal/privacy.
Customer content. For personal data that you or your users put into receipts, watches, records and labels, including the records the tools keep about your own users (for example consents, terms acceptances, approvals or exam submissions), you decide the purpose and we act on your behalf as your processor, under the Data Processing Addendum that forms part of the Terms of Service. For account, billing, security and website data, and for our own purposes described below, we are the controller.
In plain language: we collect what we need to run, secure and bill the Service. We do not store your documents or request bodies, except an SBOM you ask us to keep. We do not sell your data. Receipts are signed records that cannot be edited and are deleted when they pass the retention window of your plan, and section 7 explains exactly what that means for deletion.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Workspace, organization and seat details, role, and the plan and region you choose when you finish creating your account. When you sign in with Avonao ID: the claims it sends us, which are your Avonao ID identifier, your email address (only if Avonao ID has confirmed it), your name and your language, and, if your account was migrated, your earlier user id (the Avonao ID platform user id). We keep a link between your Avonao ID identifier and your account, and the data region of that account, so that a later sign-in finds the same account instead of creating a second one. We hold no passwords. | Avonao ID, and you. |
| Sign-up and sign-in data held by Avonao ID | Not held by the Service: your email addresses, name, sign-in methods (passwords, passkeys, authenticator app, recovery codes and any connected third-party accounts), sessions, the Avonao ID security log, your country, and your confirmation that you are at least 16 years old. Avonao ID collects these and its privacy policy applies to them. | You, directly at Avonao ID. |
| Credentials | For each API key or token: identifier, display prefix, last four characters, scopes, dates, and a usage counter by path and source network. The secret itself is stored only as a SHA-256 hash. Session tokens are stored as hashes. | You and your use of the key. |
| Billing data | The plan, status, seat count, usage counters and top-up balances that we keep, and, from Avonao Billing (the centralized billing entity, which runs checkout) and Stripe (the merchant of record, which takes the payment for your purchase), your billing country, tax status, and the brand and last four digits of your card. We never receive the full card number. | You, Avonao Billing, Stripe and your use of the Service. |
| Receipts and watches | For the calls you make: the tool, time, workspace, the destination URL, hostname or domain in full (including any query string), HTTP method and status, sizes and timings, SHA-256 hashes of bodies and content, the free-text labels and references you supply, commit author names and emails for commit.attest, the sender and receiver identifiers of an e-invoice, the domain of an email's sender and its DKIM verdicts, the summary an approver reads for approval.attest, DNS answers, certificate chains, registry, package and page data for watches and captures, and the signed receipt itself. | Your calls to the Service and the checks you schedule. |
| Records about your users | For the tools that keep records about people on your behalf: a salted subject hash in place of each person's identifier, and the salt we keep for your workspace; for approvers, the label you give them, their passkey's public key and sign counter; for devices, their public key; for mail received at an Agined-hosted address, the hash of the message and of its envelope sender; for anonymous reports, the hash of the encrypted report and of the reporter's case token. | You, and the people you send to the pages and addresses we host for you. |
| Escrowed SBOMs | The software bill of materials you send to sbom.notarize with escrow on, kept as canonical JSON. It can name the people or suppliers it lists. Only when you ask for escrow. | You. |
| Stored third-party secrets | API credentials you store for api.witness and webhook signing secrets for payment.event, sealed with AES-256-GCM and bound to your workspace and the endpoint. We never return them and they appear in no receipt. | You. |
| Security audit log | Security-relevant events (sign-ins, key and role changes, denied access) with the source IP address and user agent. | Your devices. |
| Operational logs | IP address, user agent, request path and outcome of requests, and rate-limit counters, used for reliability, rate limiting and abuse prevention. | Your devices. |
| Test-key data | A salted SHA-256 hash of the network address that requested a test key, and creation and expiry times. The address itself is not kept. | Your network. |
| Abuse and support records | A per-workspace abuse status with the reason and any appeal, and what you write to support or in a privacy request. | You, and our detection of misuse. |
| Number One conversations | What you type to Number One, the assistant on the website and in the dashboard, its answers and the sources it cited. In the dashboard, also the workspace records it reads to answer you (receipt metadata, usage, monitors, webhooks, key prefixes, team members, plan and support tickets, but never passwords, key secrets or card data) when workspace lookups are on for your workspace. On the website, a day-salted hash of your network address is used for rate limiting; the address itself is not kept. | You, and your workspace when you ask about it. |
| Website analytics | Pseudonymous page visits and navigation, only if you allow Statistics. See the Cookie Policy. | Your browser. |
Receipts can contain personal data if it is in what you submit, for example a URL that identifies a person or a commit author's name and email. Do not submit special categories of personal data (health, biometric, political, religious and similar data) or data about children to the Service.
If you are a person named in a receipt by someone else (for example as a commit author), the workspace owner is the source. You can use the rights in section 8 against us for that data.
If you met Agined through one of our customers. You may approve an action with a passkey on a page we host, send a report through an anonymous channel, accept a customer's terms, give consent on a customer's site, take an exam or send mail to an Agined address. The customer decides why, and is the controller; we keep only what the table above lists, as its processor. Most of these records name you only by a salted hash that we cannot link to you without the customer. The anonymous report channel never receives your report, your IP address or your browser details. Ask the customer first; you can also use the rights in section 8 against us, and we will pass your request to the customer where it concerns their records.
We do not store:
One exception: if you send an Idempotency-Key on a request, the gateway keeps the complete response, which for a relayed call includes the destination's response body, for 24 hours so a retry returns the same answer. It is scoped to your workspace and then expires on its own. See Data and privacy for the technical detail.
A second exception: if you send an SBOM to sbom.notarize with escrow on, we keep the document itself for ten years, as section 7 describes.
| Purpose | Data | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Provide the Service: sign-in, receipts, watches, API and dashboard | Account data, credentials, receipts and watches | Contract. |
| Create your account and sign you in through Avonao ID, and report your subscription state to it | The Avonao ID claims (identifier, confirmed email, name, language), the link to your account, the subscription state we report | Contract. |
| Bill for the Service, meter usage and handle payment failures | Billing data, account data | Contract. |
| Secure the Service, detect and prevent fraud and abuse, rate limit | Security audit log, operational logs, test-key data, abuse records | Legitimate interests in keeping the Service and its customers safe. |
| Keep receipts as verifiable records for your plan's retention window | Receipts | Contract with you, and legitimate interests of you and the people you show a receipt to in evidence that can be relied upon. |
| Respond to support and privacy requests, and keep a record that we did | Support and request records | Contract, legal obligation and legitimate interests. |
| Send service notices (security, billing, changes to terms) | Account data | Contract and legal obligation. |
| Send the newsletters, updates and waitlist notices you sign up for | Email address, the lists you chose, the time and record of your confirmation | Consent. |
| Meet tax, accounting and other legal duties; establish or defend legal claims | Billing records, other records as needed | Legal obligation and legitimate interests. |
| Measure how the website is used | Website analytics | Consent. |
Email lists. We send newsletters, product updates and "notify me" emails only to addresses that asked for them and then confirmed by clicking the link in our confirmation email (double opt-in). Each list is separate: you receive only the lists you chose. Every such email carries an unsubscribe link and a List-Unsubscribe header, so you can leave a list in one click or from your mail app, and you can manage all your lists from the link at the foot of any of these emails. You can also write to privacy@agined.com and we will remove you. Unsubscribing does not stop service notices about an account you hold (security, billing, changes to terms), which we send under the contract. We keep a record of your confirmation and of your unsubscribe so that we can show your consent and honour your choice.
Where we rely on legitimate interests you can object (section 8). Where we rely on consent you can withdraw it at any time.
California and other US states. We collect the categories above for the business purposes listed in this section. In the language of the CCPA, we collect identifiers (email, name, IP address, keys), customer records and commercial information (plan, billing status), internet and network activity (requests, logs, analytics if you consent) and approximate location derived from IP address. We do not collect sensitive personal information to infer characteristics about you. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done either in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.
We do not sell personal data to anyone.
We are based in the United States. Account data, sign-in, billing records and the dashboard are served and stored in the region you chose at sign-up (Cloudflare); the public website and documentation, which hold no customer data, are served from the United States. Cloudflare terminates network connections at the location nearest the visitor, which can be outside your region; stored data stays in the region. Workspace data (receipts, watches and relayed-request processing) is processed and stored in the data region you choose for the workspace (see Data regions). Free workspaces are always in US West, with no region choice. On the Starter, Pro, Pro+ and Team plans, you choose one of seven Cloudflare regions, and it is stored with Cloudflare: on Free and Starter in the region's shared Cloudflare D1 database, and on Pro, Pro+ and Team in the workspace's own separate store on Cloudflare in that region, one per workspace, with strict tenant isolation. The three European regions store data under Cloudflare's EU jurisdiction. On the Scale and Enterprise plans, and with the isolation add-on, it is stored in the workspace's own Amazon Aurora database at Amazon Web Services, in the AWS region you choose. If you are in the EEA, the UK or Switzerland, your personal data is transferred to the United States when you use the Service.
We protect these transfers with the European Commission's Standard Contractual Clauses (and, for the UK, the UK International Data Transfer Addendum, and for Switzerland the Swiss adaptations of the clauses), which form part of our Data Processing Addendum and our agreements with sub-processors. Where a recipient is certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US Data Privacy Framework, that certification is an additional basis. Cloudflare, Google, Microsoft and Amazon Web Services are so certified. We claim no certification for any other provider and rely on the Standard Contractual Clauses for them. You can ask for a copy of the clauses at privacy@agined.com.
Avonao ID stores your Avonao ID account data in the data region you choose with it (one of seven, with some records kept in its home region, US West), and it relies on its own transfer safeguards, described in its privacy policy. The claims it sends us are received and stored by the Service as described above.
You choose the data region when a workspace is created and it does not change afterwards. Choosing a region outside the United States does not move account data, which stays in the United States.
| Data | Kept for |
|---|---|
| Account data, watch registrations, signing-key requests and stored connector credentials | For the life of the account or workspace. When you delete it, we wait 30 days (the grace period in which you can restore it), then erase the data. Database recovery copies held by our storage provider roll off within a further 30 days. |
| Avonao ID account | Deleting your Avonao ID is governed by Avonao ID's rules. You cannot request deletion while you have a paid subscription on a platform; cancel it there first. A free subscription ends with your Avonao ID and its data is deleted. After you confirm deletion you have 30 days to restore the account; then Avonao ID permanently deletes it. Avonao ID keeps its security log for 13 months, and no longer than the account. [CONFIRM: that the Service's own account deletion applies the same paid-subscription block and the same 30-day restore alongside the Service's 30-day grace period above, and what the Service does when Avonao ID reports that an account was deleted.] |
| Receipts | For your plan's retention window, then deleted: Free 7 days, Starter 30 days, Pro 90 days, Pro+ 180 days, Team 365 days, Scale 730 days; Enterprise is custom, with no automatic deletion unless you or your contract set a window. You can shorten the window in your settings but not extend it. After a downgrade the previous window applies for 7 days, and after a paid plan ends for 30 days; then receipts older than the new window are deleted. Receipts are append-only while they are kept: the database refuses updates and deletes except the audited deletion routes (your own deletion, redaction, and the retention job), and the product has no way to edit one. Deleting a watch or cancelling a plan does not by itself delete them, and they are not removed by account deletion before the window ends; a workspace with no active paid plan is treated as Free. They keep the readable fields they contain (URLs, labels, commit author names and emails and the other fields listed in Retention and erasure) until they are deleted. Receipts, and everything recorded about them, are stored in the workspace's data region: on the Free to Team plans in Cloudflare D1, on the Scale and Enterprise plans and with the isolation add-on in the workspace's own Amazon Aurora database in the AWS region the workspace chose. When you move to one of those plans or buy the add-on, existing receipts are moved into that database; when you move back from Scale or Enterprise or drop the add-on, they are copied back into Cloudflare D1 and checked, and the Aurora database is retired after the grace period. We keep no copy or hash of them anywhere else. |
| Escrowed SBOMs | Ten years from when you asked sbom.notarize to keep the document, in a storage bucket in your workspace's data region (Cloudflare R2; EU-jurisdiction storage for the European regions). The bucket is locked for those ten years: no one, including us, can delete the document earlier, and deleting its receipts, the workspace or the account does not remove it. Do not escrow an SBOM that contains personal data you may need erased. |
| Tool settings and records | Watch and capture settings and their history, record chains, your workspace's subject salt, approvers, devices, inbound endpoints and mailboxes, draws and stored third-party secrets: for the life of the workspace, then erased with it after the 30-day grace period described above. The receipts they produced follow the Receipts row. |
| Number One conversations | Website questions and answers: 30 days. Dashboard questions and answers: 90 days, then deleted; deleted with the workspace when you delete it. Rate-limit counters: no longer than a day. |
| Security audit log | For the life of the workspace and after it as an append-only record. When erasure of a person is required, we replace the identifier of that person in the entries rather than breaking the chain. |
| Operational logs and rate-limit counters | 30 days at most. |
| Idempotency response cache | 24 hours. |
| Sessions | 12 hours at most, ending after 30 minutes of inactivity. |
| Billing and tax records | 7 years, as tax and accounting law requires. They survive account deletion. |
| Abuse flags and appeals | For as long as needed to protect others, and they survive account deletion, so that deleting a workspace cannot clear an abuse record. |
| Support and privacy request records | 3 years after the matter is closed, then their content is erased: a support ticket's messages, attachments and subject, and a privacy request's name, contact details and message. A privacy request that was never verified counts as closed when its verification link expires. Content is erased earlier when the workspace or organization is erased (a privacy request, once it is closed). A ticket for which you chose "Keep forever" is kept until the workspace or organization is erased. We keep a hash of each message for the receipt chain, and the record of each privacy request (its type, dates and outcome) to show that we handled it. |
| Test-key sandbox | The key stops working 7 days after it is issued. The sandbox workspace, its receipts and the key are deleted 7 inactive days after the later of the key's expiry and its last call, and the hashed network identifier within 30 days after that. A copy of a test receipt you saved still verifies. |
| Website analytics | Google Analytics event data is kept for 14 months at most. Avonao ID plans further analytics tools on its own sites; see the Cookie Policy. |
What persistence of receipts means for you. A receipt is a signed statement that must stay unchanged to be worth anything. We therefore do not alter receipts on request through the product; they are deleted when they pass your plan's window, or earlier if you delete or redact them yourself. If a request concerns personal data inside a receipt, we assess it individually, tell you in our answer what we can remove and what we must retain and why, and do so within the deadlines in section 8. We keep receipts on the basis of our contract with you and the legitimate interest in evidence that stays reliable, and, where a law allows, for the establishment, exercise or defense of legal claims. Once we have deleted a receipt it cannot be fetched from the Service again, but a copy that you or a third party already hold, such as one you exported, still verifies offline whatever happens to our stored copy, because verification needs only the receipt and a public key. Keep personal data out of receipts: choose what you put in URLs, labels and the other readable fields. Export the receipts you need before they pass your plan's window, and before you delete an account.
See Retention and erasure for how deletion works in practice.
Depending on where you live, you may have the right to:
These rights come from the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA/CPRA) and the comparable laws of other US states, and apply to the extent those laws apply to you.
Use the privacy request form, which covers GDPR requests and requests under California and other US state laws, or write to privacy@agined.com. If you are signed in, use the account you hold; you can also change most of your data in the dashboard. For the data Avonao ID holds (email addresses, name, sign-in methods, security log, country and age confirmation), use the tools in your Avonao ID dashboard or write to Avonao ID's privacy contact; we cannot change it for you. If you need us to find receipts, give the receipt ids or the hash, because we often cannot tell from a hash whom a receipt concerns.
For people in Brazil, the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018) applies to the processing described in this policy. The rights in section 8 include the rights in Article 18 LGPD, among them confirmation that we process your data, anonymisation, blocking or deletion of unnecessary or excessive data, information about the public and private entities we share it with, and information about the possibility of refusing consent and what follows from refusing.
Send requests under the LGPD to our privacy contact, privacy@agined.com. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD). Personal data is transferred to the United States and to the data region chosen for the workspace, with the safeguards described in section 6.
For people in Japan, the Act on the Protection of Personal Information (APPI) applies.
We honor the Global Privacy Control signal as an opt-out. A browser that sends it is treated as "Only necessary": Statistics stay off unless you switch them on yourself in the cookie settings. The Service does not respond to the older Do Not Track header, because it does not track you across other sites.
California Civil Code section 1798.83 lets California residents ask which categories of personal information a business has disclosed to third parties for their direct marketing. We make no such disclosures. You can still write to privacy@agined.com to ask.
The Service is for businesses and developers and is not directed to anyone under 16. Avonao ID, through which you sign up and sign in, is not for anyone under 16 either: at sign-up it asks whether you are at least 16 and does not ask for a date of birth. A guardian-consent flow for younger members is built in Avonao ID but switched off. If Avonao ID learns that someone under 16 created an account, it deletes it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@agined.com and we will delete what we can, as described in section 7.
We make no decision about you that has legal or similarly significant effects based solely on automated processing. Automated checks flag unusual usage for a person at Agined to review. They do not suspend an account by themselves.
We protect personal data with technical and organizational measures described in Security model, including encryption in transit, hashed credentials, per-workspace isolation and access controls. No system is perfectly secure. If a personal data breach affects you, we notify you and the authorities as the law requires. Report suspected incidents to security@agined.com.
We update the date at the top when we change this policy. We announce material changes by email to account owners or in the dashboard at least 30 days before they take effect. If you do not agree, you may delete your account before the change takes effect.