Privacy Policy

Overview

x402 List is an open directory of services and facilitators implementing the x402 payment protocol. This page explains what data we collect, why we hold it, how long we keep it, and how you can ask us to access or delete it. We keep data collection to the minimum needed to run the directory. Questions or requests can be sent by email to info@x402-list.com.

Who Is Responsible

x402 List is operated by Cosimo Miccolis, an individual based in Italy, who is the data controller for the personal data described on this page. Requests and questions reach him at info@x402-list.com, which is the only channel we use for data requests.

What We Collect

Submission data. When you submit a service or a facilitator, or request an update to an existing listing, we collect the email address you provide and the listing details you enter: names, URLs, category, description, endpoint paths or settler addresses, networks, and any optional notes. The optional owner contact email on an update request is used only to reach you and is never displayed publicly.

Support tickets. When you open a paid support ticket we collect the email address you provide, which is where the reply is sent, together with the listing you name and the problem you describe. None of it is published. The confirmation is sent through the transactional email provider named below.

Sponsor bookings. When you book a sponsor week, we collect the selected week, sponsor name, sentence, URL, link label, and optional contact email. We also record the payer wallet address, payment amount, network, transaction hash, and review and refund history. Booking notifications, including these details, are sent to the admin through the transactional email provider named below.

Analytics. We use aggregated, privacy-respecting web analytics (Rybbit) to understand how pages are used. This does not set tracking cookies and does not build cross-site advertising profiles.

Operational logs. Our servers process standard request metadata (such as IP address and request path) as needed to operate, rate-limit, and secure the directory and its API.

Why We Use It

We use submission data to review, publish, and maintain directory listings, and to contact you about the outcome of a submission or update. We use analytics and operational logs to run the site, keep the API available, and prevent abuse. We do not sell your data, and we do not use it for advertising, except that approved sponsor copy is published as the sponsor's own paid placement.

We may also send the address given with a listing an occasional email about that listing and the directory, for example its badge, a facilitator it uses that we do not track yet, or sponsoring a week. Every such email has a one-click unsubscribe link, and once you use it we send no more of these emails to that address.

We use sponsor booking data to review the paid placement, publish approved sponsor copy during its booked week, and handle any manual refund. An optional contact email is used for questions about the booking.

Legal Basis

We process the data you send with a submission in order to take the steps you asked for before a listing is published, and to maintain that listing afterwards (GDPR Article 6(1)(b)). We process operational logs, analytics, and the record of rejected submissions on the basis of our legitimate interest in keeping the directory available, accurate, and free of spam (Article 6(1)(f)). We send the occasional emails about a listing on the basis of our legitimate interest in keeping listings and the directory current (Article 6(1)(f)), and you can object at any time with the unsubscribe link. We keep payment records to comply with accounting law (Article 6(1)(c)). We process the data you send with a support ticket in order to answer it, which is the service you paid for (Article 6(1)(b)). We process sponsor booking data to provide the paid placement, review it, and handle any refund (Article 6(1)(b)). Sponsor payment records follow the accounting basis above.

Some directory entries were discovered from public sources rather than submitted to us. We publish those on the basis of our legitimate interest in maintaining a complete public index of the x402 ecosystem, and every such entry says so on its own page. If you operate one of them you can ask to be removed at any time: see Your Rights below.

Who Else Processes It

We do not sell data and we do not share it for advertising. A small number of providers process it on our behalf in order to run the site: Hetzner for hosting (Germany), Cloudflare for content delivery and protection (which handles visitor IP addresses and is based in the United States), and Brevo for transactional email (France), including submission replies, support ticket messages, the occasional emails about a listing, and sponsor booking notifications to the admin. Our analytics run on our own server, so that data does not leave it.

The automated assessment of listed services uses an external language-model provider. It receives only public information about the services being assessed: never your email address, and never anything else you send us.

Cloudflare processes visitor IP addresses outside the EU under its data processing addendum, which incorporates the European Commission standard contractual clauses. The language-model provider is also outside the EU, and receives no personal data at all.

What Is Public

Listing content you submit (service or facilitator name, URLs, category, description, and endpoints) is published in the public directory and its API: that is the purpose of a submission. The email address you submit and any owner contact email are not published.

Approved sponsor names, sentences, URLs, and link labels are public in the sponsor row during the booked week. The contact email, review notes, and payment details are not published in that row or in the directory API, MCP server, or llms.txt. Wallet addresses and transaction hashes are already public on the blockchain.

Retention

When one of these periods runs out we do not delete the record: we redact it. The email address and any free-text notes are removed, and what remains is the bare event (a URL, a status, a date). That is deliberate. The record that a service was already reviewed and rejected is what stops it from silently re-entering the review queue later, so deleting it outright would quietly undo the curation it represents.

Submissions. While a listing is published, the submission behind it is kept for as long as that listing exists: it is the record of who proposed it. Once the listing is removed, or when a submission is rejected, the email address and notes are redacted 12 months later.

Update requests and facilitator submissions. Same rule, 12 months after the request is closed. The one-time ownership token used to prove control of a domain expires by itself after 72 hours.

Suggestions. The email address attached to a paid suggestion is removed after 24 months. The suggestion text itself is kept: it is what the payment was for.

Support tickets. The email address attached to a support ticket is removed after 24 months. The ticket text itself is kept: it is what the payment was for.

Sponsor bookings. Booking content and review and refund history are retained with payment records for the accounting period below. The optional contact email is part of the booking record and has no shorter scheduled redaction period. You can request earlier removal of that contact email by email.

Unsubscribes. When you unsubscribe we keep a one-way hash of the address, never the address itself, with the date and how you unsubscribed. It is kept for as long as we send these emails, because it is what stops us from writing to that address again.

Payment records. Kept for 10 years, as accounting law requires. They contain an on-chain address and a transaction hash, both already public on the blockchain by design. Because the law requires us to keep them, they are not removed on request.

Monitoring data. Raw uptime checks are deleted after 30 days. They contain no personal data.

Analytics and server logs. Analytics events carry no IP address and no tracking cookie, so they stay pseudonymous, and we keep them for as long as the directory runs in order to compare periods over time. Server request logs are not archived: they rotate away by size, which in practice means days rather than months.

Your Rights

You can ask us to give you a copy of the personal data you have sent us, to correct it, to delete it, to export it, or to limit what we do with it. Where we rely on legitimate interest, you can also object: that includes asking to have a listing removed, whether you submitted it yourself or it was discovered from a public source. To exercise any of these, email info@x402-list.com. We reply within one month, which is the deadline the law sets.

If you believe we have handled your data improperly, you can lodge a complaint with your local data protection authority. In Italy that is the Garante per la protezione dei dati personali, garanteprivacy.it.

Contact

For any privacy question or request, email info@x402-list.com. This is the only channel we use for data requests.