Privacy Policy

Overview

x402 List is an open directory of services and facilitators implementing the x402 payment protocol. This page explains what data we collect, why we hold it, how long we keep it, and how you can ask us to access or delete it. We keep data collection to the minimum needed to run the directory. Questions or requests can be sent by email to info@x402-list.com.

Who Is Responsible

x402 List is operated by Cosimo Miccolis, an individual based in Italy, who is the data controller for the personal data described on this page. Requests and questions reach him at info@x402-list.com, which is the only channel we use for data requests.

What We Collect

Submission data. When you submit a service or a facilitator, or request an update to an existing listing, we collect the email address you provide and the listing details you enter: names, URLs, category, description, endpoint paths or settler addresses, networks, and any optional notes. The optional owner contact email on an update request is used only to reach you and is never displayed publicly.

Analytics. We use aggregated, privacy-respecting web analytics (Rybbit) to understand how pages are used. This does not set tracking cookies and does not build cross-site advertising profiles.

Operational logs. Our servers process standard request metadata (such as IP address and request path) as needed to operate, rate-limit, and secure the directory and its API.

Why We Use It

We use submission data to review, publish, and maintain directory listings, and to contact you about the outcome of a submission or update. We use analytics and operational logs to run the site, keep the API available, and prevent abuse. We do not sell your data, and we do not use it for advertising.

Legal Basis

We process the data you send with a submission in order to take the steps you asked for before a listing is published, and to maintain that listing afterwards (GDPR Article 6(1)(b)). We process operational logs, analytics, and the record of rejected submissions on the basis of our legitimate interest in keeping the directory available, accurate, and free of spam (Article 6(1)(f)). We keep payment records to comply with accounting law (Article 6(1)(c)).

Some directory entries were discovered from public sources rather than submitted to us. We publish those on the basis of our legitimate interest in maintaining a complete public index of the x402 ecosystem, and every such entry says so on its own page. If you operate one of them you can ask to be removed at any time: see Your Rights below.

Who Else Processes It

We do not sell data and we do not share it for advertising. A small number of providers process it on our behalf in order to run the site: Hetzner for hosting (Germany), Cloudflare for content delivery and protection (which handles visitor IP addresses and is based in the United States), and Brevo for transactional email (France) when we reply to a submission. Our analytics run on our own server, so that data does not leave it.

The automated assessment of listed services uses an external language-model provider. It receives only public information about the services being assessed: never your email address, and never anything else you send us.

Cloudflare processes visitor IP addresses outside the EU under its data processing addendum, which incorporates the European Commission standard contractual clauses. The language-model provider is also outside the EU, and receives no personal data at all.

What Is Public

Listing content you submit (service or facilitator name, URLs, category, description, and endpoints) is published in the public directory and its API: that is the purpose of a submission. The email address you submit and any owner contact email are not published.

Retention

When one of these periods runs out we do not delete the record: we redact it. The email address and any free-text notes are removed, and what remains is the bare event (a URL, a status, a date). That is deliberate. The record that a service was already reviewed and rejected is what stops it from silently re-entering the review queue later, so deleting it outright would quietly undo the curation it represents.

Submissions. While a listing is published, the submission behind it is kept for as long as that listing exists: it is the record of who proposed it. Once the listing is removed, or when a submission is rejected, the email address and notes are redacted 12 months later.

Update requests and facilitator submissions. Same rule, 12 months after the request is closed. The one-time ownership token used to prove control of a domain expires by itself after 72 hours.

Suggestions. The email address attached to a paid suggestion is removed after 24 months. The suggestion text itself is kept: it is what the payment was for.

Payment records. Kept for 10 years, as accounting law requires. They contain an on-chain address and a transaction hash, both already public on the blockchain by design. Because the law requires us to keep them, they are not removed on request.

Monitoring data. Raw uptime checks are deleted after 30 days. They contain no personal data.

Analytics and server logs. Analytics events carry no IP address and no tracking cookie, so they stay pseudonymous, and we keep them for as long as the directory runs in order to compare periods over time. Server request logs are not archived: they rotate away by size, which in practice means days rather than months.

Your Rights

You can ask us to give you a copy of the personal data you have sent us, to correct it, to delete it, to export it, or to limit what we do with it. Where we rely on legitimate interest, you can also object: that includes asking to have a listing removed, whether you submitted it yourself or it was discovered from a public source. To exercise any of these, email info@x402-list.com. We reply within one month, which is the deadline the law sets.

If you believe we have handled your data improperly, you can lodge a complaint with your local data protection authority. In Italy that is the Garante per la protezione dei dati personali, garanteprivacy.it.

Contact

For any privacy question or request, email info@x402-list.com. This is the only channel we use for data requests.