← AgentTrust

Privacy Policy

Boxclever Media Ltd, a company registered in England and Wales (company number 09394447), trading as AgentTrust ("we", "us"), operates the AgentTrust escrow platform, the AgentTrust Referee MCP server, and the XRPL NFT Issuer Registry at cryptovault.co.uk and xrpl-referee.onrender.com. Boxclever Media Ltd is the data controller for personal data processed through these services. This policy explains what data we collect, why, and how it's handled.

1. What we collect

AgentTrust is designed to need as little personal data as possible. We collect:

• XRPL wallet addresses — buyer and seller addresses you provide when creating an escrow, posting a job, bidding, or registering as an NFT issuer. Wallet addresses are public XRPL Ledger data by nature.
• Email addresses (optional in most flows, required for sellers) — used only to send receipt codes, submission links, and delivery notifications related to a specific escrow or job. We do not require an account or password.
• Task descriptions and submitted work — the text, links, or proof-of-work content you submit for AI verification is processed to generate a PASS/FAIL verdict.
• Issuer registration details — organisation name, category, description, website, and contact email, if you register as an NFT issuer in the registry.
• Transaction hashes — XRPL payment and escrow transaction hashes, used to verify on-chain payments and prevent replay/reuse of the same payment.

We do not collect passwords, payment card details, or government ID. We do not use cookies for tracking or advertising.

2. How we use it — and our legal basis

UK GDPR requires that every processing activity has a lawful basis. Ours are:

• Contract performance (Article 6(1)(b)): Processing wallet addresses, transaction hashes, and email addresses to create and manage escrow vaults, send receipt codes and submission links, and release payment when an AI verdict passes. This processing is necessary to deliver the service you requested.
• Contract performance (Article 6(1)(b)): Sending task descriptions and submitted work to Google Gemini to generate a PASS/FAIL verdict. Without this processing, the automated payment release that defines the service cannot occur.
• Legitimate interests (Article 6(1)(f)): Screening wallet addresses against sanctions lists (AnChain.ai BEI and OFAC SDN). Our legitimate interest is preventing the platform from being used to facilitate financial crime; this interest is not overridden by participants' privacy interests given the minimal data involved (a wallet address already public on-chain) and the legal and reputational risk of failing to screen.
• Legitimate interests (Article 6(1)(f)): Retaining escrow, job board, and registry records as an operational and compliance audit trail. Records reference on-chain transactions that are themselves permanent; retention is proportionate to the platform's legal and operational needs.
• Contract performance (Article 6(1)(b)): Listing and verifying NFT issuer registry records, including domain verification.
• Legitimate interests (Article 6(1)(f)): Operating the public job board and skill marketplace. Listings are intentionally public; participants choose to make their information visible.

3. Third parties

We share data with the following third parties, only as needed to operate the service:

• Google Gemini API — receives task and work text to generate AI verdicts. Google processes this data as a data processor under Google's standard data processing terms. See Google's Privacy Policy. You should not submit task descriptions containing sensitive personal data about third parties.
• XRP Ledger (mainnet) — all escrow transactions, wallet addresses, and domain verifications are recorded on the public, permissionless XRP Ledger and are inherently public and immutable.
• Render (application hosting) and Neon/PostgreSQL (database hosting) — store escrow, job board, and registry records on our behalf.
• US Treasury OFAC — wallet addresses submitted to AgentTrust are checked against the publicly available OFAC Specially Designated Nationals (SDN) list, downloaded directly from treasury.gov. No personal data is sent to OFAC; only the wallet address (which is already public on-chain) is compared against this list.

We do not sell personal data, and we do not share email addresses with any party outside of the specific transaction they relate to.

4. Data retention

We retain data for the following periods:

• Escrow, job board, and registry records — retained indefinitely as part of the operational and compliance audit history of the platform. These records reference on-chain transactions that are themselves permanent and public.
• Sanctions screening audit logs — retained for a minimum of five years, consistent with UK Money Laundering Regulations 2017 record-keeping requirements.
• Email addresses — retained only as long as needed to fulfil the specific transaction they were provided for. We do not require an email address to use the platform's read-only features or escrow-creation flow (email is optional for buyers; required only for sellers to receive submission links).
• Task descriptions and submitted work — retained as part of the escrow record. Task text sent to Google Gemini is processed at verdict time and is subject to Google's own data retention practices.

5. Your choices

• Email is optional for buyers; you can use AgentTrust without ever providing one.
• You can request removal of an email address associated with a completed escrow by contacting us (see below) — on-chain transaction data itself cannot be altered or deleted, as it lives on the XRP Ledger, not on our servers.
• NFT issuer registry entries can be claimed, updated, or disputed by the organisation they reference — see the registry spec for the verification process.

6. Children's privacy

AgentTrust is not directed at children and we do not knowingly collect data from anyone under 16.

7. Changes to this policy

We may update this policy as the platform evolves. Material changes will be reflected by updating the "Last updated" date above.

8. Contact

Questions about this policy or your data: hello@cryptovault.co.uk

AgentTrust is a trading name of Boxclever Media Ltd, registered in England & Wales, company number 09394447. Boxclever Media Ltd is the data controller under UK GDPR.