Privacy Policy

BIT-TIGHT LTD, company number 517253035, a company registered in Israel ("Bitight", "we", "us") is the controller of the Personal Data described in this Privacy Policy.

Words defined in our Terms of Service have the same meaning here.

This Privacy Policy applies to Personal Data we Process when you visit our website, sign in to or use the Service, or contact us.

"Personal Data" means any information that relates to an identified or identifiable person.

The following "Service Providers" receive Personal Data to help us provide the Service. Each definition includes any successor provider we appoint:

1. (a)

   "Authentication Provider" means Auth0, and the sign-in services you choose through it, Google or Apple.

2. (b)

   "Wallet Provider" means Privy.

3. (c)

   "Network Providers" means Pimlico, which submits Payments to the Network and collects the Network Fee, and Alchemy, which reads the Network for our servers and your browser.

4. (d)

   "Email Provider" means Postmark.

5. (e)

   "Hosting Provider" means Cloudflare, which serves our website and carries traffic to our servers, and Microsoft Azure, which runs our servers and database in its West Europe region.

6. (f)

   "Wallet Connection Provider" means Reown, used only if you connect Your Wallet by WalletConnect.

"Process" means any operation on Personal Data, such as collecting, storing, using, disclosing or deleting it.

"Data Protection Law" means the Israeli Protection of Privacy Law, 5741-1981, and the regulations under it, the EU General Data Protection Regulation and the UK GDPR where they apply, and any other data protection law that applies to our Processing.

Account data: an account ID, which is the Authentication Provider's user ID and includes your Google or Apple user ID, the email address the Authentication Provider gives us, and a display name for each sign-in (your email, or your name if no email is given).

Wallet data: the address of each wallet you link to your Account.

Agent data: the address of your Agent Wallet, each Agent Address, the Wallet Provider's wallet ID for each Agent, the name you give each Agent, the chat apps you allowed to use it, and when it was last active.

Chat app data: the name each chat app gives itself, its return addresses, when it registered, when you connected it, when it last used the Service, and the Agent it set up. A chat app's sign-in tokens are kept in protected form, with the time each was used.

Limits and approvals: the Limits you sign, which include your wallet's signature and your Agent Wallet address, your answer to each request in Ask Mode, and, for each Payment you approved, the Account that approved it and the time of approval. Each time an Agent is turned off, we record the signed Limits it ends, the reason and whether it completed on the Network.

Pending requests: while a request in Ask Mode awaits your answer, the full request the Agent wants to send, which may include details a Seller asked for.

Payment history: for each Payment, the Agent that made it, the Seller's web address or the recipient, the amount, the outcome, the Network transaction, whether you approved it in Ask Mode or it was paid within your Limits, the Agent's short note on why it paid, and technical details such as the size of the request and the Seller's response code. Each Payment records the Agent that made it, and so the chat app it is connected to. While a Payment is in progress, we also keep the signed USDC transfer to the Seller (the recipient, the amount and a one-time number), any Network transaction waiting to complete, and retry records.

Funding records: when you add USDC, the addresses, the amount, and the authorization you signed. When you move USDC back to Your Wallet, the amount, the time, the status and the Network transaction. Move-back records keep no address or signature.

Security data: if you turn on two-step sign-in, your authenticator secret and recovery codes, stored in protected form, the count of wrong codes and the time of any lockout. While you sign in, a record with your display name and the page to return to.

Plan and alerts: your Plan, its status and the end of the current period, any downgrade or cancellation you asked for with the Agents you chose to keep, a count of Plan changes, and your alerts and alert settings. Alerts may include a Seller's web address and amounts, and alerts about your Agent Wallet, such as a low balance, record the amounts at the time.

Technical data: your IP address, used to limit the number of requests from one address. Our servers' logs record the time and kind of each event, and the route of a failed request, but not your IP address or the full address of a request. They are kept in Azure Log Analytics for 365 days. Cloudflare, as a Hosting Provider, also sees all traffic to our servers.

Keys: you hold the keys to Your Wallet, which alone owns your Agent Wallet. The Wallet Provider holds the key of each Agent Address.

Communications: when you contact us, your contact details and the content of your message.

We collect this data from you, from the Authentication Provider, from your Agents and connected chat apps, and from the Network.

We do not ask for identity documents or for special categories of Personal Data. If you or your Agent give us Personal Data of another person, you must have the right to do so.

We use Personal Data to provide the Service: to sign you in, connect your Agents, pass on your Agents' Payment requests and ask you about them, and send your alerts. You can turn alert emails off, except security and billing emails, which always come. Legal basis: performance of our contract with you.

We use Personal Data to keep the Service secure: to limit requests, check two-step sign-in codes and prevent misuse. Legal basis: our legitimate interest in a secure Service.

We use Personal Data to manage your Plan and to answer you when you contact us. Legal basis: performance of our contract, and our legitimate interest in answering you.

We use Personal Data when the law requires it, and to establish, exercise or defend legal claims. Legal basis: legal obligation, and our legitimate interest in protecting our rights.

We do not use Personal Data for advertising or marketing, and we do not sell it.

The Service applies your Limits and Ask Mode automatically. A Payment outside your Limits, or not approved in time in Ask Mode, is refused without human review. The Service also refuses to pass on a Payment request automatically, under our own rules, when: (a) it would exceed the Free Plan's 1 Payment a day; (b) a payment for your Plan has failed; (c) the owners or code of your Agent Wallet have changed; (d) its Network Fee is above our maximum; or (e) the Seller's web address fails our safety checks. We make no other decision about you based solely on automated Processing.

We do not run your Agent's AI, and we do not use your Personal Data to train AI models. Your chat app and its AI provider Process what you and your Agent exchange under their own terms and privacy policies.

We share Personal Data only with the following recipients, and only as needed to provide the Service or as the law requires:

1. (a)

   the Authentication Provider receives your sign-in details;

2. (b)

   the Wallet Provider receives each Agent Address and each Payment it signs;

3. (c)

   Network Providers receive the address of your Agent Wallet, each Agent Address and each Payment, and Alchemy sees your IP address and the wallet address when your browser checks a balance or status;

4. (d)

   the Email Provider receives your email address and the content of each alert;

5. (e)

   the Hosting Provider carries and stores the data we hold;

6. (f)

   the Wallet Connection Provider relays your wallet connection, if you use it;

7. (g)

   the chat apps you connect receive the results of the Payments they request and the status of their Agent;

8. (h)

   Sellers an Agent pays receive the Agent Address, the Payment, and the request the Agent sends them, but never the Agent's note;

9. (i)

   authorities, when the law requires it;

10. (j)

    our professional advisers, under a duty of confidentiality; and

11. (k)

    a buyer or successor in a merger, acquisition or sale of our business, which must protect Personal Data in line with this Privacy Policy.

Payments, wallet addresses and signed Limits on the Network are public and permanent. Anyone can see them, and no one, including us, can delete them.

Service Providers Process Personal Data on our instructions or under their own terms. Sellers and chat apps Process Personal Data under their own privacy policies, and we are not responsible for them.

Your Personal Data may be transferred to and Processed in the European Union. We host the Service on Microsoft Azure in its West Europe region.

Some Service Providers Process Personal Data outside Israel and the European Economic Area, including in the United States.

Where Personal Data is transferred outside the European Union or the European Economic Area, we rely on the standard contractual clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

The European Commission recognizes Israel as providing an adequate level of protection for Personal Data transferred from the European Union.

A sign-in session lasts 30 days from your last use of the Service. The record kept while you sign in lasts five minutes.

A chat app's sign-in lasts 30 minutes at a time, and stays signed in while the chat app uses the Service at least once every 30 days. Turning two-step sign-in on or off signs you out of all other browsers and signs out every connected chat app.

A Seller's reply to a Payment you approved in Ask Mode is deleted after about 24 hours. Retry records for a Payment are kept for 24 hours.

A pending request in Ask Mode, with your answer, is deleted soon after it ends. Requests still open are deleted at once when you turn the Agent off. The Agent's own copy is deleted 30 days after it ends.

Account, wallet, Agent, chat app, Limits, Plan and alert data are kept while your Account is open. A chat app's registration (its name, return addresses and registration time) is shared by all Users who connect that chat app, and is kept while any Account uses it. Your connection to a chat app is deleted with your Account under clause 7.8. Registrations that no Account uses are removed from time to time.

While your Account is open, Payment history, approval records, funding and move-back records, each set of Limits you signed, and the record of which version of the Terms you accepted and when are kept for 7 years from each one's date. After your Account is closed, clause 7.8 applies.

Server logs and backups are kept for up to 12 months.

You may close your Account with the Close account button in your account settings. After you confirm, you are signed out. For 14 days after closing, you may cancel the closure by signing in again, and you may move your USDC to Your Wallet through the Service. After those 14 days, the closure is final, moving USDC through the Service ends, USDC left at each Agent Address is sent to Your Wallet, less the Network Fee for that transfer, and all data of your Account is deleted, except the records of money movements that the law requires us to keep, each set of Limits you signed, and the record of which version of the Terms you accepted and when. We keep those records for 7 years from each record's date. We also keep each Agent Address and the Wallet Provider's wallet ID for it, without your Account, so that the Wallet Provider can still sign for any USDC that stays at that address, until 7 years after the last record of money movements for that address, or after your Account is deleted if there are none. Deleted data stays in our backups until those backups expire, within the period in clause 7.7.

When a retention period ends, we delete the Personal Data or anonymize it so that it no longer identifies you. Data on the Network cannot be deleted.

You may ask us to give you access to, correct, or delete your Personal Data, or to give you a copy of it.

Depending on where you live, you may also object to or restrict some uses, and complain to a data protection authority. In Israel, this is the Privacy Protection Authority. In the European Economic Area, it is the authority in your country of residence, and in the United Kingdom, the Information Commissioner's Office.

To exercise your rights, write to support@bitight.com.

Data on the Network cannot be deleted.

We will respond to a request within 30 days of receiving it. We may ask you to confirm your identity first. Where the law allows, we may extend this period and will tell you why.

When you ask us to delete your Personal Data, we will delete it within 30 days of your request, except data that the law requires us to keep, data we need to establish, exercise or defend legal claims, and data on the Network. We will tell you what we keep and why. Deleted data stays in our backups until those backups expire, within the period in clause 7.7.

We will not treat you less favourably for exercising your rights.

Your Account page shows where you are signed in:

1. (a)

   Chat apps: each connected chat app, with its name, when you connected it and when it last used the Service. You can sign out any chat app. A chat app that you sign out can no longer use the Service until you connect it again.

2. (b)

   Browsers: a list of the browsers signed in to your Account, each of which you can sign out, or a control to sign out of all browsers.

If you live in California or in another US state whose privacy law gives you these rights, you may ask us to tell you what Personal Data we hold about you and how we use it, to give you access to it, to correct it, to delete it, and to opt out of the sale or sharing of your Personal Data. We do not sell Personal Data, and we do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. To exercise them, write to the address in clause 8.3.

We protect your two-step sign-in secret, session cookies, recovery codes and chat app sign-ins. We cannot guarantee that the Service is free from unauthorized access.

If a breach of security affects your Personal Data, we will email you without undue delay. Where the breach involves Personal Data from the European Union, we will notify the competent supervisory authority within 72 hours of becoming aware of it, where the law requires. We will notify any other authority as Data Protection Law requires.

To report a security problem, write to support@bitight.com.

Our Security Statement describes who holds what in the Service and the steps you must take to protect your Account.

The Service is not intended for anyone under 18, and we do not knowingly collect their Personal Data. If we learn that we hold Personal Data of a person under 18, we will delete it.

We set cookies only to keep you signed in. The Authentication Provider may set its own cookies during sign-in.

Your browser also stores which wallet you connected, so it can reconnect, and a short record of any funding step you started, so the Service can complete it. It also keeps a step you signed to move USDC back to Your Wallet or to end an Agent's Limits, until its outcome is seen; new Limits you saved but did not sign, while the Agent is paused; and the pairing link, in that tab only, while you sign in. If you use the Wallet Connection Provider, it stores its own session in your browser.

We use no tracking, analytics or advertising cookies.

The cookies and browser storage in clauses 11.1 and 11.2 are strictly necessary to provide the Service, so we do not ask for consent to them. If you block them, you will not be able to sign in.

We do not track you across other websites. Do Not Track signals therefore do not change how the Service works.

We may change this Privacy Policy. The date at the top shows when it last changed.

We will give you at least 30 days' notice of a material change, by email to the address on your Account or in the Service, before it takes effect. A change required by law may take effect sooner.

Questions about your privacy: support@bitight.com.