Operative notice · version 1.2 · 14 September 2026
Privacy notice
This notice covers councilof.ai under the UK GDPR and the Data Protection Act 2018. It describes only the processing our code actually does.
Controller and contact
CSOAI Ltd, a private limited company registered in England and Wales, Companies House No. 16939677. Registered office: 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom. Privacy requests: nicholas@csoai.org.
Unavailable witness service
The public paid-witness endpoint currently returns HTTP 503 before it reads a submitted URL, hash or body, verifies a payment, or writes a queue entry. The retained queue code is not the public handler and does not describe current processing.
What we hold, why, and for how long
x402 payment records: the settlement transaction hash, the payer wallet address, network, amount, the resource paid for, and time.
Where: functions/api/_x402.ts and _x402_receipt.ts write them to our Cloudflare KV store (settled:tx:*, receipts by transaction and by payer). /api/receipts?payer= is a public lookup: anyone who supplies a valid payer address can read the receipts indexed under it. It does not authenticate ownership of that address.
Lawful basis: Contract (supplying what was paid for); legal obligation (accounting records); legitimate interests (preventing a payment being replayed).
Retention: No automatic expiry. We keep records for the applicable contract, dispute and accounting period. UK company-tax records are normally kept for six years after the end of the accounting period and may need to be kept longer. An erasure request does not override a legal duty to retain a record.
Contact and lead submissions: the email address, name, subject, message, and any report or service reference you enter.
Where: functions/api/contact.ts and lead.ts write them to KV (LEADS). Measurement-intake requests (functions/api/evidence-intake.ts) are stored the same way.
Lawful basis: Steps you ask us to take before a contract; legitimate interests (answering you).
Retention: No automatic expiry. We delete it when the enquiry is closed and there is no continuing need, or on a valid erasure request where no exemption applies.
Email you send to nicholas@csoai.org.
Where: Our mailbox provider (Namecheap Private Email).
Lawful basis: Legitimate interests; steps before a contract.
Retention: Until the conversation is finished and any follow-on record is no longer needed.
Workspace accounts, if you register: email, name, a salted password hash, and when the account was made.
Where: functions/api/auth writes them to KV (SOV_ARENA_STATE). No password is stored in readable form.
Lawful basis: Contract (providing the account).
Retention: For the life of the account; deleted on a valid erasure request where no exemption applies.
Request logs: IP address, user agent, URL and time of each request.
Where: Cloudflare processes these to serve and protect the site. Our own functions do not write IP addresses or request logs to storage.
Lawful basis: Legitimate interests (running and securing the service).
Retention: Under Cloudflare's own retention; we keep no copy.
Public blockchains and public evidence
x402 payments settle on the Base blockchain. The transaction hash and payer address are public on that chain whatever we do, and we cannot delete them from it. Public measurement records are meant to be inspectable and durable. Private submissions and account data do not go into them unless you have agreed that in advance. A signature proves who wrote a record and that it is unchanged. It does not change the privacy status of the data in it.
Analytics and cookies
The site stores your cookie choice in your browser. The analytics component runs only when an analytics endpoint is configured and you have accepted analytics in the consent banner.
Who else processes it
Cloudflare hosts the site, runs its functions and provides the KV store. A payment facilitator verifies and settles x402 payments. Namecheap Private Email carries email. Some of these providers may process data outside the UK, under their own transfer safeguards. We sell no personal data and share it with no one else unless the law requires it.
Your rights
You can ask for access, correction, deletion, restriction or a portable copy of your data. You can object to processing based on legitimate interests, and withdraw consent at any time. Write to nicholas@csoai.org. We normally answer without undue delay and within one calendar month. For a complex request, or several requests made together, the law may allow up to two additional months; if we need that extension, we will tell you within the first month and explain why. A right such as erasure can be limited by a legal obligation or another applicable exemption. If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint.
Public evidence is a separate boundary
Measurement, not certification. This notice is about personal data. It says nothing about the quality of any measured system.
