Privacy Policy

The Service collects some Data from its users. This policy covers zipviz.ai, the registry API at api.zipviz.ai, and the zipviz-mcp software package.

Registration collects only your agent's name and public key, and both are published so anyone can check its signatures. We never receive your private key. We do not sell personal information, and we do not use advertising or cross-site tracking.

Elusor Pty Ltd ("ZipViz", "we", "us").

Types of Data collected

The types of Data the Service collects, by itself or through third parties, are:

• Registry data: .viz name, Ed25519 public key, agent card, registration time, verification and trust-badge status
• Invite data: a one-way hash of the invite code used, which identity redeemed it, and when
• Behavioral signals: categories, e.g. signed requests and verification checks involving the identity
• Account data: email address and user identifier from our sign-in provider, and the name you reserved
• Mailing list data: name and email address
• Security report data: what you report and, if you choose, how to reach you
• Contributor data: GitHub username, CLA version and date, if you contribute to our open-source projects
• Usage Data: IP address and basic request details

You provide most Personal Data freely. Usage Data is collected automatically when you use the Service.

Unless stated otherwise, the Data we ask for is needed to provide the Service. Without it we may not be able to provide it. Where we say Data is optional, you can choose not to give it without affecting the Service.

If you are unsure which Personal Data is required, contact us.

We use only the cookies needed for sign-in sessions. We do not use advertising or cross-site tracking cookies.

You are responsible for any third-party Personal Data you obtain, publish or share through the Service, including in your .viz name or agent card.

What is public

The registry exists so that anyone, human or agent, can look up an identity and check it. The following are published at api.zipviz.ai and on zipviz.ai, can be read by anyone without signing in, and may be copied, cached or indexed by others:

• the .viz name and its public key
• the agent card, including any endpoint or capability details the owner publishes
• verification status and trust-badge status

Do not put personal information in your .viz name or agent card. Names like firstname.lastname.viz identify a person. Once something is public, we cannot pull back copies others have already made. Agent names are permanent on chain, so choose wisely.

Your private key is generated on your device. We never receive it and cannot recover it.

Mode and place of processing the Data

Methods of processing

We take appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of the Data, including access controls, encryption in transit, and signed requests at every trust boundary.

The Data is processed using computers and IT tools, following procedures strictly related to the purposes stated. Apart from us, the Data may in some cases be accessible to people involved in running the Service (administration, legal, system administration) or to external parties (such as technical service providers and hosting providers) appointed, where needed, as Data Processors. You can ask us for the current list at any time.

Place

The Data is processed on servers in California, USA, and wherever the parties involved in processing are located.

Retention time

Unless stated otherwise in this document, Personal Data is processed and stored for as long as the purpose it was collected for requires, and may be kept longer because of a legal obligation or with your consent.

The purposes of processing

We collect Data about you so we can provide the Service, comply with our legal obligations, respond to enforcement requests, protect our rights and interests (or those of our users or third parties), and detect malicious or fraudulent activity, as well as for running the public registry, sign-in, managing the mailing list, rate limiting and security, handling security reports, and recording open-source contributions.

We do not use your Data for advertising or profiling.

Detailed information on the processing of Personal Data

Our providers use tag management and marketing services.

Registry, API and rate limiting

Cloudflare (Cloudflare, Inc.): API hosting, database, DNS and rate limiting.
Personal Data processed: registry data, invite data, Usage Data.

IP addresses are the key for rate limiting on the public API (30 requests per 60 seconds). Rate-limit counters last about a minute. Failed invite-code attempts are counted against a hashed client address for a 10-minute window, then deleted.

Constellation Network: we may anchor cryptographic fingerprints (hashes) of registry events on a public ledger as tamper evidence. Fingerprints contain no readable personal information, but a ledger entry cannot be deleted.

Sign-in and name reservations

Auth0 (Okta, Inc.): sign-in.
Personal Data processed: email address, user identifier.

Upstash (Upstash, Inc.): stores name reservations.
Personal Data processed: reserved name, user identifier.

Mailing list

beehiiv (beehiiv Inc.): manages our mailing list and sends emails.
Personal Data processed: name, email address. beehiiv tracks email opens and clicks.

Security reports

Cloudflare Turnstile: checks that a security report is not from a bot.
Personal Data processed: Usage Data.

Linear (Linear Orbit, Inc.): stores security reports as issues in a private project.
Personal Data processed: report content, and contact details if you give them.

Software distribution and open-source contributions

npm and GitHub (GitHub, Inc.): distribute the zipviz-mcp package and host our open-source code. Their own privacy policies apply to downloads and to your GitHub account.

Our CLA bot provider records your GitHub username, the CLA version and the date when you accept our Contributor License Agreement.

The zipviz-mcp package

The zipviz-mcp package does not collect telemetry or usage analytics, and has no install-time scripts. It makes network requests only when you or your agent use one of its tools, and only to:

• api.zipviz.ai, to look up agent cards, verify signatures and check trust-badge status
• the endpoint of another agent you choose to contact
• a relay target, if you configure one

Those requests reach our API like any other and are handled as described under "Registry, API and rate limiting". If this ever changes, we will document it in TELEMETRY.md and here first, and any new telemetry will be off unless you turn it on.

We do not sell, rent or trade personal information.

Further information for users

Legal basis of processing

We may process Personal Data about you if one of the following applies:

• you have given consent for one or more specific purposes (for example, the mailing list)
• providing the Data is necessary to perform an agreement with you or for pre-contractual steps (for example, registration and sign-in)
• processing is necessary to comply with a legal obligation we are subject to
• processing is related to a task carried out in the public interest or in the exercise of official authority vested in us
• processing is necessary for our legitimate interests or those of a third party (for example, rate limiting, security, and keeping the public registry trustworthy)

We are happy to help clarify the legal basis that applies, and in particular whether providing Personal Data is a legal or contractual requirement, or needed to enter into a contract.

Retention

• Registry records (name, public key, status): for as long as the identity is registered. When an identity is deleted we may, at our discretion, stop its name from being registered again, so it cannot be used to impersonate the previous holder.
• Invite records: for as long as the identity they created exists.
• Accounts and reservations: until you ask us to delete them.
• Mailing list: until you unsubscribe.
• Rate-limit counters: about one minute. Failed invite attempts: 10 minutes.
• Operational logs: kept by our hosting providers in line with their own retention policies.
• CLA records: for as long as we distribute software containing your contribution.

We may keep Personal Data longer if you have consented and not withdrawn consent, or if a legal obligation or an authority requires it.

When the retention period ends, the Personal Data is deleted. After that, the rights of access, erasure, rectification and data portability can no longer be exercised.

Deleting an identity

You can ask us to delete a .viz identity you control. We will ask you to prove control, usually by signing a challenge with its key. Deleting an identity removes it from the public registry. It cannot remove copies third parties have already made, or ledger fingerprints. If you think a .viz name impersonates you or your organization, see the name-dispute process in our Terms.

Users in the EU and UK: your rights under the GDPR

You may exercise certain rights over Data we process. In particular, to the extent permitted by law, you have the right to:

• Withdraw consent at any time, where you gave consent to processing.
• Object to processing, where processing is on a legal basis other than consent.
• Access your Data: learn whether we process it, get disclosure about aspects of the processing, and get a copy.
• Verify and seek rectification: check the accuracy of your Data and ask for it to be updated or corrected.
• Restrict processing, in which case we will only store your Data.
• Have your Personal Data deleted.
• Receive your Data and have it transferred to another controller, in a structured, commonly used, machine-readable format, where technically feasible.
• Lodge a complaint with your data protection authority.

You are also entitled to learn the legal basis for Data transfers abroad, including to any international organization, and about the security measures we take to safeguard your Data.

Details about the right to object

Where Personal Data is processed in the public interest, in the exercise of official authority vested in us, or for our legitimate interests, you may object to that processing by giving a ground related to your particular situation.

If your Personal Data is processed for direct marketing (our mailing list), you can object at any time, free of charge and without giving a reason, and we will stop.

How to exercise these rights

Send any request to us using the contact details in this document. Requests are free of charge and we will answer as early as possible, and always within one month. We will tell each recipient of your Data about any rectification, erasure or restriction, unless that is impossible or involves disproportionate effort. If you ask, we will tell you who those recipients are.

Users in the United States

We do not sell your Personal Information, share it for cross-context behavioral advertising, or use it for targeted advertising.

Depending on your state, you may have the right to know, access, correct and delete your Personal Information, to get a copy in a portable format, and not to be discriminated against for exercising these rights. To exercise them, contact us using the details in this document. We will need to verify your identity before acting, and will use any information you give us for verification only for that purpose. We will respond within the time the law requires.

Additional information about Data collection and processing

Legal action

We may use your Personal Data for legal purposes in court, or in the steps leading to possible legal action, arising from improper use of the Service.

You acknowledge that we may be required to disclose Personal Data at the request of public authorities.

Additional information about your Personal Data

On request, we may give you additional, contextual information about particular services or about the collection and processing of Personal Data.

System logs and maintenance

To run and maintain the Service, we and third-party services may collect files that record interactions with the Service (system logs) or use other Personal Data (such as IP address) for this purpose.

Information not in this policy

You can ask us for more details about the collection or processing of Personal Data at any time, using the contact details at the start of this document.

Changes to this privacy policy

We may change this privacy policy at any time. We will tell you by posting the change on this page and updating the date above, and, for material changes, by notice on this site before they take effect. Please check this page often.

If changes affect processing based on your consent, we will ask for your consent again where required.

Definitions and legal references

Personal Data (or Data) / Personal Information: any information that, directly, indirectly or in connection with other information, including an identification number, allows a natural person to be identified or to be identifiable. A .viz name or agent card can be Personal Data if it identifies a person.

Sensitive Personal Information: Personal Information that is not publicly available and that applicable privacy law treats as sensitive.

Usage Data: information collected automatically through the Service, which can include the IP addresses or domain names of the computers used, request URIs, the time of the request, the method used to submit it, the size of the response, the response status code, country of origin, browser and operating system features, and similar details.

User: the individual using the Service who, unless stated otherwise, is the Data Subject.

Data Subject: the natural person the Personal Data refers to.

Data Processor (or Processor): the natural or legal person, public authority, agency or other body that processes Personal Data for the Controller, as described in this policy.

Data Controller (or Owner): the natural or legal person, public authority, agency or other body that, alone or jointly, decides the purposes and means of processing Personal Data, including the security measures for running and using the Service. Unless stated otherwise, the Data Controller is Elusor Pty Ltd.

Service: zipviz.ai, api.zipviz.ai and the zipviz-mcp package, as described in our Terms.

European Union (or EU): unless stated otherwise, references to the EU include all current EU member states and the European Economic Area.

Cookie: a Tracker consisting of a small set of data stored in your browser.

Tracker: any technology, such as Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting, that enables tracking of users, for example by accessing or storing information on your device.