visitor@x402card:~$ privacy

Privacy notice

x402card processes the minimum operational data needed to authenticate wallets, settle x402 payments, issue or fund provider cards, fulfill prepaid travel eSIMs, deliver credentials privately, reconcile money states, prevent abuse, and respond to security incidents.

Effective: 2026-07-12. This notice describes the current technical service and will be updated before broader card issuance if operator or jurisdiction-specific disclosures require it.

Data processed

• Wallet addresses, signed authentication messages, session identifiers, scopes, and timestamps.
• x402 order, payment requirement, settlement, transaction, amount, asset, network, and status records.
• Provider card identifiers, masked card metadata, funding identifiers, fees, and status. x402card does not store full PAN or CVV.
• eSIM order identifiers, selected plan details, fulfillment state, ICCID, and encrypted installation credentials. Raw delivery tokens are not stored.
• Security and audit records, which can include hashed IP address or user-agent evidence for product interactions and sensitive credential actions.
• First-party product events such as page view, wallet connect, issue, eSIM purchase, payment, funding, and reveal outcomes. Event names and properties are allowlisted; raw terminal input, wallet addresses, IP addresses, user agents, signatures, tokens, PAN, CVV, QR/LPA data, and ICCIDs are not stored in product analytics.
• Standard web-server logs needed for availability, abuse prevention, and incident investigation.

Product-event retention

Privacy-safe product events expire after 90 days by default. Financial, security, and card-access audit records can be retained longer where needed for accounting, dispute handling, abuse prevention, or legal obligations.

Why it is processed

Data is used to deliver requested functions, prove wallet ownership, prevent replay and double processing, maintain accounting evidence, reconcile provider outcomes, protect the service, and meet applicable operational or legal obligations.

Service providers and public chains

Payment and card operations can involve Base, the x402 facilitator infrastructure, VALUT, and hosting/network providers. Blockchain transactions are public and cannot be deleted by x402card.

Retention and security

Operational and accounting records are retained only as needed for the service, reconciliation, security, dispute handling, and applicable obligations. Access to production systems and sensitive provider operations is restricted. No system is risk-free; users must protect wallet keys and verify every signature.

Your choices

You may stop using the service and revoke an active session through the product flow. Blockchain settlement evidence and records required for integrity, accounting, security, or legal reasons may not be erasable.

Questions and sensitive reports

Send privacy questions to privacy@x402card.org. Send vulnerabilities or sensitive data only to security@x402card.org.