Privacy Notice

Version 1.2.0 · Effective 2026-08-17 · Controller: Autoctavian LLC (operator of Cofferline)

This is a plain-English description of what Cofferline does with data. The operator is bootstrapped and has engaged no counsel. Where something is not yet built (for example a formal retention schedule), this notice says so.

Notice at collection (the short version)

Cofferline is an API. Your identity is a wallet address — there is no signup form and no email is collected. When your agent calls the API we record security and activity telemetry (see below) including the request's edge-derived IP address and a truncated user agent, and we store the treasury data you create (policies, delegations, ledger, balances) and any venue trade credentials you choose to submit (sealed, write-only). We use this to run the service you asked for, keep auditable books, detect abuse, and screen against sanctions/jurisdiction rules. On-chain transactions you authorize are permanent public records we cannot delete.

Who we are

The service is operated by Autoctavian LLC ("Cofferline", "we"). This notice is between you and Autoctavian LLC. Privacy contact: security@cofferline.com (also published in https://cofferline.com/.well-known/security.txt). Because a Cofferline account is a wallet with no email, to prove you control an account for a data request you can sign a challenge from POST https://api.cofferline.com/v1/auth/challenge with that wallet — the same SIWE mechanism you authenticate with. You do not need an email account to reach us or to verify yourself.

What we collect, and from where

• Wallet address — your identity (the account primary key). Supplied by you at sign-in.
• No email / contact. The account schema has an optional contact column, but no endpoint populates it today — we do not ask for or store email.
• Security & activity telemetry (audit log). For every authenticated request we record a durable audit fact — your wallet address, HTTP method, path, a request id, and the response status — in an append-only log. Each unsealing of a venue credential is also logged with the operation that used it (anomaly detection). The raw network context (the edge-derived client IP — connection-derived at the edge, not client-spoofable — and a truncated user agent, ≤200 chars) is stored separately and keyed to the request id, so it can be deleted on a short window without touching the immutable audit trail (see retention below).
• Authentication material. API-key and session tokens are SHA-256 hashed at rest (the plaintext is shown once and never stored). We keep each key's scopes and, if you set them, an optional source-IP pin and wallet pin.
• Treasury data you create. Policies (versioned, immutable), delegations, conversion/gas intents, the double-entry ledger, and balances.
• Payment data. Prepaid-balance credits, and auto-topup authorizations (the payer address, fixed value, nonce, and signature of each pre-signed USDC transfer). Prepaid USDC settles into the platform treasury — see the custody matrix.
• Venue trade credentials (optional). If you trade on Polymarket you may submit a credential. It is sealed with AES-256-GCM (tenant+venue-bound), write-only (no endpoint returns it), and stored in one table alongside non-secret display facts (e.g. maker address, signature type).
• Webhook configuration. Destinations you register and their per-account signing secret (the secret is stored unhashed because signing needs it).
• Statements. Deterministic monthly financial summaries for your wallets, exported immutably to object storage.
• Screening & jurisdiction signals. We screen counterparties against a sanctions (OFAC SDN) list held at the edge, and gate Polymarket surfaces by jurisdiction (mirroring the venue's own geo-restrictions).
• Support / feature requests. If you submit one, its content and your requester address (optionally forwarded to the operator's notification channel).

Why we process it

To do the things you call the API to do: enforce your policy, execute conversions and gas top-ups under your delegation, route prediction-market orders, keep the ledger and produce statements, fund the treasury and settle payments, and run the service reliably. Security telemetry supports abuse and anomaly detection (including credential-use volume alerts). Screening and jurisdiction data support sanctions and venue-eligibility compliance. We do not sell data and we run no advertising or third-party analytics.

Automated and rules-based decisions

Several decisions are made by code, server-side and deterministically: policy checks (an action beyond your active policy is refused, naming the rule), sanctions screening (a blocked counterparty), jurisdiction gating (Polymarket surfaces refused from restricted origins), and suspension / panic switches an operator can set. Refusals are typed and carry a remediation and a request_id. To ask a human to review one, contact the operator with the request_id.

Who receives data

• Venues and chains you choose. When you convert or trade, the trade details (token pair, amount, your address) go to the venue you selected (CoW, ParaSwap, Polymarket) and the transaction goes to the public blockchain.
• Public blockchains. Transactions you authorize are permanent, public, and irreversible on Base and Polygon. Deleting data from Cofferline does not, and cannot, remove an on-chain record.
• Webhook receivers you configure. These are recipients you direct us to send to; you control them.
• Legally compelled disclosure, where required.

The venues, chains, and webhook receivers are recipients you direct — data reaches them because of an action you took, not a choice we made for you.

How long we keep it

Purged on a schedule:

• SIWE auth nonces — 10-minute TTL, deleted about an hour after expiry.
• Sessions — 24-hour TTL, deleted after expiry.
• Idempotency keys — 7 days.
• Payment challenges — 1 day if unused, 7 days after use.
• Raw request network context (client IP + user agent) — 90 days. These now live in a store separate from the audit log and are deleted by the hourly housekeeping sweep once they pass the window. The durable audit fact they were keyed to (your address, the time, the operation, the request id, and the status) remains.
• Coordinator outbox rows — 14 days; sealed signed-transaction envelopes are compacted to a hash after 90 days.
• Terminal auto-topup signatures — cryptographically shredded once an authorization is settled, failed, or expired.
• Dev-environment test accounts — 7 days.

Retained as long as your account is open, then handled by offboarding: your account row and its treasury records, sealed venue credentials, and statement exports. When you offboard (see Your choices), API keys and sessions are revoked, delegations are flipped to revoked with on-chain unwind calldata, every venue credential's ciphertext is zeroed, auto-topup arrows are removed with cancellation instructions, the webhook secret and dead-letter bodies are deleted, your optional contact field is scrubbed, and your statement exports are deleted by the housekeeping sweep. Statement objects are safe to delete because they are deterministic re-derivations of the ledger, not the source of truth.

Retained permanently, by design: the append-only ledger, events, policies, and the audit facts described above — these are the double-entry books and the security/accountability trail, and offboarding does not erase them. Your account row itself is retired in place, not deleted, because those immutable books reference it. Anything already on a public blockchain is permanent and outside our control. The platform's edge request logs are governed by the hosting provider's native log retention.

Your choices

• Revoke API keys (DELETE https://api.cofferline.com/v1/keys/{id}); sessions expire on their own.
• Revoke a delegation on-chain from your owner key — your own transaction, no Cofferline cooperation needed.
• Revoke a venue credential — the ciphertext is zeroed; rotate a Polymarket signer with the calldata from GET https://api.cofferline.com/v1/pm/credentials/{id}/rotation, which you execute yourself.
• Cancel a payment authorization on-chain (cancelAuthorization) — unilateral.
• Export all your data — GET https://api.cofferline.com/v1/account/export returns a complete, versioned JSON snapshot of everything your account holds (profile, keys/session metadata, policies, delegations, intents, ledger, balance, events, webhook config, auto-topup and venue-credential metadata, PM orders/positions, audit records, and a statement-object manifest). It never returns secret material — no token plaintext, no sealed ciphertext, no signatures. Authenticating is the wallet proof; the response is scoped to your account only.
• Offboard (close) your account — POST https://api.cofferline.com/v1/account/offboard, echoing your own wallet address to confirm. This revokes every credential, zeroes venue-credential ciphertext, removes auto-topup arrows (returning the cancelAuthorization material — deleting our copy does not revoke the on-chain authorization), deletes the webhook secret and dead-letters, scrubs your contact field, deletes your statement exports, and retires your account. Export first if you want a copy.
• Access or deletion request — the two endpoints above are self-service; you can also contact us, verifying with a wallet signature as above. Limits: append-only records (audit facts, ledger, policies, events) and anything already on a public blockchain cannot be erased, and your account row is retired in place rather than deleted because the immutable books reference it.

Where processing happens

The primary database and secret storage are hosted in the United States; compute and storage run on a global edge network. Venues, RPC endpoints, and public blockchains are global services.

Security

Venue credentials and sealed transaction envelopes are AES-256-GCM encrypted; credential and session tokens are hashed at rest; the runtime database role is DML-only and cannot alter append-only, trigger-protected tables; secrets are never in the repository. No system is perfectly secure and we make no absolute guarantee.

Age

Cofferline is infrastructure for autonomous agents and their operators, not a service directed at children, and is not intended for anyone under 18.

Changes

Material changes bump the version and effective date in the header above; the current version and links are also carried in the agent manifest (https://cofferline.com/.well-known/cofferline.json).