Agent Offers

Privacy Policy

Effective 2026-09-29

This policy explains what Agent Offers, operated by Active Life Hub LLC, processes and why. Agent Offers is a business-to-business service for publishing commercial offers; it has no user accounts, no advertising, no analytics trackers and no cookies.

1. What we process

  • Seller submissions: the URLs and offer information you send (product, prices, terms, endpoints, contact-free business data). Do not include personal data you do not want published: published Offers are public.
  • Public source data: content retrieved from URLs you point us to (your pages, llms.txt, OpenAPI, agent cards) and the unpaid response of your purchase endpoint. We keep the facts extracted from them, short verbatim excerpts, content hashes, status codes and timestamps as evidence — not full copies of pages.
  • Payment metadata: for paid revisions, the payer wallet address, amount, network, a hash identifying the payment authorization (for replay protection) and the settlement transaction hash. We never receive private keys or recovery phrases. Payments are public on the blockchain by nature.
  • Management keys: not stored. Keys are derived cryptographically when needed; only a key version number is stored.
  • Domain-authority checks: the domain, method and time of a successful check.
  • Technical logs: our hosting provider records standard request logs (IP address, time, path, status) for security and operations, retained according to its standard retention. Rate limiting uses a hashed IP in short-lived process memory only.

2. Why

To provide the Service you request (building, validating, signing, publishing and serving Offers), to take payment and prevent payment reuse, to keep accounting records, and to protect the Service against abuse.

3. Who processes it (subprocessors)

  • Vercel Inc. — hosting, CDN, serverless functions, and Vercel Blob storage for published Offers.
  • Neon (PostgreSQL) — storage of offer revisions and payment records.
  • Coinbase Developer Platform — x402 payment verification and settlement.
  • Cloudflare and Google public DNS resolvers — DNS-over-HTTPS lookups for domain-authority checks (they see the domain name queried).

No language model, translation service or search provider receives your data. These providers may process data in the United States and other countries.

4. Retention

  • Unpublished drafts: deleted 30 days after the last change.
  • Withdrawn Offers: deleted 90 days after withdrawal (they stop being served as active immediately).
  • Expired Offers: deleted 90 days after their validity date.
  • Offers not refreshed for 180 days after becoming stale: deleted.
  • Payment records: kept for accounting after the Offer is deleted.

Deletion happens lazily when the Service is next used for a paid revision or deployed (we run no scheduled jobs), so it can occur somewhat later than the dates above. Copies you or others downloaded or hosted elsewhere are outside our control.

5. Security

Secrets stay server-side; identifiers and keys are protected with message authentication codes; Offer documents are signed; retrieval refuses private and internal network addresses; storage is encrypted by our providers. No system is perfectly secure.

6. Your choices

You can pause or withdraw an Offer at any time with its management key. To ask about data relating to you, or for deletion ahead of the schedule above, contact us using the contact details that will be published on this page. Depending on where you are, you may have legal rights to access, correct or delete personal data; we will respond as required by applicable law.

7. Changes

We will update the effective date above when this policy changes.