Privacy policy

This privacy policy explains how OpenUSDC, Inc. ("OpenUSDC", "we", "our", "us") collects, uses, retains, and protects personal data when you visit openusdc.ai, when you use our self-hosted gateway and SDKs, and when you sign up for our hosted OpenUSDC Cloud control plane. We have written it in plain English on purpose. If anything below is unclear, write to privacy@openusdc.ai and we'll do our best to clarify.

Who we are

OpenUSDC is a Delaware C-corp with its principal place of business in New York. We act as the data controller for personal data collected through our marketing site and our hosted Cloud service, and as a data processor for personal data you choose to push into Cloud as part of operating your gateway. Our EU representative is Prescient Privacy GmbH, contactable at openusdc@prescient-privacy.eu.

The short version

• We collect what we need to operate the site and the Cloud service, and not much else. We do not sell personal data, ever.
• The gateway and SDKs do not phone home. They run entirely under your control.
• Cloud workspace data is encrypted at rest with AES-256-GCM and in transit with TLS 1.3.
• We retain audit logs for one year, billing records for seven years (because we have to), and most other personal data for the lifetime of your account plus 30 days.

Categories of data we collect

We group personal data into five categories. The category determines how long we keep it, who at OpenUSDC can see it, and what we do with it.

1. Account data

If you sign up for an OpenUSDC Cloud account, we collect your name, email address, password hash (Argon2id), workspace name, and any optional profile information you provide. We also collect technical metadata about the account — when it was created, when it was last used, what plan it is on.

2. Operational data

When you operate the gateway and connect it to Cloud, we collect settlement metadata your gateway pushes to us: the route a payment settled against, the chain it settled on, the destination wallet address, the amount, the trace ID, and the signed receipt. We do not see the contents of the underlying request or response — only the metadata used to reconcile and report on payments.

3. Telemetry

We collect aggregate usage telemetry about Cloud — page loads, response times, error counts. We use Plausible Analytics, which is cookieless and does not collect IP addresses in any form we can read.

4. Communications data

When you write to us — support tickets, sales conversations, security disclosures — we keep the threads and any attachments. We use Front for shared inboxes and Linear for tracking engineering work.

5. Marketing data

If you opt in to our newsletter, we keep your email address and the history of which issues we sent you. We use Buttondown. You can opt out from the footer of any newsletter or by emailing privacy@openusdc.ai.

Why we process this data

Under GDPR, every category above maps to a lawful basis we have documented. Most of it is justified by the contract you have with us (operating Cloud) or by our legitimate interest in running a stable, secure service. Marketing communications are sent only with your opt-in consent.

• Performance of a contract — account data, operational data, communications about your account.
• Legitimate interests — telemetry, abuse prevention, security monitoring, audit logs.
• Consent — marketing emails, voluntary product research interviews.
• Legal obligation — financial recordkeeping under U.S. and EU tax law, sanctions screening when applicable.

Who we share data with

We share personal data with a small number of vendors who help us operate the business. Each one is bound by a contract that requires them to handle your data only on our instructions and to a security standard at least equal to our own. The current list is:

• Amazon Web Services — primary cloud hosting (us-east, eu-west, ap-southeast)
• Cloudflare — edge network and DDoS protection
• Stripe — billing and tax reporting for Cloud subscriptions
• Front — shared inbox for customer support
• Buttondown — newsletter delivery
• Plausible — privacy-respecting site analytics
• Linear — engineering project tracking
• 1Password — internal credentials

We do not share personal data with any other third party. We do not sell personal data. We do not allow advertisers to track you on our site, because we do not run advertising on our site.

Where we keep data

Primary storage is in the AWS region your workspace is assigned to — us-east-1, eu-west-1, or ap-southeast-1. Backups are encrypted and stored in the same region. We never replicate workspace data outside its assigned region. International transfers (for example, our team in Tokyo accessing logs of a workspace in eu-west) are governed by Standard Contractual Clauses with appropriate supplementary measures.

How long we keep data

• Account data — for the lifetime of your account plus 30 days
• Operational ledger data — per your Cloud plan (30 days on Starter, 13 months on Growth, custom on Enterprise)
• Telemetry — 30 days, anonymized
• Audit logs — 12 months
• Communications — 24 months after the conversation closes
• Billing records — seven years, as required by U.S. tax law

Your rights

You have the right to access, correct, export, and delete the personal data we hold about you. You also have the right to object to processing based on our legitimate interests, to restrict processing, and to lodge a complaint with your data protection authority. To exercise any of these rights, write to privacy@openusdc.ai. We verify identity before acting on a request and aim to respond within 14 days.

Cookies

We use a single first-party session cookie on the marketing site and in Cloud. We do not use third-party cookies, advertising pixels, or cross-site tracking. Our cookieless analytics provider is Plausible (open-source, EU-hosted).

Security

Hosted Cloud data is encrypted at rest with AES-256-GCM and in transit with TLS 1.3. Engineering access uses single sign-on with FIDO2 keys; production access uses short-lived, purpose-scoped credentials recorded in our audit log. We publish independent audit reports under /security.

Children

OpenUSDC is not intended for children under 16, and we do not knowingly collect personal data from children. If you believe a minor has provided us with data, write to privacy@openusdc.ai and we'll remove it.

Changes to this policy

We may update this policy when we add features, change vendors, or when the law changes. Material changes are posted here and announced in our changelog at least 14 days before they take effect.

How to reach us

Email privacy@openusdc.ai, or write to OpenUSDC, Inc., 150 Greenwich Street, 36th Floor, New York, NY 10006, USA. Our EU representative is Prescient Privacy GmbH, Friedrichstraße 68, 10117 Berlin, Germany.