1. Who we are
Squid builds financial infrastructure for AI agents. Squid Gateway is the part that lets API providers sell per-request access to agents. Squid is non-custodial: we never hold the funds that move between agents and providers.
2. What we collect
Provider account data
- Email address and sign-in data (through Supabase Auth), display name, and team members' email addresses and roles
- API settings: names, descriptions, base URLs, endpoints, prices, logos, networks and payout wallet addresses
- Upstream API credentials, stored encrypted (AES-256-GCM) and never shown again, even to you
- API keys, stored only as one-way hashes; webhook URLs and an encrypted signing secret
- Preferences such as theme and email alerts
Gateway traffic data
- For each request: API, endpoint path, method, status, outcome, error code, latency, timestamp and a request ID
- For each payment: amount, network, payer wallet address, payout address, status and on-chain transaction hash
- We do not store request or response bodies, headers, query strings, or the credentials agents send. If an upstream echoes a provider credential, we redact it.
Technical data
- IP address and user agent, used transiently for rate limiting and security, and kept in our hosting provider's logs for a limited time
We do not collect passwords for other services, private keys, seed phrases or card numbers. Never send them to us. When you verify a payout wallet, you sign a message in your own wallet; we only store the resulting address and time.
3. How we use it
- To run the service: authenticate you, forward paid requests, verify payments and show your requests, transactions and customers
- To send what you asked for: webhooks, email alerts and team invitations
- To keep Gateway secure: prevent abuse, fraud, replayed payments and attacks on upstream APIs
- To communicate about your account and the beta, and to improve the product
4. Public and on-chain information
- Published APIs (name, description, logo, endpoints, prices, payout address and networks) are public in the catalog and its JSON feed.
- Payments are recorded on public blockchains. Wallet addresses, amounts and transaction hashes are visible to anyone and cannot be deleted by us or anyone else.
- Providers can see the wallet address and payment history of agents that paid their APIs.
7. Retention
- Account and API data: while your account exists. Deleting an API removes its stored credential immediately.
- Request and payment records: kept for your reporting and our legal and accounting obligations, then deleted or anonymised.
- Webhook delivery logs: about 30 days.
8. Your choices and rights
You can access, correct, export or delete your data, or object to how we use it, by emailing hello@squidbank.xyz. We may need to verify the request comes from your account's email. Depending on where you live, you may also complain to your data protection authority. On-chain data can't be deleted.
9. Security
We use HTTPS everywhere, encryption for credentials and secrets, hashed API keys, row-level security in the database, and strict controls on outbound requests. No system is perfectly secure. Report vulnerabilities to security@squidbank.xyz.
10. Children
Squid Gateway is for adults and businesses. We do not knowingly collect personal information from children under 16.
11. Changes
We may update this policy as the product grows. The “Last updated” date changes when we do, and we'll notify you of material changes.
12. Contact
- Privacy questions and requests: hello@squidbank.xyz
- Support: squidsupport@agentmail.to
This policy is written for a private beta. It is not legal advice; have counsel review it before a general launch, especially for GDPR and other regional requirements.