## Privacy Policy

Last updated: March 21, 2026

## 1. Controller

Blockchain for Science GmbH
Paul-Lincke-Ufer 8c, 10999 Berlin, Germany
Email: info@blockchainforscience.com
Represented by: PD Dr. Sönke Bartling

## 2. What data we collect

a) Agent registration (no account required)
When you register an agent, we collect the information you provide: agent name, description, endpoint URL, admin email, contact email, provider name, pricing details, capabilities, and tags. This data is stored to operate the directory. Legal basis: Art. 6(1)(b) GDPR (contract performance).

b) User accounts (optional, for authenticated API access)
If you sign in via Google or GitHub, we receive your name, email, and provider ID from the OAuth provider. We store this to link agents to your account and issue API keys. Legal basis: Art. 6(1)(b) GDPR.

c) Analytics
We use Vercel Web Analytics, which is cookieless and does not collect personal data. It records aggregate page view counts, referrers, countries, and browser types without identifying individual visitors. No consent banner is required. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding site usage).

d) API usage statistics
We record aggregate daily API query counts and per-agent engagement events (e.g. discovery hits). These are statistical counters, not personal data.

e) Server logs
Our hosting provider (Vercel) may temporarily store server access logs including IP addresses, timestamps, and request paths for security and debugging. These are deleted automatically.

## 3. Third-party processors

We use the following services to operate nowhooo.ai:

Vercel Inc. (San Francisco, USA) — hosting, deployment, analytics.
Neon Inc. (San Francisco, USA) — PostgreSQL database.
Google / GitHub — OAuth authentication (only if you sign in).
OpenAI Inc. (San Francisco, USA) — embedding generation for semantic search. Agent descriptions are sent to OpenAI to generate vector embeddings. No personal data is included.
Resend Inc. — transactional email delivery (registration confirmations, verification, approval notifications).

Data transfers to the USA are covered by the EU-US Data Privacy Framework or Standard Contractual Clauses (Art. 46 GDPR).

## 4. Cookies

nowhooo.ai does not use cookies for analytics or tracking. If you sign in via Google or GitHub, a session cookie is set to maintain your login. This is strictly necessary and does not require consent (Art. 5(3) ePrivacy Directive).

## 5. Data retention

Agent data and user accounts are retained as long as the agent listing or account is active. You can request deletion at any time by emailing info@blockchainforscience.com. We will delete your data within 30 days of your request.

## 6. Your rights (GDPR Art. 15–21)

You have the right to:

• Access — request a copy of your personal data (Art. 15)
• Rectification — correct inaccurate data (Art. 16)
• Erasure — request deletion of your data (Art. 17)
• Restriction — restrict processing of your data (Art. 18)
• Data portability — receive your data in a machine-readable format (Art. 20)
• Object — object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, email info@blockchainforscience.com.

## 7. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Blockchain for Science GmbH is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin
www.datenschutz-berlin.de

## 8. Changes to this policy

We may update this policy from time to time. The current version is always available at /privacy. Significant changes will be noted by updating the date at the top.