What we hold about you, and why.
Written to be read rather than clicked past. Where we do not know something yet, it says so, because a privacy notice that guesses is worse than none.
UIE Ltd, trading as WorldAuth, is the controller: a company registered in England and Wales with its registered office at 66 Paul Street, London EC2A 4NA. The controller is reachable at hello@worldauth.com.
| What | When | Why (basis) | Kept for |
|---|---|---|---|
| Name, work email, company, role, and what you wrote | When you submit a pilot, certification or general enquiry | To answer you. Legitimate interest in responding to a business enquiry you initiated. | 24 months from the last contact, or until you ask us to delete it, whichever is first. |
| A sandbox key, its tier, and a monthly count of machine requests | When you issue a key and use it | To enforce the allowance you were given. Legitimate interest in running the service. The key is not linked to a name unless you gave us one. | Usage counts, 13 months. Keys, until disabled. |
| Escrows you open in the sandbox: asset, amount, the payer and payee strings you supplied | When you call lock_escrow | To run the sandbox. Synthetic value only; no money moves. Do not put personal data in payer, payee or memo fields. | 90 days after the escrow deadline. |
| Your network address, approximately, and request timing | On every request | Rate limiting and abuse prevention. Legitimate interest. Held in memory on the server for at most ten minutes; not written to a database. | Minutes. |
| The URLs you ask the intent endpoint to read | When you call dmi_discover, dmi_query or dmi_plan | To perform the read you asked for. We fetch them and do not store them. Server logs on our hosting provider may retain request paths for a short period under their own terms. | Not stored by us. |
- No analytics scripts, no advertising pixels, no cookies except what the hosting platform sets for deployment protection.
- We do not sell, rent or share enquiry data with anyone. Nobody else sees it.
- We do not profile you, score you, or make automated decisions about you.
- Enquiries, keys, usage and sandbox escrows: a Postgres database hosted by Supabase in the EU (London region).
- The site and API: Vercel, serving from the US East region. Requests to the API transit there.
- Both providers process data under their own published terms; neither is given your enquiry to read.
You can ask what we hold about you, ask us to correct it, ask us to delete it, or object to our holding it. Write to hello@worldauth.com from the address we hold and we will act within 30 days. If you are in the UK you can complain to the Information Commissioner’s Office; in the EU, to your national authority. We would rather hear from you first.
Last changed on the date of the commit that produced this page; see the changelog. Changes to what we collect are listed there rather than silently applied.