1. Who we are
The controller for personal data described in this policy is AffixIO, operating BoundProof Agent and related AffixIO services from the United Kingdom.
Contact for privacy requests: hello@affix-io.com
General contact: https://www.affix-io.com/contact/
Product site: https://boundproof.affix-io.com/
Where AffixIO later publishes a Companies House number or registered office on affix-io.com, that identity information applies to AffixIO as controller. Until then, use the email and contact routes above.
2. What this policy covers
This policy covers BoundProof Agent as a standalone service (workspaces, login, APIs, connectors, sandbox, receipt verification and documentation on boundproof.affix-io.com). It also covers personal data processed when you use AffixIO Hub, Stripe Checkout or api.affix-io.com in connection with BoundProof or AffixIO agent / proof products that reference BoundProof.
Related AffixIO pages such as the Trust Centre, Security and Compliance pages describe wider product posture. This BoundProof Privacy Policy stands alone for BoundProof; if wording conflicts on a BoundProof-specific point, this page prevails for BoundProof.
Our Terms of Service govern contractual use of the Services. This Privacy Policy explains personal data processing.
3. Personal data we collect
What we collect depends on how you use the Services.
Account and workspace data
- Username and workspace / company name you provide at registration
- Password (stored only as a salted one-way hash; we cannot read your password back)
- Session identifiers and CSRF tokens for signed-in owner sessions
- Timestamps for account creation and material workspace events
Agent, permission and decision data
- Registered agent names and technical agent identifiers
- Owner-granted permissions (merchant identifier, currency, amount limits, budgets, review thresholds, expiry and status)
- Action payloads submitted for evaluation (for example merchant, amount, currency, order reference and agent ID)
- Decision state (allow, deny, review, consumed), reasons, expiry and consumption timestamps
- Signed decision receipts (cryptographic attestations over decision payloads)
- Owner audit events describing workspace administration
API keys and connection material
- API key labels, scope (merchant or agent), status and creation time
- Hashes of API key secrets (the raw
bp_live_secret is shown once at creation and is not stored in recoverable form) - Connection setup metadata when you use the Connect an agent flow
Relay data (only if you turn on Relay)
- If you turn on Relay, we store your relay agents' encrypted signing keys, trusted senders, received requests including their parameters, and receipts until you turn Relay off.
- Requests your relay agents send, with the recipient address and the delivery result, and a workspace approver key used to sign your approvals (also encrypted).
- Relay requests are created and checked with single-use AffixIO proofs through api.affix-io.com. Proof references and digests appear in receipts. Please do not put secrets or personal data in request parameters.
Billing and Hub-linked data (when you use paid AffixIO surfaces)
- Billing contact details, plan selection and subscription status held in AffixIO Hub or billing records
- Payment card data is collected and processed by Stripe (or a successor Payment Processor), not stored as full card numbers by BoundProof
- Invoices, receipts and payment event metadata returned by the Payment Processor
The standalone BoundProof pilot workspace currently states that no subscription or card is taken on that pilot surface itself. Paid AffixIO / BoundProof Starter flows (for example Hub or Stripe Checkout advertised on AffixIO) may still process billing data when you start them.
Technical and security data
- Server access logs and security logs, which may include IP address, user agent, requested path, status code and approximate time
- Rate-limit and abuse-prevention counters
- Public key material for BoundProof’s ML-DSA-65 signing identity (not personal data)
Verification uploads
If you use the public receipt verifier, the receipt JSON is sent to the server to check the signature. The verification endpoint is designed not to save uploaded receipts. Do not upload unrelated personal data in verification payloads.
Sandbox
The public sandbox uses synthetic demonstration inputs. It issues demonstration signatures and does not save decisions into company workspaces.
What we ask you not to send
Do not submit card numbers, payment credentials, government identity numbers, special category data or unnecessary sensitive personal data into BoundProof fields. Prefer opaque order references over customer names or emails in action payloads where your integration allows it.
4. Purposes and lawful bases
Under the UK GDPR we rely on the following lawful bases.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide the Service | Create workspaces, authenticate owners, evaluate permissions, issue signed receipts, operate APIs and connectors | Contract (Art. 6(1)(b)) where you have an account or order; otherwise legitimate interests (Art. 6(1)(f)) in operating a B2B permission service |
| Security and integrity | Session cookies, CSRF protection, hashed API keys, rate limits, access logs, incident response | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable |
| Billing and subscription | Collect fees via Stripe, prevent fraud, keep tax and accounting records | Contract; legitimate interests; legal obligation for accounting where applicable |
| Support and product communication | Respond to hello@affix-io.com requests, service notices about material changes | Contract or legitimate interests |
| Improve and diagnose | Aggregate operational metrics, fix defects, understand feature reliability | Legitimate interests (Art. 6(1)(f)) |
| Legal claims and compliance | Respond to lawful requests, enforce Terms, defend claims | Legitimate interests; legal obligation where applicable |
Where we rely on legitimate interests, we balance those interests against your rights and expectancies, especially for B2B workspace operators. You may object to processing based on legitimate interests (see section 9).
We do not use BoundProof decision content to build advertising profiles, and we do not sell personal data.
6. Processors and recipients
We use service providers who process personal data on our instructions or as independent controllers for their own payment compliance duties.
- Stripe (or a successor Payment Processor) — payment collection for AffixIO / BoundProof paid plans when you start Checkout. Stripe’s own privacy notice applies to card data it processes.
- Hosting and infrastructure — the BoundProof application, database and logs run on AffixIO-operated servers (currently a dedicated VPS serving boundproof.affix-io.com).
- Email and support tooling — messages you send to hello@affix-io.com are processed to respond to you.
- AffixIO Hub / api.affix-io.com — when you link BoundProof use to Hub accounts, SDK proof allotments or agent provisioning on AffixIO’s main API, those systems process account and usage data under AffixIO’s wider operations.
We may disclose data if required by law, to protect rights and safety, or in connection with a corporate reorganisation, merger or sale, subject to appropriate safeguards.
Your merchant payment provider for end-customer transactions is separate and is not AffixIO. BoundProof does not take custody of end-customer card data for your checkout.
7. International transfers
AffixIO is based in the United Kingdom. Infrastructure and processors may be located in the United Kingdom, the European Economic Area or other countries.
Where personal data is transferred outside the UK to a country not covered by UK adequacy regulations, we use appropriate safeguards recognised under UK GDPR — typically the UK International Data Transfer Agreement / Addendum or equivalent contractual clauses — unless another lawful transfer mechanism applies.
Stripe and other global processors may process data in the United States or other regions under their own transfer mechanisms. Review their documentation when you use paid Checkout.
8. Retention
We retain personal data only as long as needed for the purposes above, including:
- Account and workspace records — for the life of the workspace and a reasonable wind-down period after closure or deletion request, unless longer retention is required by law or dispute
- Sessions — until expiry or logout; expired sessions are removed
- API key hashes — until revoked or the workspace is deleted
- Decisions and signed receipts — while the workspace exists and for a period needed for audit, dispute handling and product integrity; pilot workspaces may not have an automatic purge schedule
- Relay keys, inboxes and receipts: until you turn Relay off for that agent, when they are deleted straight away. A held request can be approved for up to 60 minutes after it arrives.
- Access and security logs — for a rolling operational window appropriate to security monitoring
- Billing records — for the period required for accounting and tax (often up to six years in the UK for certain records)
Public verification uploads are not designed to be retained by the verification endpoint. Sandbox demonstration decisions are not stored in company accounts.
To request deletion of a BoundProof workspace, email hello@affix-io.com. We may need to verify account ownership before acting. Some residual log or backup copies may persist for a limited time until rotated.
9. Your rights (UK GDPR)
Subject to exemptions and verification, you may have the right to:
- be informed about how we use your personal data (this policy)
- access a copy of your personal data
- rectify inaccurate personal data
- erase personal data in certain circumstances
- restrict processing in certain circumstances
- data portability for data you provided where processing is based on contract or consent and is automated
- object to processing based on legitimate interests
- not be subject to solely automated decisions producing legal or similarly significant effects — BoundProof permission outcomes for agent actions are tools for your workspace; you remain responsible for how you use them in your business
To exercise rights, contact hello@affix-io.com. We may ask for information to confirm identity and workspace ownership.
You may complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/. We would appreciate the chance to resolve concerns first.
10. Security
We apply technical and organisational measures appropriate to a permission and attestation service, including:
- TLS for public HTTPS endpoints
- HttpOnly session cookies with SameSite controls
- CSRF protection on owner state-changing routes
- Password hashing; API secrets stored as hashes
- Separation of BoundProof signing keys from the public web document root
- Helmet-style HTTP security headers and rate limits
- Scoped agent keys that cannot approve or consume execution authority
No method of transmission or storage is perfectly secure. You must protect passwords and API keys, keep merchant keys server-side only, and revoke credentials that may be compromised. Report security issues via Security or hello@affix-io.com.
11. Children
BoundProof is designed for business and professional use by adults. It is not directed at children under 18. Do not create a workspace for a child or submit children’s personal data into BoundProof fields.
12. Controller and processor roles for your end customers
When you integrate BoundProof into your product, AffixIO is typically the controller of BoundProof account, billing and service-operation data about you (the customer organisation and its users).
For personal data about your end customers or employees that you choose to place in action payloads, order references or related fields, you remain the controller of that source data. AffixIO processes those fields as needed to evaluate permissions and issue receipts. Prefer minimisation: send only what the gate needs.
BoundProof signs permission evaluations. A valid signature shows integrity of the signed payload. It is not proof of payment, KYC, consumer consent or regulatory compliance for your business.
13. Changes to this policy
We may update this Privacy Policy by posting a revised version at https://boundproof.affix-io.com/privacy/ and updating the effective date. Material changes will be notified by site notice or email where reasonably practicable. Continued use after the effective date means you acknowledge the updated policy.
14. Contact
AffixIO — operator of BoundProof Agent
Email: hello@affix-io.com
Web: https://www.affix-io.com/contact/
Privacy page: https://boundproof.affix-io.com/privacy/
Terms: https://boundproof.affix-io.com/terms/
This Privacy Policy describes AffixIO / BoundProof practices in plain UK English for commercial launch. It is not solicitor advice to you, and AffixIO does not guarantee any particular compliance certification or regulatory determination. For advice on your specific situation, consult a qualified solicitor or privacy professional.