Privacy Policy

Who we are

x402Mall (x402mall.shop) is operated by BUTIFUL L.L.C. In this policy, "we" and "us" mean BUTIFUL L.L.C.

The short version

• Browsing x402Mall requires no account, no sign-up, and no cookies.
• We don't run analytics or advertising trackers.
• If you submit a listing, we collect what you type into the form — including a contact email that stays private.
• We never ask for seed phrases, private keys, or wallet credentials.

1. What we collect

Listing submissions. When a provider submits a listing through the "Add your API" form, we collect the information entered: service name, provider name, description, use cases, website and endpoint URLs, category, tags, payment network and asset, price, pricing unit, and a contact email. Everything except the contact email is intended for publication if the listing is approved.

Provider contact email. The contact email is used only to review the listing and to contact the provider about it. It is stored privately, is never shown on the website, and is never included in our public API. It stays private unless the provider themselves chooses to publish contact details elsewhere (for example on their own website).

Moderation and security records. We keep an internal log of listing events (submitted, checked, edited, approved, rejected) so moderation decisions are accountable. For a submission, this log stores a truncated network hint (the first half of an IP address, e.g. "203.0.x.x") for abuse investigation — not the full address.

Short-lived technical data. To limit spam and abuse, our servers briefly use the IP address of requests to the submission and admin sign-in endpoints for rate limiting. This lives in server memory and is not written to our database.

2. What we don't collect

• No visitor accounts, profiles, or sign-ins.
• No analytics, advertising, or cross-site tracking scripts.
• No cookies for visitors, and no use of your browser's local storage.
• No payment information — payments happen directly between you and a provider.
• No wallet secrets, ever. We will never ask for a seed phrase, private key, or recovery phrase.

3. Cookies

The public website sets no cookies. One essential cookie exists solely for the private administrator sign-in used to review listings; it identifies an admin session, contains no personal information, and is never set for ordinary visitors.

4. Who processes data for us

Like most websites, we rely on infrastructure providers:

• Vercel hosts the website and, as part of operating and protecting its network, keeps standard server logs (which include IP addresses) under its own policies.
• Supabase hosts our database, where listing submissions and moderation records are stored.

These processors store data on our behalf; we don't sell or rent any information to anyone.

5. Automated listing checks

Our checker makes limited, unauthenticated HTTPS requests to the website and endpoint URLs in a listing to see whether they respond and whether the endpoint answers with an x402 payment challenge. These requests identify themselves as x402Mall, send no personal data, and never make a payment.

6. How long we keep things

• Approved listings, and the moderation records for listings that are still on the site: for as long as they are listed.
• Rejected or withdrawn submissions, and moderation records whose listing no longer exists: kept for up to 12 months for accountability and abuse prevention, then deleted automatically.

Providers can ask us to remove a listing or delete their submission data at any time (see Contact below); we will action reasonable requests unless we need to keep a record for legal or abuse-prevention reasons.

7. Security

Everything is served over HTTPS. Private data (such as provider contact emails and moderation records) is restricted at the database level, and administrative access is protected by a server-side secret. No online service can promise perfect security, but we design the site to collect little and expose less.

8. Legal requests

We may disclose information if we believe in good faith that doing so is required by law, or necessary to investigate fraud or abuse, or to protect the rights and safety of providers, users, or x402Mall.

9. Changes and contact

We'll update this policy if our actual practices change, and update the date at the top. Questions or requests: contact@x402mall.shop. See also our Terms of Service and Listing & Acceptable Use Policy.