Privacy Policy

Data controller#

PowaHub is operated by CertainData Ltd, a company registered in England & Wales under company number 17354647 (official name: CERTAIN DATA LTD), whose registered office is at Venture House, 2 Arlington Square, Downshire Way, Bracknell, Berkshire, RG12 1WA. CertainData Ltd is the data controller for personal data processed through PowaHub. Supervisory authority: UK Information Commissioner's Office (ICO). DSAR contact: privacy@powahub.ai.

In this Policy, "PowaHub", "we", "us" and "our" refer to the PowaHub platform operated by CertainData Ltd.

This Policy explains what personal data we collect through PowaHub, how it is used, the lawful bases relied on, how long it is retained, and the rights available to you.

1. What we collect#

Account and identity data: first name, last name, email address, telephone number, country, company, role and account identifiers where provided or required for registration.
Authentication and security data: authentication events, MFA status, security and fraud-prevention logs, API-related identifiers and other technical information used to protect accounts and the service.
Usage data: which sources and workflows are called, with timestamps and related request metadata. For marketplace proxy calls, PowaHub stores the endpoint host and path, cost and call count. Request and response bodies are not stored by the marketplace proxy.
Wallet and settlement data: wallet addresses, wallet and service identifiers, USDC transaction hashes, amounts, destination addresses and transaction or receipt records. Where buyer-side PowaHub functionality uses Delegated Signing, related authorisation status and identifiers may also be processed.
Support data: information you provide when contacting us for support, including the contents of support communications.

2. How we use personal data and our lawful bases#

We process personal data only where we have a lawful basis to do so.

To create and manage accounts and provide the service: including authentication, routing calls, providing wallet-related functionality, settling payments and producing receipts. Lawful basis: performance of a contract or steps taken at your request before entering into a contract.
To support users: including responding to questions and diagnosing service issues. Lawful basis: performance of a contract and our legitimate interests in supporting and operating the service.
To protect the service: including security monitoring, fraud prevention, abuse prevention and investigating suspected misuse. Lawful basis: our legitimate interests in protecting users, systems and the integrity of the service, and legal obligation where applicable.
To comply with legal and regulatory requirements: including responding to lawful requests and maintaining records where required. Lawful basis: legal obligation.
To improve the service: including aggregate or de-identified usage analysis, service performance monitoring and product improvement. Lawful basis: our legitimate interests in improving and maintaining the service, subject to applicable privacy and electronic communications requirements.
To provide AI-assisted features: including the documentation "Ask our Agent" assistant and catalogue "Ask the AI Data Agent" functionality. Lawful basis: performance of a contract where the feature is requested by the user and our legitimate interests in providing and improving the service, as applicable.
To send marketing communications: where we do so, the lawful basis will be consent or another lawful basis permitted by applicable law. You may opt out of marketing communications at any time.

We do not sell personal data.

3. Where data is stored and international transfers#

We use third-party infrastructure and service providers to operate PowaHub. Personal data may be processed in the United Kingdom, European Economic Area and other countries in which our service providers operate.

Where personal data is transferred outside the United Kingdom in circumstances requiring a transfer safeguard, we use an appropriate lawful transfer mechanism, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by applicable law.

Settlement transactions recorded on the Base blockchain are publicly accessible blockchain records. Blockchain records are not controlled solely by us and generally cannot be altered or deleted by us once confirmed on-chain.

4. Service providers and recipients#

We may share personal data with service providers where necessary to operate, secure and support PowaHub. These may include:

Amazon Web Services (AWS) — compute, database, authentication, email, hosting, storage and related operational services.
Coinbase / Coinbase Developer Platform (CDP) — wallet infrastructure, wallet-related identifiers, key-management infrastructure, signing services and On/Off-ramp functionality used by PowaHub.
OpenAI — used to provide the documentation "Ask our Agent" assistant and catalogue "Ask the AI Data Agent" functionality.
Infrastructure, communications, security, observability and support providers — where used to host, monitor, protect or support PowaHub.
Professional advisers, regulators, courts and public authorities — where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.

The Base network is used for public blockchain settlement. Information recorded on-chain may be publicly visible and is not treated as information held solely within PowaHub's systems.

We require service providers that process personal data on our behalf to protect that information and process it only in accordance with applicable contractual and legal requirements.

5. Retention#

Seller transaction data is available through the PowaHub portal for 90 days. Certain transaction, settlement, security and operational records may be retained internally for longer where necessary for service operation, accounting, legal or regulatory requirements, fraud prevention, dispute resolution or enforcement of agreements.

Other personal data is retained only for as long as necessary for the purposes for which it was collected. Retention periods vary according to the type of information, the purpose for which it is processed, contractual requirements and applicable law. When personal data is no longer required, we delete or anonymise it where reasonably practicable.

Information recorded on a public blockchain may remain publicly available indefinitely and cannot generally be deleted or modified by us.

Depending on the circumstances and the lawful basis used, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of personal data;
request restriction of processing;
object to processing based on legitimate interests or to direct marketing;
request portability of personal data where the right applies;
withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal; and
lodge a complaint with the UK Information Commissioner's Office (ICO).

Some rights are subject to legal conditions and exemptions and may not apply in every circumstance. To exercise your rights, contact privacy@powahub.ai.

7. Children#

PowaHub is a B2B service and is not directed at children under 16. Users must be at least 18 years old to create and use an account unless we expressly permit otherwise in accordance with applicable law.

8. Cookies and similar technologies#

We use cookies, local storage and similar technologies that are necessary to operate, secure and authenticate PowaHub. The production PowaHub site is also expected to use non-essential analytics and marketing technologies, which may include Google Analytics (GA4), Meta Pixel and LinkedIn Insight Tag. The exact set may change as the production configuration is finalised.

Where required by applicable law, non-essential analytics or marketing technologies will not be activated until the user has provided the required consent through the site's consent controls. Users will be able to manage or withdraw that consent as applicable.

9. Security#

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No system can be guaranteed to be completely secure, and users are responsible for keeping their credentials and authentication devices secure.

10. Updates#

We may update this Policy from time to time. Material changes will be posted on this page and, where appropriate, notified to registered users.