Privacy policy

Last updated: 18 October 2026. These documents have not yet been reviewed by a licensed lawyer. Bracketed placeholders depend on company formation.

Who is responsible for your data

DeepCounterfeit (deepcounterfeit.com) is currently operated by its founder, an individual based in the State of Qatar. No company has been incorporated yet. Until a company is formed, the founder is the contracting party and data controller. When a company is formed, it will take over these Terms and our contracts (see “Assignment”), and we will update this page and notify paying customers. Contact: admin@deepcounterfeit.com or ceo@deepcounterfeit.com.

This policy explains what personal data DeepCounterfeit processes, why, and your rights, including under the EU and UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

What we collect

• Contact and demo requests: name, email, company, interest, your message, plus IP address and browser user agent (for spam and abuse prevention).
• API keys and accounts: email, optional company, plan, key creation and expiry dates, and a one-way hash of your key (we do not store the key itself, except that a newly issued key bought with crypto is held for up to 24 hours so you can view it on your payment page).
• Usage: per-minute request counts per key or IP address for rate limiting, and webhook URLs you register.
• Payments: email, plan, amounts, payment network, the receiving address, transaction ID, confirmations, and (for screening) the public sending address. We never receive card numbers, private keys or seed phrases.
• Server logs: IP address, time, requested URL, status and user agent, kept by our hosting provider.
• Public blockchain data: token contract addresses, names, tickers, metadata, and the public wallet addresses that created or traded flagged tokens, with on-chain amounts and times (see below).

Public blockchain data and wallet addresses

Our detections concern tokens. To score them we process public wallet addresses (for example the creator wallet) and their public on-chain activity. A wallet address is pseudonymous, but it could be personal data if it can be linked to an individual. We do not try to identify the people behind wallets, do not combine wallet data with off-chain identity data, and show wallet addresses only as factual on-chain records, not as accusations. We rely on our legitimate interests, and those of brand owners and the public, in detecting brand impersonation and protecting consumers from deceptive tokens. You can object or ask for a correction (see “Your rights” and our correction process).

Why we use it (legal bases)

• To provide the Service and process payments (performance of a contract): issuing keys, rate limits, activation, receipts, support.
• Security, abuse and fraud prevention (legitimate interests): rate limiting, logs, blocking abuse of free trials.
• Replying to business enquiries (legitimate interests, or steps before a contract).
• Brand-impersonation detection from public blockchain data (legitimate interests, as above).
• Legal obligations: accounting and tax records, sanctions screening, responding to lawful requests.

We do not sell personal data, do not “share” it for cross-context behavioural advertising, do not use it for advertising, and do not make decisions with legal or similarly significant effects on individuals solely by automated means.

Who we share it with

Only service providers that help us run the Service, under their data-processing terms:

• Render (application hosting and database, United States: Oregon) and Cloudflare (network edge used by our host).
• Namecheap (domain and email forwarding) and Google (Gmail, where email sent to our addresses is delivered).
• Public blockchain infrastructure: RPC and explorer APIs (for example PublicNode, Solana public RPC, mempool.space, Blockscout) to read public chain data and detect payments. These receive our own addresses and public queries, not your contact details.
• x402 facilitator (currently PayAI) when you pay per call: it receives the signed payment payload from your wallet to verify and settle it.
• Card processor (for example Stripe), only once card checkout is enabled.

We may disclose data if required by law or to protect rights and safety. If the Service is transferred to a company formed by the founder, data transfers with it under this policy.

International transfers

We operate from Qatar and our servers are in the United States, so your data is processed outside your country. Where we transfer EU/UK personal data, we rely on our providers' data-processing terms, which include the European Commission's Standard Contractual Clauses (and UK addendum) where they offer them.

How long we keep it

• Alert and token records: on the live service, flagged-token records are kept for about 30 days and lower-tier “watch” records for about 3 days, then deleted. Tokens without an alert are deleted. Compact archives or aggregated statistics may be kept longer, and evidence reports you bought stay available to you.
• Rate-limit counters: up to 7 days.
• Webhook delivery logs: 30 days.
• Contact and demo requests: up to 24 months after our last contact, unless you become a customer.
• API key and account records: while the key is active and up to 24 months after it expires or is deactivated.
• Payment and invoice records: as long as tax and accounting law requires (typically up to 7 years).
• Plain-text API keys from crypto checkout: erased 24 hours after payment.
• Server logs: kept by our hosting provider for its standard retention period (typically days to weeks).

Your rights

Depending on where you live (including the EU, EEA, UK and California), you can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to processing (including processing based on legitimate interests, such as wallet data), and to withdraw consent where we rely on it. California residents can also ask what we collect, use and disclose, and can opt out of sale or sharing (we do neither). We will not discriminate against you for using your rights. To use them, email admin@deepcounterfeit.com. We may need to verify your request (for wallet data, for example by signing a message, so we never ask for private keys) and will reply within one month (45 days for CCPA requests). You can complain to your local data protection authority.

Cookies and local storage

We do not use cookies, analytics or advertising trackers. The checkout and account pages keep your API key in your browser's session storage, only in your browser tab, so you don't have to paste it again. It is cleared when you close the tab. Our hosting provider's network edge may set strictly necessary security cookies to block attacks.

Security

We use HTTPS everywhere, store API keys only as one-way hashes, restrict admin functions to a secret admin key, apply rate limits and security headers, and keep payment detection read-only. No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and regulators where the law requires.

Children

The Service is for businesses and adults. It is not directed to anyone under 18, and we do not knowingly collect their data.

Changes and contact

We will post changes here and update the date above. For material changes we will notify customers by email. Questions or requests: admin@deepcounterfeit.com or ceo@deepcounterfeit.com.

Controller details: legal name and registered address of the operating company: [PLACEHOLDER: to be set by counsel when the operating company is formed]. EU/UK representative (GDPR Art. 27), if required: [PLACEHOLDER: to be set by counsel when the operating company is formed].