Privacy Notice

1. Who We Are

DarkMatter (darkmatterhub.ai) is an independent verification and audit layer for AI agent decisions, "We," "us," and "our" refer to DarkMatter and its operators. For questions, contact us at [email protected].

2. Information We Collect

Information you provide

• Account information: Email address and password when you sign up
• Payment information: Billing details processed by Stripe (we do not store card numbers)
• Communications: Any messages you send us via email or contact forms

Information from your use of the Service

• Commit payloads: The data you submit via API to create Records, including AI agent inputs, outputs, and metadata you choose to record
• API usage data: Request timestamps, volumes, error rates, and API key identifiers
• Agent metadata: Agent names, IDs, and assurance level settings you configure

Information collected automatically

• Log data: IP addresses, browser type, pages visited, and timestamps
• Device information: Device type, operating system, and general location derived from IP

3. How We Use Your Information

• To provide the Service, storing, hashing, and making your Records verifiable
• To manage your account and process payments
• To respond to your support requests and communications
• To monitor Service health, detect abuse, and prevent fraud
• To improve the Service using aggregated, anonymized usage metrics
• To comply with legal obligations

We do not use your commit payloads to train AI models. We do not sell your data to third parties.

4. How We Share Your Information

We share your information only in the following circumstances:

• Service providers: Supabase (database and authentication), Railway (hosting), Stripe (payments), Cloudflare (DNS and CDN), Resend (transactional email). These providers process data on our behalf under their own privacy policies.
• Legal requirements: When required by law, court order, or government authority
• Business transfers: In connection with a sale, merger, or acquisition of the business
• Your direction: When you share a Record via a public /r/ link, the payload content of that Record becomes accessible to anyone with the link

5. Public Verify Links

When you share a Record using a /r/ link, the payload content of that Record is accessible to anyone with the link. You control what data you commit to Records and whether you share the resulting links. Do not commit sensitive data you do not intend to share if you plan to use public share links.

6. Data Retention

We retain your account information for as long as your account is active. Committed Records are retained according to your plan's retention window (30 days for Free, 90 days for Pro, unlimited for Teams and Enterprise). We retain payment records as required by law.

You may delete your account and all associated data at any time from Dashboard, Settings. Deletion is processed automatically and immediately. Your account, all commits, agents, API keys, and workspace records are permanently removed within minutes. Active Stripe subscriptions are cancelled at the same time with no further charges.

7. Security

We take reasonable technical and organizational measures to protect your information, including encrypted storage (Supabase), HTTPS-only transmission, and cryptographic hashing of all Records. However, no system is perfectly secure. We encourage you not to commit sensitive data you would not be comfortable disclosing in a legal proceeding or regulatory inquiry.

8. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data. We will not discriminate against you for exercising these rights.

Right to deletion. You have the right to delete your account and all associated data at any time. To exercise this right, go to Dashboard, Settings, and click "Delete account." Deletion is processed automatically and immediately, no waiting, no manual review, no further charges.

For other data rights requests (access, correction, portability), contact us at [email protected]. We will respond within 30 days.

California residents may also have rights under the CCPA. We do not sell personal information as defined by the CCPA.

9. Children

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have done so inadvertently, contact us at [email protected] and we will delete it.

10. Limitation of Liability and Hold Harmless

By using the Service, you agree not to hold harmless DarkMatter, its operators, founders, employees, contractors, affiliates, successors, or assigns (collectively, "DarkMatter Parties") from any claim, liability, damage, loss, or expense of any kind arising from your use of the Service or your reliance on any Record, verification result, or other output of the Service.

To the maximum extent permitted by law, the DarkMatter Parties shall not be liable for any direct, indirect, incidental, special, consequential, or punitive damages arising out of or related to your use of the Service, even if a DarkMatter Party has been advised of the possibility of such damages.

11. Changes to This Notice

We may update this Privacy Notice. We will post the updated version with a revised date. For material changes, we will notify registered users by email where practicable. Your continued use of the Service after changes take effect constitutes acceptance of the updated notice.

12. Contact

For any privacy questions or to exercise your rights: [email protected]