What SafePay keeps, and why.

What we receive

For each payment an agent asks SafePay to check or make: the merchant name and URL, the amount and currency, the payee identifier (for example a billing email or PayPal account), the category, an invoice or order reference if given, the stated purpose, and the task the agent was given. We also receive the agent key that identifies the account. We never receive card numbers, bank credentials or PayPal passwords.

What we do with it

• Judge the payment: check it against the account's policy and payment history, look up the merchant on the public web, and ask a language model whether the payment serves the task.
• Record the decision in a tamper-evident audit log (a hash chain) so the account, the payee and auditors can later prove what was decided and why.
• Issue signed receipts and attestations that name the payee by domain and by a hash of its address, not the address itself.

We do not sell this data, show ads, or use it to train models.

Who processes it for us

• Tavily: the merchant name or domain, for the live web check.
• Nebius AI Studio (NVIDIA Nemotron): the payment details and the task, for the intent check.
• PayPal: only for payments SafePay itself releases (Payouts, mandates). The connector never sends anything to PayPal.
• Supabase: storage of the audit log, ledger and settings. Vercel and Render: hosting.
• Telegram: held payments, only if the account operator turns on Telegram approvals.

Keeping and deleting

Agent keys are shown once and stored only as a hash; you can revoke a key at any time. The audit log is append-only by design: removing one record would break the verification of every record after it. So the records that come from outside agents keep no personal data to begin with:

• SafePay Check connector (/mcp): the payee address, the task text, the purpose and any order reference are used to judge the payment and are not stored; the log keeps only their hashes, the merchant name and domain, the amount, the verdict and the rule names. Revoking the key ends access; nothing personal remains to delete.
• Impulsa: the log keeps only a hash of the business, never names, document numbers or amounts.
• Payments SafePay releases itself (console, API, mandates): the record keeps the payment details needed to prove what was paid and why, for as long as the service runs. Do not put personal data the decision does not need in a task or purpose.

You can ask what we hold about you, and ask us to correct it, at security@novacorplabs.com. We follow Chile's personal data law (Ley 19.628, and Ley 21.719 when it takes effect).