Privacy Policy
Last updated: 2026
This Policy describes what data Obolo collects, how we use it, and what rights you have. Obolo is an early-stage public draft; some details will be finalized before general availability.
1. Data we collect
We collect: (a) account information, such as your email and your organization’s details; (b) usage and metering data, including the tool calls you make, their timestamps, latency, and associated cost; and (c) payment data, which is handled by our payment processors. We do not store full card numbers.
2. How we use data
We use this data to provide and operate the service, route your calls through the gateway, bill consumption against your prepaid balance, enforce spend caps, maintain security and prevent abuse, and generate the audit logs that let you reconstruct consumption. We also use it to provide support and to comply with legal obligations.
3. Payment processors
Payments are processed through third parties: Stripe for card and fiat, and on-chain addresses for USDC payments (including x402). These processors handle payment data under their own policies. Obolo does not store full card numbers; we retain only minimal references (for example, a transaction identifier or last digits) needed for reconciliation and billing.
4. Cookies and authentication
We use strictly necessary session cookies to keep you logged in. Your language and theme preferences are stored locally in your browser (localStorage) and are not sent to a tracking server. We do not use third-party advertising cookies.
5. Who we share data with
We do not sell personal data. We share data with providers that run the service (payment processors, infrastructure) under confidentiality obligations. Publishers see aggregate GMV and usage metrics for their own servers, but do not receive buyer identities beyond what is strictly needed to operate the platform. We may disclose data where required by law or to protect the security of the service.
6. Public catalog and AI crawlers
Obolo maintains a public catalog of MCP servers, including crawled servers from public sources. Catalog information (names, descriptions, tools, categories, and verification tier) is public and may be indexed by search engines and AI crawlers. Your account data, consumption, and payments are not part of the public catalog.
7. Data retention
We keep account data while your account is active, and usage, metering, and billing data for as long as needed to provide the service, resolve disputes, and meet legal, accounting, and tax obligations. We then delete or anonymize it. Audit logs are retained for a reasonable period for security and reconciliation purposes.
8. Your rights
You can request access to, correction of, or deletion of your personal data, as well as a copy of it, by contacting us at hola@obolo.dev. We will honor your request under applicable law. Note that certain billing and audit data may be retained where the law requires it, even after a deletion request.
9. Security
We apply technical and organizational measures to protect your data, including encryption in transit and SSRF (Server-Side Request Forgery) blocking to prevent routed calls from reaching unauthorized internal resources. No system is completely secure, but we work continuously to reduce risk.
10. Changes and contact
We may update this Policy as the product evolves and will notify you of material changes by reasonable means. As this is an early-stage public draft, some details will be finalized before general availability. For any privacy question, contact us at hola@obolo.dev.