Privacy statement
Fizzl Agent Wallet (wallet.fizzl.eu) · last updated 2 October 2026
This statement explains what personal data the Fizzl Agent Wallet processes, why, for how long, and what your rights are. We keep it short because we collect little: no passwords, no names, no e-mail addresses, no tracking.
1. Who is responsible
The controller is Frits Zwager, trading as Fizzl, the Netherlands. For anything about your data, contact Fizzl13@protonmail.com.
2. What we process, and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your wallet address and the date you signed up | It is your account: you sign in by signing a message with your wallet. No password, no e-mail. | Contract (art. 6(1)(b)) |
| Your agents: the names you give them, a SHA-256 hash of each agent key (never the key itself), when each was last seen | So your agents can use the service and you can manage them | Contract |
| Your rules: limits, allow list, paused or not | To apply your spending rules | Contract |
| What your agents ask to sign: method, network, recipient address, amounts, the safety verdict from presign-guard, and what the agent says it is buying (a URL and a description, if your agent sends them); your approvals and denials | To check requests against your rules, ask you for approval, and show you receipts and an activity log | Contract |
| Telegram (only if you connect it): your chat id, user id and username | To send you approval requests and plan reminders, and to accept your taps | Contract |
| Payments for Pro: transaction hashes, amounts, dates, until when you paid; for automatic payment, what the subscription contract and USDC show for your address (next payment date, paid-through date, the approval you gave, your USDC balance) | To give you Pro, remind you before a payment, and keep the records the law requires | Contract; legal obligation for bookkeeping (art. 6(1)(c)) |
| Your IP address, briefly | Held in memory only, to slow down repeated wrong logins and sign-in floods. Not stored by us. | Legitimate interest: security (art. 6(1)(f)) |
Please don't put other people's personal data in agent names, rules or purchase descriptions. What your agents send is up to you.
3. Cookies and local storage
- aw_session: a signed cookie that keeps you signed in, for 7 days. It is strictly necessary, so no consent banner is needed.
- aw_wallet (local storage, only in your browser): which wallet you signed in with, so the right one opens when you pay.
No analytics, no advertising, no tracking pixels, no third-party scripts. Even the fonts are served from this server.
4. What we never do
- We never ask for, see or store your private key or recovery phrase, and we never hold your funds. Your agents sign and pay themselves.
- We don't sell or rent your data, don't use it for advertising or profiling, and don't use it to train AI models.
5. Who helps us (processors)
- Render (hosting, EU region Frankfurt). Render may keep server logs, including IP addresses, for a limited time.
- Upstash (the database that stores the data above).
- Telegram, only if you connect it. Messages go through Telegram, under Telegram's privacy policy.
- A Base RPC provider, to read public blockchain data about payments.
Render and Upstash are companies based in the United States. Where data is processed outside the European Economic Area, this happens under the safeguards these providers offer, such as the EU standard contractual clauses.
6. The blockchain is public
Pro payments and automatic payment happen on the Base blockchain. Your address, the amounts and the times are public there and permanent. That is how blockchains work, and nobody, including us, can delete them.
7. How long we keep it
| Data | Kept |
|---|---|
| Account, agents, rules, Telegram link | Until you delete your account (or disconnect Telegram) |
| Receipts (what each payment was for) | 7 days on Free, 90 days on Pro |
| Spending records for your limits | 31 days |
| Approval requests | Shown for 24 hours after they are decided, deleted after 7 days |
| Activity log | The latest 500 events |
| Payment records for Pro | 7 years (Dutch bookkeeping law), also after you delete your account |
| Sign-in codes and Telegram link codes | 10 to 15 minutes, used once |
8. Your rights
You have the right to access, correct and delete your data, to get it in a portable format, to object to processing based on legitimate interest, and to ask us to restrict processing.
- Delete: on the dashboard, under "Your account", use Delete my account. Everything above goes, except the payment records we must keep. Turn off automatic payment first: it lives on the blockchain, so only your wallet can stop it.
- Anything else, such as a copy of your data: write to Fizzl13@protonmail.com. We answer within one month.
If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We'd appreciate hearing from you first.
9. Security
- Agent keys are stored only as hashes.
- Sessions are signed and HTTP-only, and everything runs over HTTPS.
- Every account can see and change only its own data.
- Approvals on Telegram are accepted only from the Telegram user linked to that account.
10. Age
The service is not meant for anyone under 16.
11. Changes
If we change this statement in a way that matters to you, we'll say so on the dashboard (and on Telegram, if you connected it) before it takes effect. The date at the top shows the current version.