Privacy and data.

Data controller

The data controller is José Luis Sánchez, tax ID 71223690G, address calle Repullete 100, 23300 Villacarrillo (Jaén), Spain. Scorpio is a product of Automaton Colony and is run by the same person.

Contact for any privacy matter: jls.17@automatoncolony.xyz. No data protection officer has been appointed: it is not required for processing of this size and nature, and the person who answers is the same one who runs the service.

This document describes the processing the service performs today, checked against the running infrastructure.

Data Scorpio may process

Analysis data

• Public repository URL, organisation, project name and commit.
• Number of own and third-party files, compilation information and scope metrics.
• Results, evidence, execution states, engine fingerprint and integrity checksums.

Payment and operational data

• Public wallet address, network, asset, amount and transaction hash.
• Order identifier, product, timestamps and status.

What is not stored

The IP address is in no file and in no table. It is used in memory only, and only on the free routes, to count how many requests arrive from the same place within a 60-second window; once the window passes it is gone. On the paid routes it is not even needed, because there the count goes by the paying address, which travels signed. The service does not record the user agent either, and there are no cookies, no analytics and no tracking of any kind.

Scorpio needs no private keys, seed phrases or repository credentials. You should never supply them.

Where the data comes from

The data comes from the information you enter, from publicly accessible repositories, from technical interaction with the service, from the payment facilitator when it takes part, and from public blockchain networks.

If you submit someone else's repository or data, you must have authorisation and avoid including unnecessary personal information in branch names, commits, issues or files.

What they are used for

• Running the preflight and determining whether the repository falls within scope.
• Issuing and verifying the x402 offer, confirming payment and handling refunds.
• Running the analysis, producing the delivery and allowing it to be downloaded.
• Protecting the service, limiting abuse, investigating incidents and keeping security logs.
• Handling support, complaints and legal or accounting obligations.
• Measuring performance and improving the engine through aggregated or anonymised data.

Legal basis

Running the service, the payment and the delivery are processed because they are necessary to perform the contract. Fraud protection, security, diagnostics and operational improvement may rest on the operator's legitimate interest, balanced against people's rights.

Retention required by tax, accounting or prevention rules, or by an authority, rests on legal obligations. Where a purpose requires consent, it will be requested separately and may be withdrawn.

Data on a public blockchain

x402 payments may publicly record the wallet address, amount, asset, network, recipient, hash and approximate time. That information is independent of Scorpio's database and can be copied by nodes, explorers and third parties.

A blockchain does not let the operator delete or alter confirmed transactions. Use a wallet that reveals no more information than you want publicly associated with the purchase.

Providers and recipients

This is the list of those who take part in providing the service today, checked against the running infrastructure. Information is also disclosed when a competent authority requires it or when it is necessary to bring, exercise or defend claims.

Scorpio uses no analytics, advertising or tracking providers, and does not share order data with third parties other than those above.

The Base network and its participants process public data in a decentralised way and outside Scorpio's direct control.

Retention and deletion

These are the periods the service applies today, taken from its actual configuration:

The first two periods are not an intention: a module of the service itself applies them, and every deletion leaves a record in the technical log. Changing the number in that module changes what the machine does, and this page quotes that number rather than deciding one of its own.

Security measures

Scorpio applies job separation, access control, encryption in transit, repository validation, operational limits and integrity mechanisms to reduce the risk of access, alteration or loss.

No system is infallible. If you spot an exposure or unexpected behaviour, avoid publishing the details while it is being investigated and use the security contact given at the end.

Your rights

Where the applicable rules recognise them, you may request access, rectification, erasure, restriction, objection and portability. You may also lodge a complaint with the competent data protection authority.

To process the request it may be necessary to verify that you control the address or the email associated with the order. Data written to a public blockchain cannot be erased by Scorpio.

International transfers

Hosting and running the analysis take place in Germany, within the European Economic Area. Two processing operations leave the EEA, both identified above: Cloudflare's proxy and DNS, and Coinbase's payment facilitator. Both are United States providers.

Cloudflare. Its data processing agreement incorporates the European Union's standard contractual clauses, those annexed to Commission Implementing Decision 2021/914, in its section 6.2; and in section 6.4 it states that it adheres to the adequacy framework between the European Union and the United States, so that a transfer covered by that framework does not count as a restricted transfer. Verified against its public document on 10 September 2026.

Coinbase. Its public documentation indicates that it relies on the standard contractual clauses and on the adequacy framework between the European Union and the United States, but that could not be verified by reading the document at the source, so it is not asserted here as fact.

Minors

Scorpio is aimed at professionals, developers, security teams and automated systems. It is not designed for minors and does not knowingly collect their data.

Changes to this policy

The policy may be updated because of changes to the product, the providers or the law. The page will state the version and the date it takes effect. Material changes will be communicated by a means proportionate to their impact.

Privacy and security contact

To exercise your rights or ask anything about this document: jls.17@automatoncolony.xyz. It is the only address on the domain that receives mail, and it is run by the same person who answers for the processing.

If you consider that the processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency.

Later on it will be worth splitting support, privacy and vulnerability disclosure into separate functional addresses. While there is only one, this is it.