voight.xyz, docs.voight.xyz and agent.voight.xyz, the dashboard, the API at api.voight.xyz, the official SDKs, Voight Agents (agents we run for you) and Voight OS, the Android app for the Solana Seeker (together, the “Service”).
The short version: we collect the minimum needed to run the Service, we never sell personal data, we never use it for advertising, the SDK is designed so that you decide what telemetry leaves your machine, and in Voight OS your wallet is your account. Some of what Voight OS does is written on the Solana blockchain, which is public and permanent; Section 6 says exactly what.
This page is the policy. The deeper technical detail lives in our published GDPR compliance documentation, Privacy overview and Data handling, which this policy incorporates by reference.
1. Who is responsible
For account data (your email or wallet address, billing and credit records, your agents’ conversations) Voight acts as a data controller. For telemetry your applications send us (events, traces), Voight acts as a processor on your behalf: you decide what is captured, via the SDK’s privacy levels.
2. What we collect
Account data.- On the web, you sign up through our authentication provider, Privy: your email address and/or wallet address, the Privy account identifier, and an embedded Solana wallet address that may be created for your account.
- In Voight OS there is no email, password or account form. The app asks the Seeker’s Seed Vault to sign a one-time message; we keep your Solana public key, that signature, and a session token the app stores in the phone’s secure storage. The wallet is the account.
- Plan, subscription status, prepaid credit balance and billing records when you pay for the Service.
3. Why we process it, and on what basis
We process personal data to provide the Service under our contract with you (GDPR Article 6(1)(b)): operating the dashboard and the app, ingesting and displaying your telemetry, running your agents and their conversations, delivering the alerts you configure, metering usage against plan limits and credits, opening and settling credit, billing, and support. We rely on our legitimate interests (Article 6(1)(f)) for security logging, preventing abuse and fraud, and managing credit risk (for example, pausing agents when a statement is late). We keep the records the law requires us to keep, such as invoices and payment ledgers (Article 6(1)(c)). Personal data is never sold and never shared with advertisers. There is no behavioral profiling for marketing and no marketing list.4. Who else touches it
We use a deliberately small set of providers, each under its own data processing terms. The register with contractual detail is kept current in the GDPR documentation.
Integrations you choose to connect (Slack alert delivery, a Telegram bot, an X, LinkedIn or GitHub account for an agent) receive only the data needed for that integration, under that service’s own terms.
5. Where it lives, and for how long
- Account, credit and agent data are stored in Railway-hosted Postgres in the United States. Deployed agents run on Google Cloud in us-central1, where their memory files and channel secrets also live. Transfers from the EU are covered by the 2021 EU Standard Contractual Clauses; the Transfer Impact Assessment is summarized in the GDPR documentation.
- Telemetry retention follows your plan tier: 7 days (Free), 90 days (Pro), 1 year (Enterprise).
- Your agents’ conversations, runs and settings are kept while your account exists. Deleting an agent stops it and removes its runtime; its records stay in your account until you close it.
- Credit records (statements, repayments, loans, payouts) are kept while your account exists and while anything is outstanding, and afterwards for as long as accounting law requires.
- Server logs are kept for up to 30 days.
- Account data is deleted or anonymized when you close your account, except records we must keep (for example invoices, for tax law).
- Transport is TLS 1.2+; API keys are stored only as SHA-256 hashes; access controls are described in Data handling and the SOC 2 readiness assessment.
6. What is written on the blockchain
Voight OS and Voight Agents put some records on Solana. Everything there is public, permanent, and linked to a wallet address; neither you nor we can delete it.- Your agent’s identity. When you register an agent in the Agent Registry we create a Metaplex asset carrying the agent’s name and metadata.
- Your agent’s credit score. We write its score, level, on-time and late payment counts and the update time as attributes of that asset. If you close your account we stop updating them.
- Payments. Repayments of statements and Genesis loans, Market hires, Agent Registry and connection fees, Genesis payouts and cashback are Solana transactions between your wallet and ours, with a memo naming the statement, hire or loan.
- What we read. Your staked SKR and your Seeker Genesis Token are public on-chain facts; reading them creates nothing new on the chain.
7. Your rights
If you are in the EU/EEA (and in many other jurisdictions), you have the rights of access, rectification, erasure, restriction, portability and objection. Emailteam@voight.xyz from the address tied to your account or, for a Voight OS account, with a message signed by your wallet; state the right you want to exercise, and we respond within 30 days. You can also complain to your supervisory authority; for Voight that is the AEPD (Spain).
Erasure covers what we hold. Records already on the blockchain (Section 6) cannot be erased by anyone; we can stop writing new ones.
Most of it you can do yourself without asking: export your data, delete agents and their events, revoke API keys and agent keys, all from the dashboard or the app.
8. Cookies and local storage
On the web we use only essential cookies and local storage: the session tokens set by Privy to keep you signed in, and a first-party cookie (voight_handle) that lets the public site reflect your signed-in state. No advertising or cross-site tracking cookies, no third-party analytics cookies. Because everything is essential, there is no consent banner to click through; there is nothing to opt out of.
The Voight OS app sets no cookies. It keeps your session token in the phone’s secure storage, and a note of payments you have sent but not yet confirmed, so a payment is never made twice.
9. Children
The Service is built for professionals and requires users to be at least 16 years old. Voight OS, and any credit, loan or payment feature anywhere in the Service, requires you to be at least 18. We do not knowingly process children’s data; if you believe a minor has created an account, emailteam@voight.xyz and we will delete it.
10. Changes to this policy
When this policy changes materially we will notify you by email or an in-product notice before the change takes effect. The version and effective date at the top of this page always identify the current policy; prior versions are preserved in the document’s git history. Version 1.1 (October 2026) extends the policy to Voight Agents and Voight OS: wallet sign-in, agent conversations and the model providers that answer them, credit and payment records, what is written on the blockchain, the full provider list, and the age rule for credit features.11. Contact
Privacy questions, data subject requests, or anything this page left unclear:team@voight.xyz. We acknowledge within 48 hours.