Privacy Policy

Moltline Studio ("Moltline", "we", "us") builds AI-agent skills, persona bundles, and MCP servers. This policy explains what data we collect, why, and how we handle it. We designed the products to need as little of your data as possible: there are no user accounts, and the data we need to deliver and support a license is kept only for the periods in section 4. The website and blog use Google Analytics and Google advertising features, and blog articles can show ads: section 1 says what they collect and section 6 how to turn them off.

1. What we collect

• Email address: only when you buy an All-Access license, so we can send your key and handle support. You may also email us directly for help.
• Payment data: cryptocurrency payments at checkout are processed by NOWPayments; we receive a payment confirmation and the amount. Payments over x402 (USDC on the Base network, the way AI agents pay) go straight to our wallet, and we record the paying wallet address, the transaction hash, the amount and the license key issued for it. Standard x402 payments are settled by the PayAI facilitator, which receives your signed payment authorization, including your wallet address, and submits it to the Base network. A blockchain transaction is public and permanent: nobody can delete it from the chain. We never see or store card numbers, wallet keys, or bank details.
• Order record: a record linking your order ID or transaction hash, your email or paying wallet address, and your license key, so we can deliver the key, support it and stop misuse. Section 4 says how long we keep it.
• Operational request data: every call to our MCP servers is written to a server-side log with: the timestamp, which server was called, which protocol method was used and which tool was named, the response status and how long it took, your IP address, the country it resolves to, your client's user-agent string, and (only if you sent one) a short, non-reversible fragment of your license key. We never log tool arguments or any content you send to a tool, and we never log a full license key. This exists to enforce anti-sharing limits and to spot abuse. It is not used to profile you, it is never sold or shared with anyone, and it never leaves our server.
• Website analytics: our public website and blog use Opinly, a privacy-respecting analytics tool, to understand aggregate traffic. It sets no cross-site advertising cookies. When a purchase completes we also send Opinly a server-side event containing the order ID and the amount so the sale can be attributed; we do not send your email address or license key to Opinly.
• Google Analytics and Google advertising: the website and blog use Google Analytics 4, loaded through Google Tag Manager, to count visits, see which pages people read and learn where they came from. These Google tags load through our own domain (the path /p7ux), which Cloudflare forwards to Google; this changes the route the requests take, not what is collected or the choices in section 6. Google signals and ads personalisation are switched on: Google may link these visits to the Google accounts of signed-in users who allow it, we may use them to build audiences for our own Google Ads campaigns, and Google Ads measures which visits came from our ads (conversions such as a click on the pay button or a run of the free checker). This uses first-party cookies such as _ga and _ga_… (random IDs that expire 13 months after your last visit) and _gcl_au (90 days). Page addresses are sent without their query strings (only standard utm_ campaign tags are kept). None of this runs on the license-claim page. If your browser sends a Global Privacy Control signal, or your device is set to a European time zone, none of it runs unless you turn it on (see section 6). Visitors whose connection Google places in the EEA, the UK or Switzerland are treated as not having consented unless they turn it on: Google then receives cookieless signals only and nothing for advertising. Google explains its side in How Google uses information from sites or apps that use our services.
• Ads on blog articles: articles on community.moltlinestudio.com can show ads served by Google AdSense. Third-party vendors, including Google, use cookies and web beacons to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites on the Internet. You can opt out of personalised advertising in Google’s Ads Settings, and opt out of other vendors’ use of cookies for personalised advertising at aboutads.info (or youronlinechoices.eu in Europe). Ads appear only on blog articles, never on the main site or the license-claim page.

2. What we do not collect

• No user accounts, passwords, or sign-ups.
• No selling or renting of personal data. Advertising data goes only to Google, as described above.
• No card, bank, or wallet credentials (those stay with the payment processor).

3. How we use data

We use the limited data above only to: deliver your license key; validate and support your license; process and confirm payment; prevent fraud, key resale, and abuse; measure how the website and our own Google ads perform, and show ads on blog articles; and comply with law. License validation itself happens offline on the server using a cryptographic signature: no per-use "phone home".

4. Retention

A job on our server runs every day and deletes what has passed these periods:

• Unpaid checkouts (an order you started but did not pay): deleted after 30 days, so that a payment which reaches us late still finds its order.
• Order and license records (your email or paying wallet address and your license key): kept while your license is valid and for 60 days after it ends (or 60 days after the order, when no license was issued), so we can support it. Then we delete the email address, the wallet address and the key. For our accounts we keep the order ID or transaction hash, the date, the product, the amount and the payment status.
• Records of collecting a key on the claim page (order ID and result, no email or IP address): 90 days.
• Operational request log of calls to our MCP servers (section 1): 8 days.
• Web server and system logs, which hold IP addresses and, for x402 payments, wallet addresses: 30 days. Daily traffic reports made from them keep their counts but lose the IP addresses after 30 days.
• SSH login records of our server (account name, source IP address and time of each sign-in or failed sign-in attempt): 30 days.

The job keeps a safety copy of what it changes for 7 days, then deletes that copy too. Emails you send to support are deleted from our support mailbox after 30 days, and sooner if you ask us. Brevo, which sends our emails, keeps its own delivery log and email previews (section 5). Google Analytics data is deleted automatically after 14 months. Payment providers keep their own records under their own policies.

5. Sharing

We share data only with the service providers that make the product work, and only the minimum each needs:

• NOWPayments: cryptocurrency payment processing at checkout.
• PayAI: the facilitator that settles standard x402 payments; it receives your signed payment authorization, including your wallet address.
• Brevo: sends your license-key and support emails. It keeps a delivery log with the recipient address, and a preview of each email (for the license email that includes the key), for 1 month and then deletes them. Ask us and we will have Brevo delete them sooner.
• Base RPC providers (the public Base endpoint and PublicNode): used to verify on-chain USDC payments; they see the transactions and wallet addresses our server looks up, not your IP address.
• Cloudflare: serves and protects the site; processes request metadata (including IP) at the edge, and forwards the Google tag requests described above to Google.
• Google Cloud: hosts our server.
• Opinly: aggregate website analytics and the order-ID purchase event described above.
• Google: Google Analytics, Google Ads and Google AdSense, as described above. For advertising, Google also uses this data under its own terms.

We do not sell or rent personal data, and we share it with no one else except where required by law.

6. Your choices & rights

Because we hold so little, most requests are simple. To see or delete what we hold about you, write to support@moltlinestudio.com from the email address you bought with, or tell us your order ID, transaction hash or license key. We delete your email or wallet address, unlink your license key from you and delete the key once it has ended, and keep only what our accounts need (section 4). A license that is still valid keeps working until it ends, but we can no longer resend its key. Canceling your subscription stops future charges; your key simply expires at the end of the paid period.

Analytics and advertising. You can turn Google Analytics and Google’s advertising features (Google signals, ads personalisation, conversion measurement and the ads on blog articles) on or off for this browser here. Your choice is saved in a small first-party cookie (ml-analytics, which holds only “on” or “off”) so that it also covers the blog, and it lasts about 13 months. Turning it off also removes the ads from blog articles in this browser. Google offers a browser add-on that blocks Google Analytics on every site, and you can turn off personalised ads everywhere in Google’s Ads Settings.

7. Security

All traffic to moltlinestudio.com and our API and MCP endpoints is served over HTTPS. License secrets are held server-side only and are never exposed to clients. We apply standard hardening (transport security headers, origin validation, abuse limits) across our services.

8. Children

Our products are intended for developers and businesses and are not directed to children under 16. We do not knowingly collect data from children.

9. Changes

We may update this policy as the product evolves. Material changes will be reflected here with a new "last updated" date.

10. Contact

Questions about privacy? Email support@moltlinestudio.com.