Privacy Policy

Controller

Story Glider Limited (C 114108), The Watercourse, Central Business District - Zone 2, Mdina Road, CBD 2010, Malta, is the controller of personal data processed through TollNode. Contact: privacy@tollnode.com.

What we collect

TollNode has no accounts and doesn't ask for your name or email to use a node. For each paid call we store an audit record: the paying wallet address, the request you sent (for example a prompt or an image link), the result we returned (including generated files), the time, the IP address and user agent the request came from, and the on-chain payment transaction.

If you email us, we keep the email. Our admin area uses a single sign-in cookie for staff only; visitors are not tracked with cookies or analytics.

Why, and on what legal basis

To perform the service you request and deliver or re-deliver results (performance of a contract); to prevent fraud, abuse and payment problems, screen payments against sanctions lists and keep the service secure (legitimate interests and legal obligation); and to keep records we may need to comply with legal obligations or answer lawful requests from authorities (legal obligation and legitimate interests).

We don't use your requests or outputs to train AI models, and we make no automated decisions about you that have legal or similarly significant effects, other than refusing payments from sanctioned wallets or regions.

We don't sell personal data, don't use it for advertising, and never publish customer outputs.

Who processes it

To run a node, the relevant parts of your request are sent to the provider of the AI model or data source behind that node. We also use hosting, database and file-storage providers and a payment facilitator to verify and settle payments. These providers act on our instructions or under their own terms for the part they perform. Some are located outside the EEA; where they are, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or adequacy decisions.

Payments happen on the Base blockchain, which is public: wallet addresses and amounts are visible to anyone.

How long we keep it

Call records, requests, outputs and payment records are kept for up to 6 years, which covers accounting and legal limitation periods, unless a longer period is required by law or for an open dispute. Emails are kept as long as needed to handle your request.

Your rights

Under the GDPR you can ask for access to, correction or deletion of your personal data, restriction of or objection to its processing, and data portability. Because we have no accounts, include the wallet address and approximate times of your calls so we can find them. Some records (for example payment and audit records) may need to be kept for legal reasons.

You can complain to the Maltese data protection authority, the Information and Data Protection Commissioner (idpc.org.mt), the UK Information Commissioner's Office (ico.org.uk), or the authority where you live.

California and other US state residents: we don't sell or share personal information for cross-context behavioural advertising, and you can request access to or deletion of your data at the address above.

Free VIN demo

The free VIN demo on the website caches decoded results and limits use per IP address. Don't send data you aren't allowed to share.