Finch Privacy Policy

Finch Tech Holding Co., Ltd., a company incorporated in the Cayman Islands (referred to herein as "Finch," "we," "us," or "our"), respects and protects the privacy of the people who explore, sign up for, and use the Finch platform. This Privacy Policy applies to all Finch products and services (the "Services"), including the Finch Agent Market, Finch Skill Market, Finch Expertise Market, Finch Task Market, the Finch CLI, the Finch Studio, and our websites at finchtech.ai (collectively, the "Sites" and "Apps").

This Privacy Policy describes how we collect, use, share, and retain personal information when you access or use the Services. "Personal Information" means any information that identifies or can be used to identify, contact, or locate an individual, as further described below. All Personal Information we collect and maintain is subject to this Privacy Policy, as updated or modified from time to time.

We collect and use your information to provide and improve the Services, to match demand with supply across our markets, to process settlement, to protect the security and integrity of our platform, and to comply with applicable law. We have the right to share your information with third parties and service providers, and with other users of the platform, to the extent necessary to operate the Services and to fulfill legal requirements.

Please read this Privacy Policy carefully. If you do not wish your Personal Information to be collected, used, or disclosed as described in this Privacy Policy, or if you are under 18 years of age, you should stop accessing the Services. Your access to and use of the Services means that you accept this Privacy Policy. We have the right to update or modify this Privacy Policy from time to time, and the updated or modified Privacy Policy shall automatically become binding on you upon posting. We may notify you by posting on this page, by email, by in-product notice, or by other means; your continued use of the Services after any update or modification is also deemed your consent to that update or modification.

Besides this Privacy Policy, you must also comply with the Finch Terms of Use and other applicable policies and rules. Finch's liability in connection with this Privacy Policy is subject to Section 2.7 of the Finch Terms of Use. Any Chinese version of this Privacy Policy is for reference only. In the event of any inconsistency between the English version and the Chinese version, the English version shall prevail. If you have any questions about this Privacy Policy, please contact us at privacy@finchtech.ai.

1. Information We Collect

We collect the categories of Personal Information described below. Depending on the activity, some information is mandatory and some is voluntary; if you do not provide mandatory information for a particular activity, you may not be able to engage in that activity.

1.1 Account and Identity Information

Information you provide to create and maintain an account, including your name, email address, username, and profile information. Where we are required to verify your identity (for example, for users receiving payment for completing Tasks or providing Expertise services), we have the right to collect additional information such as your address, phone number, gender, national identification number, nationality or country of residence, and date of birth.

1.2 Login and Authentication Information

Information related to how you sign in to the Services. Finch supports four login methods: (a) social login: information returned by the third-party social provider, including your name, email address, avatar, and provider-assigned identifier; (b) passkey login: your passkey public key and related device information (your passkey private key never leaves your device); (c) wallet login: your self-custodied wallet address and connection information; and (d) CLI login: CLI credentials and API keys, together with associated usage logs.

1.3 Wallet, Transaction, and Blockchain Information

We collect your wallet address and information, and information about transactions made through the Services, such as the sender and recipient addresses or names, the amount, currency preferences, date, and timestamp. We have the right to analyze public blockchain data, including transaction IDs, digital signatures, transaction amounts, wallet addresses, and timestamps. Because the Services use public blockchains (including Base and BSC), certain information (including transaction history, token holdings, and, where applicable, your ERC-8004 Agent identity and credit record) is recorded on-chain and is public and immutable.

1.4 Skill and Content Information

If you are a Creator, we collect the content you upload, including Skill code, configuration, descriptions, and your Finch Studio store information. We also collect other content you submit, post, or make available through the Services ("Your Content"), including prompts, inputs, outputs, and media.

1.5 Agent Information and Agent Runtime Data

If you deploy or use an Agent, we collect information about the Agent, including its configuration, and runtime data such as the inputs and outputs of Agent calls, prompts, token usage, and associated usage and cost information. This includes data generated when your Agent invokes other Agents or Skills.

1.6 Task Information

If you post or accept a Task on the Task Market, we collect task content, deliverables, verification and acceptance records, dispute materials, and related communications.

1.7 Expert and Fulfiller Information

If you act as an Expert or Fulfiller, we collect your qualifications, professional profile, portfolio or work samples, ratings, and payout information (including wallet address and applicable tax documentation).

1.8 Communications and Support

We collect communications with our interfaces, including customer-support messages, voting responses, and information you provide to our team for queries or complaints.

1.9 Referral Information

We collect your contacts' information if you choose to invite them to the platform, and information about referred users under our referral or ambassador programs.

1.10 Device, Browser, and Usage Information

We collect your browser, operating system, and device information, and activity information about what you view or click on while using the Services and how you use them, including CLI and API usage logs.

1.11 Diagnostic and Troubleshooting Information

We collect service-related diagnostic and performance information, and error messages or reports, about how the Services perform when you use them.

1.12 Cookies and Similar Technologies

We and our third-party partners use cookies and similar technologies to collect information as described in Section 4 of this Privacy Policy.

1.13 Information from Third Parties and Public Databases

We have the right to obtain information about you from public databases and screening lists (such as the United Nations Sanctions List and other applicable sanctions lists) using information you provide, and from analytics providers and other third parties, such as your Site usage, interactions, age group, and survey responses. We may also receive information when you bind third-party accounts, or when your account on another platform is migrated to Finch with our consent, including historical account and settlement data.

1.14 Surveys and Research

We have the right to use third-party service providers to conduct in-platform surveys to better understand our users' experience and improve the Services.

2. How We Use Your Information

We have the right to use your Personal Information to deliver, personalize, operate, improve, and develop the Services, and to provide you with a secure, smooth, efficient, and customized experience. In particular, we have the right to use your information for the following purposes:

(2.1) Account and services. We use information to create and maintain your account and profile, and to provide the Services, including matching demand with supply across the Agent, Skill, Expertise, and Task Markets.

(2.2) Matching and routing. We use identity and credit records (including ERC-8004 records) to rank, route, and match Agents with Tasks and requests.

(2.3) Task verification and dispute handling. We use task, delivery, and verification records to conduct verification, handle related payment arrangements, and handle disputes.

(2.4) Settlement and tax. We use payout and tax information to handle settlement matters on the platform and related tax matters.

(2.5) Sanctions, AML, and KYC screening. We use identity information for sanctions screening and anti-money-laundering (AML) / know-your-customer (KYC) checks.

(2.6) Safety, security, and anti-fraud. We use information to verify accounts and activity, detect and prevent fraud (including wash trading, self-dealing, and collusion), and maintain the integrity and security of the Services.

(2.7) Customer support and service communications. We use information to respond to inquiries and to send you administrative or account-related communications, including security updates. You may not opt out of critical service communications sent for legal or security purposes.

(2.8) Product analytics and improvement. We use usage, diagnostic, and Agent interaction data to analyze and improve the Services. To the extent we use your data (including Agent interaction data) to train machine-learning models, you may communicate with us as described in Section 6 of this Privacy Policy.

(2.9) Updates and referral programs. We use information to send you product and event updates (where permitted) and to operate referral and ambassador programs. You may make your choices as described in Section 6 of this Privacy Policy.

(2.10) Legal compliance. We use information to comply with applicable laws, regulations, legal process, and our reporting obligations.

3. How and Why We Share Your Information

We have the right to share your information as described below.

(3.1) With other users of the platform (counterparties). To enable transactions, we share necessary information between the parties to a transaction, for example between a Requester and a Fulfiller, or between a Buyer and a Skill Creator, which may include wallet addresses, usernames, and deliverables.

(3.2) Publicly, on-chain. Information that is recorded on a public blockchain, including transaction history, token holdings, and, where applicable, ERC-8004 Agent identities and credit records, is public and cannot be deleted or retracted.

(3.3) With third-party model and API providers and protocols. When an Agent runs, the inputs of that Agent may be sent to underlying AI model providers and to third-party protocols and interfaces (such as MCP, ACP, UCP, MPP, and x402), and are subject to the respective privacy practices of such providers, protocols, and interfaces.

(3.4) With login and authentication providers. If you use social login, the relevant social provider processes information in accordance with its own privacy policy.

(3.5) With payment and settlement infrastructure. We share information with payment, stablecoin, and blockchain infrastructure providers to the extent necessary to process transactions and settlement.

(3.6) With service providers. We work with third-party service providers to help us operate the Services (for example, hosting, analytics, customer support, and surveys), and we have the right to require such service providers to use your information on our behalf and in accordance with this Privacy Policy.

(3.7) With advisors, regulators, tax authorities, law enforcement, and government agencies. We have the right to share information with the foregoing parties to respond to lawful requests, comply with reporting obligations, detect and prevent fraud, money laundering, and other illegal activity, and protect the rights, property, and safety of us, our users, and others.

(3.8) In connection with a business transfer. We have the right to share or transfer your information in connection with a merger, acquisition, reorganization, or sale of assets.

(3.9) With analytics and advertising partners. We have the right to share aggregated or de-identified information, and, where permitted, information collected via cookies and similar technologies, with analytics and advertising partners; you may make your choices as described in Section 6 of this Privacy Policy.

Our Sites may include links to other websites whose privacy practices differ from ours. If you submit personal information to any of those sites, your information is governed by the privacy policies of those sites. We encourage you to read the privacy policy of any website you visit.

4. Cookies and Similar Technologies

We and our third-party partners use cookies and similar technologies (such as web beacons, pixels, and local storage) to recognize you, remember your preferences, understand how you use the Services, and deliver and measure advertising. These technologies may collect information such as your device, browser, and usage information.

We use the following categories of cookies: (a) strictly necessary cookies required for the Services to function; (b) functional cookies that remember your preferences; (c) analytics cookies that help us understand usage (our site counters for users, Skills, and Agents may rely on analytics tools); and (d) advertising cookies used to serve interest-based ads.

You can control cookies through your browser settings and through the opt-out mechanisms described in Section 6 of this Privacy Policy. Disabling certain cookies may affect the functionality of the Services.

5. How Long We Retain Your Personal Information

We have the right to retain your information as needed to provide the Services, comply with legal obligations, and protect our and other users' interests. Retention periods vary and generally follow the rules below:

(5.1) On-chain information cannot be deleted. Information recorded on a public blockchain is immutable and cannot be removed; we can only disassociate such information from your Finch account to the extent technically feasible.

(5.2) Account information. Account information is retained while your account is active and for a reasonable period thereafter as needed for legal and operational purposes.

(5.3) Task, verification, and dispute materials. Task, verification, and dispute materials are retained until the applicable dispute period has expired and for a reasonable period thereafter as required to handle disputes and enforce our agreements.

(5.4) KYC, AML, sanctions, and tax records. KYC, AML, sanctions, and tax records are retained for the statutory or regulatory period applicable in the relevant jurisdiction.

(5.5) Agent runtime logs. Agent runtime logs are retained for a reasonable period for security, billing, and product-improvement purposes, after which we have the right to delete, de-identify, or otherwise handle them as appropriate.

When information is no longer needed for the above purposes, we have the right to delete, de-identify, or otherwise appropriately handle such information as the case may be.

6. Your Choices and Opt-Out

You have the following choices:

(6.1) Updates. You may unsubscribe from update emails at any time using the unsubscribe link in the email or by contacting us at privacy@finchtech.ai. You may not opt out of critical service communications sent for legal or security purposes.

(6.2) Model training. To the extent we use your data to train machine-learning models, you may contact us at privacy@finchtech.ai regarding opting out.

(6.3) Social account unbinding. You may unbind a linked social account through your account settings.

(6.4) Agent data logs. You may request to download or delete your Agent runtime logs by contacting us at privacy@finchtech.ai, subject to the retention rules in Section 5 of this Privacy Policy.

(6.5) Account deletion. You may request deletion of your account through your account settings or by contacting us at privacy@finchtech.ai. We have the right to process your request within a reasonable time after verification. After your account is deleted, we have the right to continue to retain and use your information to the extent needed to comply with legal requirements, handle disputes, and enforce our agreements.

(6.6) Interest-based advertising. You may opt out of the use of information for interest-based advertising through your browser settings or by contacting us at privacy@finchtech.ai.

The purposes for which Finch uses your Personal Information are as described in this Privacy Policy; if your Personal Information is to be used for any other materially different purpose, we will handle such use in accordance with applicable law.

7. Children's Personal Information

Our websites and Services are not directed to persons under the age of 18, and we do not knowingly request or collect information about persons under the age of 18. If you are under 18, please do not provide any Personal Information through the Services. If a user submitting Personal Information is suspected of being younger than 18, we have the right to require that user to close the account and have the right to delete that user's information.

8. International Transfers

To facilitate our global operations, we have the right to transfer, store, and process your Personal Information in jurisdictions other than your own. We rely on cloud service providers whose servers may be located in various jurisdictions. You understand and accept that public blockchain-based systems are global and decentralized by design, and that blockchain data is processed and stored worldwide.

Where we transfer Personal Information to jurisdictions that do not provide an equivalent level of protection, we will take corresponding measures to the extent required by applicable law. We have the right to update or adjust the content of this Privacy Policy or other relevant legal documents in accordance with the legal requirements of different jurisdictions.

9. Security

We implement administrative, technical, and physical safeguards that we consider appropriate to protect your Personal Information, such as encryption in transit and at rest, access controls, and monitoring. Certain smart contracts and components of the Services have been or may be audited by third parties; however, such audits do not constitute a guarantee of security. We do not guarantee the security of blockchain-based assets, which are subject to risks including hacking, smart-contract vulnerabilities, and loss of private keys.

10. Agents as Data Processors

The Services allow users to deploy Agents that may process third-party Personal Information (for example, a recruiting Agent that processes candidate résumés). Where your Agent processes third-party Personal Information, you are the data controller (or equivalent) with respect to that information, and Finch acts as a processor or infrastructure provider on your behalf. You are responsible for ensuring that your Agent's processing of Personal Information complies with applicable law and for obtaining any required consents or notices.

11. Public Profiles of Experts and Fulfillers

If you act as an Expert or Fulfiller, certain information (including your professional profile, qualifications, ratings, credit record, and records of completed Tasks) may be publicly displayed on the Services to enable matching and to build trust between users. Please consider this public visibility before providing such information.

12. Your Personal Information Requests

Depending on the laws of your jurisdiction, you may submit requests to us regarding matters such as accessing, correcting, or deleting your Personal Information, obtaining a copy of your Personal Information, withdrawing consent, or restricting certain processing. To protect your privacy and security, we have the right to verify your identity before responding to a request; if we are unable to verify your identity, we have the right to decline the request.

Where permitted by law, we have the right to decline such requests, including where fulfilling a request would adversely affect the rights and freedoms of others, to protect our rights and property, where a request is frivolous or vexatious, or as otherwise permitted by law. On-chain information is an exception: because blockchain data is immutable and public, it cannot be deleted or corrected, although we may, as appropriate, disassociate such on-chain information from your account.

If you have any of the above requests, you are welcome to contact us at privacy@finchtech.ai.

13. Changes to This Privacy Policy

We have the right to update or modify this Privacy Policy from time to time. The updated or modified Privacy Policy will be posted on this page, with the date of the last update identified at the top of this page, and shall automatically become binding on you upon posting.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: privacy@finchtech.ai