Last updated: 2026-08-19
This policy describes how Gradient Decisions ("we", "us") handles data in
connection with x402 Merchant Check: the check_merchant MCP tool at
mcp.gradientdecisions.com and the informational site at
gradientdecisions.com. It's written to describe what this system actually does,
not generic boilerplate.
x402 Merchant Check is a pre-payment decision tool for autonomous agents: before paying an
unfamiliar merchant via the x402 protocol, an agent can call check_merchant with a
wallet address and receive an assessment of that merchant's observable on-chain payment
behavior. The merchant data behind this is aggregated from public blockchain activity and
public discovery feeds (Coinbase's x402 Bazaar, PayAI Network, Helius), not collected from
individuals.
We do not have user accounts. There is no sign-up, login, password, or email collection anywhere in this service. There are no cookies, no tracking pixels, and no third-party advertising trackers. What we do collect:
check_merchant,
we log: the paying wallet's address, the merchant wallet it checked, the on-chain payment
transaction hash, the category/price if supplied, and a timestamp. This lets us track usage
of the service and, in aggregate, understand who's using it and how often.
We never attempt to link a wallet address to any off-chain identity: a name, an email address, an IP-derived identity, or any other real-world identifier. This is a deliberate design principle applied consistently throughout this system, not just a policy statement. Nothing in our code performs or attempts identity resolution.
Infrastructure-level logging. This service runs on Cloudflare Workers. Cloudflare, as our hosting/CDN provider, processes standard technical request data (e.g. IP addresses, request metadata) as part of operating its network. This is typical of any Cloudflare-hosted service and is governed by Cloudflare's own role as an infrastructure provider, not data we separately collect or store ourselves beyond what's described above.
check_merchant returns. As of 2026-08-19 that assessment is only served through
the paid check_merchant MCP tool, not a public dashboard or API.Payments are made via the x402 protocol in USDC on Base mainnet. Payment verification and settlement is performed by Coinbase's CDP facilitator infrastructure, not by us directly. We receive and store the resulting on-chain transaction hash as proof of payment, which is itself public blockchain data.
We do not sell wallet-level data. We do not share caller wallet data with third parties for advertising or marketing purposes. We do pull from public third-party data sources to build merchant assessments (Coinbase's x402 Bazaar, PayAI Network, Helius). That is data we read, not data we send about our users.
We do not currently run an automated data-deletion or expiry process. Data we've collected is retained indefinitely unless removed on request (see "Your rights" below) or as our practices evolve. Because wallet addresses and transaction hashes are inherently public blockchain data, removing a record from our own database does not remove the underlying on-chain transaction itself, which remains publicly visible on the relevant blockchain regardless of what we do.
Because we don't collect off-chain identity and don't operate accounts, we have no way to independently verify that a request relates to "your" wallet versus anyone else's. Requests are handled on a best-effort, case-by-case basis. If you'd like us to look into or remove data associated with a specific wallet address from our own systems, contact us at the address below with the wallet address in question. We'll respond and do what we reasonably can, with the caveat above about on-chain data being independently public regardless of what we do on our end.
If you are located in a jurisdiction with specific statutory rights over personal data (e.g. GDPR in the EU/UK, CCPA in California), we intend to honor requests consistent with those rights to the extent they apply to the limited, wallet-address-level data described in this policy. Contact us and we'll work through it with you.
This service is not directed at children, is not marketed to children, and we do not knowingly collect data about children. Given the nature of the service (a paid, machine-to-machine tool called by autonomous agents over MCP), we don't expect or intend for it to be used by children directly.
We may update this policy as the service changes. Material changes will update the "Last updated" date above. Continued use of the service after a change constitutes acceptance of the updated policy.
Questions about this policy, or requests regarding data associated with a specific wallet address, can be sent to: info@gradientdecisions.com
This policy was drafted to accurately describe this system's real, built data practices as of the date above. It has not been reviewed by a lawyer. If you are relying on this policy for regulatory compliance purposes, we recommend having it reviewed by counsel familiar with the jurisdictions your users are in.