Privacy policy
Warns is published by Saira SAS, 173 rue de Courcelles, 75017 Paris, France (RCS Paris 130 728 926). Saira is the controller of the personal data described here. For any question or request, write to hello@warns.xyz.
We collect as little as we can. We do not sell data, we do not use advertising trackers, and we do not set analytics cookies.
What we collect, and why
| Where | Data | Why | Legal basis |
|---|---|---|---|
| Early access form | Your email address, the country your request came from, your browser's user agent | To contact you about early access | Your consent, given by submitting the form |
| Dashboard sign-in | Your GitHub login, name, public email address and avatar | To create your workspace and let you sign in | Performance of the service you ask for |
| Dashboard and API | The agents you register, their wallet addresses, the payments your agents ask Warns to evaluate (amounts, destinations, the URLs paid), the decisions and their attestations | To evaluate payments, show them to you and keep an auditable record | Performance of the service |
| Alerts | The webhook address you set, and the email addresses of your workspace members | To tell you when a payment is held for your review or an agent is frozen. Alerts go only to the channels you configure | Performance of the service |
| Network protection | From the payments your agents ask Warns to evaluate: the merchant's site and path (never the query string), the recipient address, the token, the amount and the outcome | To recognize, for every customer, the recipient addresses and merchants that behave suspiciously, and the price a merchant usually charges. Only aggregates are shared between customers: never your workspace, your agents, your wallets or the query strings of the URLs you pay | Our legitimate interest, and yours, in preventing fraud |
| Public traps | The wallet address that paid a trap, the amount and the transaction | To show you, on the results page, what your agent paid | Our legitimate interest in running the test |
| Scanner | The URL you scan, without its query string, and the report | To show the result and let you share it with its link. Nothing about who scanned is kept | Our legitimate interest in offering the tool |
Wallet addresses and transactions on a public blockchain are public by nature. Warns never receives or stores private keys.
Data we process without keeping it
- IP addresses. The early access form, the scanner and the traps use your IP address to limit abuse. It is held in memory for a few minutes at most to count requests, then dropped. It is not stored with your email.
- Bot protection. The early access form and the scanner use Cloudflare Turnstile, which looks at signals from your browser to tell people from bots. Cloudflare processes these signals under its own privacy policy.
- Technical logs. Our hosting providers keep short-lived technical logs (request time, status, IP address) for security and troubleshooting.
Cookies
The dashboard sets one cookie, the session cookie that keeps you signed in. It is strictly necessary and set only after you sign in. The website, the blog and the traps set no cookies of their own. Cloudflare may set a technical cookie needed for its bot protection. None of these require consent.
How long we keep it
| Data | Kept |
|---|---|
| Early access email | Until early access is offered to you, or three years after our last exchange, whichever comes first. You can ask us to delete it at any time. |
| Dashboard account | While your workspace exists. Deleted within 30 days after you ask us to close it. |
| Decisions and attestations | While your workspace exists, as an audit record of what your agents were allowed to pay. |
| Network observations | 13 months, then only daily aggregates per merchant remain. They are deleted with your workspace; aggregates already computed stay. |
| Trap results | 30 days, then deleted automatically. |
Who processes it for us
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Website, traps, bot protection, DNS | United States and worldwide network |
| Vercel Inc. | Dashboard | United States |
| Railway Corporation | Decision API and database | United States |
| GitHub, Inc. | Sign-in | United States |
| Resend, Inc. | Alert emails, when you turn them on | United States |
| OVH SAS | France |
Some of these providers are outside the European Union. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
Your rights
You can ask to access, correct or delete your data, to receive it in a portable format, to restrict its processing, or to object to it. When processing relies on your consent, you can withdraw it at any time, without affecting what was done before. Write to hello@warns.xyz. We answer within one month.
If you think your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority, at cnil.fr.
Changes
We will update this page when what we collect changes, and change the date at the top. If a change affects how we use data we already hold, we will tell you by email first.