Makings Privacy Notice
Version: privacy-2026-10-06
Effective:
Who is responsible
brainAI, a business based in Cyprus ("brainAI", "we"), is the controller of the personal data described here. Makings is a brainAI product. Email: info@makings.lol. X: @makingsHQ.
The short version
- makings.lol sets no cookies and runs no analytics, ads or tracking. It loads nothing from other companies. Our API sets no cookies either.
- We do not record visits to makings.lol or to our API, and our API never stores or logs your IP address.
- When your agent buys, we keep the records needed to run the order and our accounts. We know your agent only by the wallet address it pays from.
- Payments happen on Base, a public blockchain. Anyone can see wallet addresses and transactions there, and nobody can delete them.
What we collect and why
Visiting the site (makings.lol)
- We keep no access logs of visits.
- If a request fails, our server's error log may include the connecting IP address. We use it only to keep the service secure and working, and we keep it for up to 30 days. The legal basis is our legitimate interest in running a secure service.
Contacting us
- If you write to info@makings.lol, we receive your email address and your message, and use them to reply. The mailbox is forwarded by our domain provider.
- If you message or mention @makingsHQ on X, we receive your X account name and profile and your message, and use them to reply. X handles them under its own privacy policy.
- We keep the correspondence as long as we need it to deal with your message, then delete it. The legal basis is our legitimate interest in answering you.
Buying on Makings (through your agent)
- What we keep:
- the wallet address that signed each payment, and the addresses any refund was sent from and to;
- the request identifiers (idempotency keys) your agent sends;
- quotes and orders, including product, version, licence, prices and times;
- payment records, such as transaction hashes and settlement status, and each signed payment authorization's nonce and validity window (we don't keep the signature);
- the facilitator's checks on your payment, including any risk-screening refusal;
- licence grants;
- a hash of the paying wallet address, used to match download proofs to that wallet;
- a fingerprint of each signed proof, so that no proof can be used twice;
- download and re-issue events;
- the finality checks we make on your payments (block numbers and hashes, which are public on Base);
- receipts, which include the paying wallet address and the transaction hash;
- your agent's delivery acknowledgements;
- remedies and refunds, including the refund transaction.
- Our API uses your agent's IP address only in memory, to apply rate limits. We don't store or log it.
- Our API logs one line for each delivery request: the time, the route, the order ID and the outcome. Our payment checks log order IDs, outcome codes and, for some problems, a transaction hash. These logs never include IP addresses or wallet addresses. Our database's own logs may record values such as a wallet address. We use all of these logs to secure and operate the service, and keep them for up to 30 days.
- Operator tasks, such as recording a refund, log the order ID and the transaction hashes involved. We keep those logs for up to 90 days.
- Why:
- to provide what you bought (performing our contract with you);
- to prevent fraud and abuse, and secure the service (legitimate interest);
- to keep the accounting and tax records the law requires (legal obligation).
Selling on Makings (once shops beyond Makings open)
- Not in effect yet. Before shops beyond Makings open, we will update this notice to say what we keep about sellers and the files they upload.
We don't sell personal data, and we don't use it for advertising.
Public blockchain data
Payments use USDC on Base. Wallet addresses, amounts and transaction hashes are published on the blockchain by design. We can't change or remove them. If you don't want a wallet linked to you publicly, don't use one that is.
Transfers outside the EU
Most processing happens in the EU. Some providers can handle data outside the EU: Coinbase, GitHub and our domain and email provider can do so in the United States, and our blockchain data providers wherever their servers are. Where a provider handles data outside the EU, we rely on an adequacy decision, such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.
How long we keep it
- Error logs, API and payment logs, and database logs: up to 30 days.
- Operator task logs: up to 90 days.
- Emails and X messages: as long as needed to deal with the message.
- Orders, payments and receipts: at least 6 years after the end of the tax year of the order, to meet accounting and tax rules. Our system does not yet delete them automatically after that; we will put deletion in place before the first records reach that age. Our access to the files you bought is a separate matter, covered in the Terms.
- Backups: database backups are kept for 14 days, so data removed from the live database can remain in backups for up to 14 days.
- Blockchain records: permanent, and not in our control.
Your rights
You can ask us for access to your personal data, or ask us to correct, delete, restrict or transfer it. You can also object to our use of it. Write to info@makings.lol. We know buyers only by wallet address, so we will ask you to prove a wallet is yours by signing a message with it.
Order, payment and delivery records can't be corrected or deleted while we keep them: they are the record of what was sold and paid, and some have to be kept by law. Blockchain data can't be deleted by anyone.
You can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).
Security
- Traffic between your agent and us, and between our systems and our providers, is encrypted in transit. Our database and file storage are encrypted at rest.
- Access to our systems is restricted.
- We never ask for your private keys or seed phrases.
Children
Makings is not for anyone under 18.
Changes
If we change this notice, we post the new version here with its effective date.
Contact
brainAI, Cyprus. Email: info@makings.lol. X: @makingsHQ.