# UND Assay — Privacy Notice Addendum
version: 0.2-draft
effective: not in force (draft pending legal review)

> DRAFT. Under legal review; not yet in force. It adds to the UND Privacy Policy at universalnetworkdevelopment.com/docs/privacy.html.

## 1. Data we collect from account holders
- **Account:** you sign in with your UND account (Google or an emailed code). UND Assay receives your UND account id and email address and records when the account was created. UND Assay never receives or stores a password.
- **Agreements:** which document and version you accepted, the document's SHA-256 fingerprint, the time, your IP address and browser user agent. We keep these to show what you agreed to.
- **API and MCP use:** time, endpoint or tool name, query parameter names (not values), status, response time, your API key or connected-app identifier, your IP address and user agent.
- **Your activity:** tools you watch, analyses you request, disputes you file, domains you claim.

We never store your API keys or access tokens in readable form (only their hashes), and we never handle payment card data (Stripe does).

## 2. Data about people we collect from public sources
Package registries, the official MCP Registry and GitHub publish the names, usernames and profile images of software publishers and maintainers. We show this public information to identify who publishes a tool.
- **Legal basis (EU/UK):** our legitimate interest, and the public's, in knowing who publishes software.
- **Your choice:** you may object or ask for correction at support@universalnetworkdevelopment.com. We will remove personal details that are not needed to identify a publisher.

## 3. How long we keep data
| Data | Kept for |
|---|---|
| Agreement records | life of the account plus 7 years |
| API/MCP request logs | 90 days (IP addresses shortened after 30 days) |
| Security and admin audit log | 2 years |
| Disputes and publisher responses | as long as the related statement is published |
| Account data | until you delete your account (except records we must keep by law) |

## 4. Your rights
You can ask for a copy of your data, correction, or deletion. Write to support@universalnetworkdevelopment.com.

## 5. Advertising and cookies
Some public pages (home, search, tool, publisher, compare and methodology) may show ads from **Google AdSense** in the side margins on wide screens.
- Ads never appear on the sign-in, account, legal, connect, disputes or AI-agent pages.
- Ads never appear inside search results or tool evidence.
- Paying for ads never changes how a tool is ranked or assessed.

**Google's role:** Google and its partners may use cookies or similar identifiers to show and measure ads, including personalised ads where the law allows. In the EU, the UK and Switzerland, ads follow the choice you make in Google's consent message. See how Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites. You can turn off personalised ads at https://adssettings.google.com.

**UND Assay itself:** UND Assay sets no advertising or tracking cookies of its own. Its only cookies keep you signed in and protect sign-in from forgery.

## 6. AI clients
When an AI assistant uses the API or MCP server for you, we log the connected app's identifier and your account, not the content of your conversation with the assistant.