# UND Assay — Privacy Notice Addendum
version: 1.1
effective: 2026-11-01
operator: Universal Network Development LLC, a Florida limited liability company ("UND", "we")

This Addendum adds to the UND Industries Privacy Policy at undindustries.com/privacy (the "Main Privacy Policy") for the UND Assay service at undassay.com. The Main Privacy Policy applies to UND Assay as if undassay.com were named in it, and UND is the controller of the personal data described here. Where they differ about UND Assay, this Addendum controls. Earlier versions are kept at undassay.com/legal.html (Earlier versions).

## 1. Data we collect from account holders
- **Account:** you sign in with your UND account (Google or an emailed code). UND Assay receives your UND account id and email address and records when the account was created. UND Assay never receives or stores a password.
- **Agreements:** which document and version you accepted, the document's SHA-256 fingerprint, the time, your IP address and browser user agent.
- **API and MCP use:** time, endpoint or tool name, query parameter names (not their values), status, response time, your API key or connected-app identifier, your IP address and user agent.
- **Your activity:** tools you watch, the change alerts we create for them, the webhook address you give us and whether deliveries to it succeeded, analyses you request, disputes you file, and domains you claim.

We never store your API keys, access tokens or webhook signing secrets in readable form. We never handle payment card data.

## 2. Change alerts, emails and webhooks
When a tool you watch publishes a version that changed, we record an alert on your account. The alert says which tool changed, the versions, and what changed.
- **Email (off unless you turn it on):** if you turn on alert emails on your account page, we email each new alert to your account's email address from alerts@notify.undassay.com. Turn it off there at any time.
- **Webhook:** if you give us a webhook address, we send each alert to it, signed so you can check it came from us. The service at that address (for example Slack or Discord) handles the alert under its own terms. Remove the address at any time on your account page.
- **When our terms change:** if a document you accepted gets a new version, we email your account's address once about that version, from the same sender. This is a service notice about your account, so it is sent even if alert emails are off. We keep a record of which notices we sent.

## 3. Data about people we collect from public sources
Package registries, the official MCP Registry and GitHub publish the names, usernames and profile images of software publishers and maintainers. We show this public information to identify who publishes a tool.
- **Legal basis (EU/UK):** our legitimate interest, and the public's, in knowing who publishes software.
- **Your choice:** you may object or ask for correction at support@undassay.com. We will remove personal details that are not needed to identify a publisher.

## 4. Who processes data for us
- **Cloudflare** hosts the website, the API and the MCP server, stores the database, keeps request logs, forwards email sent to our @undassay.com addresses, and protects the service from attacks. Cloudflare Web Analytics counts page views without cookies; visits from the EU are not counted.
- **Supabase** runs UND sign-in (your account id and email address).
- **Resend** sends alert emails if you turn them on, and the one-time email when our terms change (your email address and the message).
- **Google** signs you in if you choose Google.
- **GitHub** stores our source code. It does not receive your account data.

## 5. How long we keep data
| Data | Kept for |
|---|---|
| Account data, watchlist, webhook, requests, disputes, claims | until you delete your account |
| Change alerts | 90 days, then deleted automatically |
| Agreement records on your account | until you delete your account |
| Record of terms-change emails we sent you | until you delete your account |
| Security audit log, including a copy of each agreement record | kept; it is append-only and tamper-evident so that we can prove what was agreed and investigate abuse, and it is not deleted automatically |
| API/MCP request logs | as long as Cloudflare keeps request logs for our plan (a few days); we do not copy them elsewhere |
| Disputes and publisher responses | as long as the related statement is published |

## 6. Your rights
On your account page you can download everything UND Assay holds about your account and delete your account. Deleting removes your account, sign-in methods, API keys, connected apps, watchlist, alerts, alert-email setting, terms-change email records, webhook, requests, disputes and claims at once; the security audit log keeps its entries as described above. You can also write to support@undassay.com to ask for a copy, a correction or deletion.

## 7. Advertising and cookies
Today the ad spaces on public pages show only our own promotions; no ad network runs on UND Assay. If we turn on Google AdSense, it will appear only on public pages (home, search, tool, publisher, compare and methodology), never on the sign-in, account, legal, connect, disputes or AI-agent pages and never inside search results or tool evidence. We will update this notice before that happens, including how Google uses cookies and your choices about personalised ads.

Paying for ads never changes how a tool is ranked or assessed.

**Cookies:** UND Assay's own cookies keep you signed in and protect sign-in from forgery. Your browser also stores your colour theme. We set no advertising or tracking cookies.

## 8. AI clients
When an AI assistant uses the API or MCP server for you, we log the connected app's identifier and your account, not the content of your conversation with the assistant.

**What a connected app can see.** When you connect an app (for example an AI assistant, including SAI, which UND also makes), you approve read-only access. The app can read UND Assay's evidence about tools through the API and MCP server, under your account and its limits. It cannot see your email address, your account settings, your API keys, your watchlist, your webhook or your other connected apps; those are available only on your account page while you are signed in. The app handles what you ask it and what it receives under its own terms and privacy policy. You can disconnect any app at any time on your account page, and the app's access ends at once.

## 9. Age
UND Assay accounts are for people 18 or older.

## 10. Changes
We version this Addendum. When a change is material, we ask you to accept the new version before you continue using account features, the API or the MCP server. Earlier versions stay available.

## 11. Contact
support@undassay.com