# UND Assay — Privacy Notice Addendum
version: 1.12
effective: 2026-11-11
operator: Universal Network Development LLC, a Florida limited liability company, doing business as UND Industries ("UND", "we"). UND Assay is a product of UND Industries.

This Addendum adds to the UND Industries Privacy Policy at undindustries.com/privacy (the "Main Privacy Policy") for the UND Assay service at undassay.com. The Main Privacy Policy applies to UND Assay as if undassay.com were named in it, and UND is the controller of the personal data described here. Where they differ about UND Assay, this Addendum controls. Earlier versions are kept at undassay.com/legal.html (Earlier versions).

## 1. Data we collect from account holders
- **Account:** you sign in with your UND account (Google or an emailed code). UND Assay receives your UND account id and email address and records when the account was created. UND Assay never receives or stores a password.
- **Agreements:** which document and version you accepted, the document's SHA-256 fingerprint, the time, your IP address and browser user agent.
- **API and MCP use:** time, endpoint or tool name, query parameter names (not their values), status, response time, your API key or connected-app identifier, your IP address and user agent.
- **Profile (optional):** a display name you choose (any name or nickname; it does not need to be your real name) and a profile picture you upload. We remove photo details such as location before the picture is saved. Only you see them on your account today.
- **Your activity:** tools you watch, the change alerts we create for them, the webhook address you give us and whether deliveries to it succeeded, analyses you request, disputes you file, and domains you claim.
- **Plans and payments (only if you buy):** your plan, billing period (monthly or yearly), number of seats, when the plan renews or ends, the customer and subscription ids Stripe gives us for you, the lookup packs you bought and how many pack lookups you use each day, and which billing emails we sent you. We never see or store your card number.
- **Founding places:** to give one place per person, we keep a keyed hash (HMAC-SHA-256, made with a secret key that only our service holds) of the billing email, never the email itself, with the place number, plan and dates.
- **Referrals:** we keep the member's referral code; for each referral, which member referred which account, its status and dates, and a keyed hash (HMAC-SHA-256, made with a secret key that only our service holds) of the new customer's email, never the email itself. Neither person sees the other's name or email; the member sees only counts. The credit is applied through Stripe (customer balance).
- **Teams:** if you own a team, the email addresses you invited and whether each person joined. A member sees only the owner's email. An invite that is not accepted expires after 7 days; the address stays on your team list, marked expired, until you remove it or delete your account.

**Daily use limit (everyone, with or without an account).** To stop bulk copying of the catalog, we count how many catalog items are viewed each day through the website, the API and the MCP server. For an account, the count is kept under the account. Without an account, it is kept under a one-way code made from your IP address with a secret key; we do not store the address itself in this count. When a visitor says it is a search engine, we check its address with the search engine's published DNS method and keep the result under the same kind of code.

We never store your API keys, access tokens or webhook signing secrets in readable form. We never handle payment card data.

## 2. Change alerts, emails and webhooks
When a tool you watch publishes a version that changed, we record an alert on your account. The alert says which tool changed, the versions, and what changed.
- **Email (off unless you turn it on):** if you turn on alert emails on your account page, we email each new alert to your account's email address from alerts@notify.undassay.com. With alert emails on, we also email you once when an analysis you asked us to run is published. Turn it off there at any time.
- **Webhook:** if you give us a webhook address, we send each alert to it, signed so you can check it came from us. The service at that address (for example Slack or Discord) handles the alert under its own terms. Remove the address at any time on your account page.
- **When our terms change:** if a document you accepted gets a new version, we email your account's address once about that version, from the same sender. This is a service notice about your account, so it is sent even if alert emails are off. We keep a record of which notices we sent.
- **Security notices:** when a new API key is created on your account or an app is connected to it, we email your account's address once about that key or app, from the same sender, so you can spot one you did not make. This is a service notice about your account, so it is sent even if alert emails are off. We keep a record of which notices we sent. Email can be delayed or missed, so the keys and apps on your account page are the full list.
- **Dispute replies:** when we reply to a dispute you filed, or resolve it, we email your account's address our reply, from the same sender. This is a service notice about your dispute, so it is sent even if alert emails are off. We keep a record of which notices we sent. Email can be delayed or missed, so your account page, which shows each dispute and our latest reply, is the full record.
- **Billing emails (only if you buy):** we email your account's address the purchase confirmation with the renewal terms and how to cancel, a reminder 30 to 45 days before a yearly plan renews, and any notice the Terms require before a change to your plan. These are service emails about your purchase, so they are sent even if alert emails are off. We keep a record of which ones we sent.

## 3. Data about people we collect from public sources
Package registries, the official MCP Registry and GitHub publish the names, usernames and profile images of software publishers and maintainers. We show this public information to identify who publishes a tool.
- **Legal basis (EU/UK):** our legitimate interest, and the public's, in knowing who publishes software.
- **Your choice:** you may object or ask for correction at support@undassay.com. We will remove personal details that are not needed to identify a publisher.

## 4. Who processes data for us
- **Cloudflare** hosts the website, the API and the MCP server, stores the database, keeps request logs, forwards email sent to our @undassay.com addresses, protects the service from attacks, and counts visits to our public pages (Cloudflare Web Analytics, see section 7).
- **Supabase** runs UND sign-in (your account id and email address).
- **Stripe** runs checkout, payments, invoices, tax calculation where it applies, and the billing page where you change or cancel a plan. Stripe receives your email address, what you buy, and the payment details you enter on Stripe's own page (card, name, billing address or country). We receive back the ids, the plan, the billing period and whether it was paid. Stripe's privacy policy also applies to what you give Stripe.
- **Resend** sends alert emails and analysis-ready emails if you turn them on, billing emails if you buy, security notices, replies to your disputes, and the one-time email when our terms change (your email address and the message).
- **Google** signs you in if you choose Google.
- **GitHub** stores our source code. It does not receive your account data.

## 5. How long we keep data
| Data | Kept for |
|---|---|
| Account data, watchlist, webhook, requests, disputes, claims | until you delete your account |
| Change alerts | 90 days, then deleted automatically |
| Agreement records on your account | until you delete your account |
| Record of terms-change emails, security notices and dispute-reply emails we sent you | until you delete your account |
| Security audit log, including a copy of each agreement record | kept; it is append-only and tamper-evident so that we can prove what was agreed and investigate abuse, and it is not deleted automatically |
| API/MCP request logs | as long as Cloudflare keeps request logs for our plan (a few days); we do not copy them elsewhere |
| Your display name and profile picture | until you change or remove them, or delete your account; after that, a copy can remain in our database host's automatic restore history (Cloudflare D1) for up to 30 days, then it is gone |
| Daily use counts | 7 days, then deleted automatically |
| Search-engine address checks | 30 days, then deleted automatically |
| Disputes and publisher responses | as long as the related statement is published |
| Plan, billing period, seats, Stripe ids, pack lookups, billing-email records | until you delete your account (a paid plan must be cancelled first) |
| Payment records (invoices: amount, date, what was bought, with the email and billing details you gave Stripe) | in our Stripe account for at least 7 years after the year of the payment, which covers US tax record periods, and longer if the law requires; deleting your UND Assay account does not delete them. Stripe also keeps its own records under Stripe's privacy policy. |
| Team invites not accepted | expire after 7 days; the address stays on the owner's team list, marked expired, until the owner removes it or deletes their account |
| Founding place record | the place stays counted for the offer; when you delete your account, its link to your account is removed |
| Referral email hash | kept after deletion so the same person cannot be referred twice; the code and the links to your account are removed |

## 6. Your rights
On your account page you can download everything UND Assay holds about your account and delete your account. Deleting removes your account, sign-in methods, API keys, connected apps, watchlist, alerts, alert-email setting, terms-change, billing, security and dispute-reply email records, webhook, requests, disputes, claims, lookup packs and team links at once. A paid plan must be cancelled first. What stays is described above: the security audit log, payment records in Stripe, a used founding place without its link to you, and the keyed hash of a used referral. If we corrected a statement because of a dispute you filed, the correction stays in the public corrections log: it holds only the tool, the statement, what we changed and when, never your name, account or what you wrote. You can also write to support@undassay.com to ask for a copy, a correction or deletion.

## 7. Advertising and cookies
Ads from Google AdSense may appear on these public pages: home, browse, tool, publisher, compare and methodology. They never run on the search, sign-in, account, legal, connect, disputes or AI-agent pages, and never inside tool evidence.

On those pages your browser loads ad code from Google, a separate company. Google and its partners may use cookies or similar identifiers to show and measure ads, limit how often you see one, and detect fraud, and may use your visits to this and other sites to personalise ads. Google's own privacy policy covers what Google does with that data; how Google uses information from sites that show its ads is explained at policies.google.com/technologies/partner-sites. We do not give Google your account, your email address or anything you do while signed in.

**Your choices:** you can turn off personalised ads from Google at adssettings.google.com, and opt out of personalised ads from many other companies at aboutads.info/choices (youronlinechoices.eu in Europe). Visitors in the European Economic Area, the UK and Switzerland see Google's consent message about personalised ads. You can also block or delete cookies in your browser; UND Assay keeps working without them.

Paying for ads never changes how a tool is ranked or assessed.

**Cookies:** UND Assay's own cookies keep you signed in and protect sign-in from forgery. Your browser also stores your colour theme. UND Assay itself sets no advertising or tracking cookies; on the ad pages above, Google may.

**Visit counting:** our public pages load Cloudflare Web Analytics to count visits; the sign-in, account, connect and search pages do not. It sets no cookie. Cloudflare shows us only totals, such as which pages were viewed, referring sites, countries, browsers, devices and page load times, not who you are.

## 8. AI clients
When an AI assistant uses the API or MCP server for you, we log the connected app's identifier and your account, not the content of your conversation with the assistant.

**What a connected app can see.** When you connect an app (for example an AI assistant, including SAI, which UND also makes), you approve read-only access. The app can read UND Assay's evidence about tools through the API and MCP server, under your account and its limits. It cannot see your email address, your account settings, your API keys, your watchlist, your webhook or your other connected apps; those are available only on your account page while you are signed in. The app handles what you ask it and what it receives under its own terms and privacy policy. You can disconnect any app at any time on your account page, and the app's access ends at once.

## 9. Age
UND Assay accounts are for people 18 or older.

## 10. Changes
We version this Addendum. When a change is material, we ask you to accept the new version before you continue using account features, the API or the MCP server. Earlier versions stay available.

What changed in 1.10: security notice emails when a new API key is created or an app is connected (section 2), and their records in sections 4, 5 and 6. This adds a protection. It uses details we already hold (your email address, the key's label, the app's name) and keeps a record of each notice sent, deleted with your account, so it is not a material change and you do not need to accept it again.

What changed in 1.11: an email with our reply when we answer or resolve a dispute you filed (section 2), and its record in sections 4, 5 and 6. It uses details we already hold (your email address, the dispute and our reply) and keeps a record of each email sent, deleted with your account, so it is not a material change and you do not need to accept it again.

What changed in 1.12: with alert emails on, one email when an analysis you requested is published (section 2). It uses details we already hold (your email address and your request), is covered by the same on/off switch as alert emails, and its send time is kept on the request, deleted with your account, so it is not a material change and you do not need to accept it again.

## 11. Contact
support@undassay.com. Mailing address: Universal Network Development LLC, PO Box 560422, Orlando, FL 32856-0422.