PortMulaSign in

Legal

Privacy Policy

DRAFT · COUNSEL REVIEW BEFORE MAINNET

Version 0.3 · draft · mainnet · last updated 20 August 2026

Draft for legal review. Not yet in force. The California and European sections below follow the standard shape but have not been checked by anyone qualified. Whether each regime applies to you at your size is a question for your lawyer.

We collect the minimum needed to run an agent for you: how you sign in, your wallet address, what your agent is told to do, and what it did. We don't sell data, we don't run ads, and we don't ask for your name, address, or date of birth.

Two things deserve your attention. Your agent's instructions and the data it reads are sent to a third-party language model so your agent can think. And every payment your agent makes is written permanently to a public blockchain that nobody — including us — can edit or erase.

Identifiers

Your email address, which sign-in method you used, and the account identifier that method gives us. If you connect a wallet, its public Algorand address. We never receive your Google password.

Your content

Your agent's description and configuration, and the instructions your agent operates under.

Activity

Your agent's run history, the skills it purchased and what each cost, transaction identifiers, and errors. Which pages you visited in the app and when.

Device and network

IP address, browser and operating system, device type, and timestamps. Collected automatically by our hosting.

Inferences

Aggregate usage patterns we derive to improve the product — for example, which parts of the flow people abandon. We do not build advertising or behavioural profiles.

What we deliberately do not collect

Your legal name, postal address, date of birth, government identification, phone number, or any bank or card details. We have never had a reason to ask, and we don't.

  • Directly from you — when you sign in, describe an agent, write an automation's instructions, or email support.
  • Automatically — server logs and strictly necessary cookies, as you use the site.
  • From your sign-in provider — Google or your wallet passes us the minimum identifying information needed to recognise you. We request no more than that.
  • From the blockchain — public, already-published information about addresses your agent interacts with.

For a wallet you connect yourself, we hold nothing but the public address.

For a wallet we create for your agent, we hold the private key in encrypted form, because the agent must sign transactions when you are not present. It is encrypted at rest, never written to logs, never shown to our staff in usable form, and never shared with any third party. Section 4 of the Terms explains exactly what that means for custody, in plain language.

You can export that key at any time and stop relying on us entirely.

  • To run the service — creating your agent, executing runs, settling payments, showing you history.
  • To keep your account working — recognising you at sign-in, linking your methods to one account.
  • To talk to you — sign-in links, paused-automation notices, approvals waiting on you, security notices.
  • To keep it safe — detecting abuse, sybil accounts, and attacks on the service.
  • To improve it — understanding where people get stuck.
  • To obey the law — where we're legally required to retain or produce something.

We use third parties to run the service. Each receives only what its job needs:

  • A language model provider receives your agent's instructions and the data your agent has read, so it can decide what to do. This is the most sensitive sharing we do. Assume anything you put into an agent's instructions is sent to it, and don't write anything there you wouldn't want processed by a third party.
  • Hosting and database providers store your account, agent, and history data.
  • Algorand node providers receive blockchain queries and transactions, which are public anyway.
  • An email provider receives your address to deliver sign-in links and notices.

We also disclose information in these situations:

  • If the law requires it — to comply with a valid legal request, court order, or regulatory obligation.
  • To protect people — where we reasonably believe disclosure is necessary to prevent fraud, harm, or an attack on the service.
  • If the business changes hands — in a merger, acquisition, or sale of assets, your data may transfer to the buyer, who would be bound by a policy at least as protective. We would tell you.

We do not sell your personal information, rent it, or share it for advertising.

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. Without them the app cannot work, so there is nothing to opt out of beyond declining to use the service or blocking them in your browser.

We do not use advertising cookies, tracking pixels, or third-party marketing trackers. If we ever add analytics beyond our own server logs, this section will say so before it happens.

Every transaction your agent makes is recorded permanently on Algorand and is visible to anyone in the world, forever. That includes your wallet address, what it paid, when, and to whom.

We cannot delete this, and neither can you. No deletion request reaches the blockchain. If your address becomes connected to your identity somewhere else — an exchange, a social post, a public donation — that connection is outside our control and outside our ability to undo.

  • Account and agent data — while your account exists, plus up to 30 days in backups after deletion.
  • Run history — 12 months, then deleted.
  • Server and security logs — 90 days.
  • Records we must keep by law — for as long as the law requires.

Whoever and wherever you are, you can ask us to:

  • Show you what we hold about you.
  • Correct anything inaccurate.
  • Delete your account and data.
  • Export your data in a portable format.

Email portmula@willmediaservices.com from the address on your account and we'll respond within 30 days. We may need to verify it's you before acting.

Requests about your data must come by email, not Discord. We need a channel where identity can be verified and a record kept; a chat message is neither.

Deleting your account removes your data from our systems. It does not remove anything from the blockchain, and it does not return your funds — withdraw and export first.

If you live in California, the California Consumer Privacy Act gives you specific rights. The categories of personal information we collect are listed in section 2, the sources in section 3, the purposes in section 5, and the recipients in section 6.

You have the right to know what we collect and why, to obtain a copy, to correct inaccuracies, to delete your information, and to not be discriminated against for exercising any of these rights. We do not charge you differently or degrade your service if you do.

We have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months, and we do not intend to. If that ever changes, this section will say so and an opt-out will be provided before it does.

We do not collect sensitive personal information as the CCPA defines it. To exercise any right, email portmula@willmediaservices.com. An authorised agent may act for you with written proof.

If you are in the European Economic Area or the United Kingdom, we act as the data controller for the information described here.

Our legal bases for processing:

  • Performance of a contract — running your agent, executing runs, maintaining your account. Without this we cannot provide the service you asked for.
  • Legitimate interests — securing the service, preventing fraud and abuse, and improving the product, balanced against your rights.
  • Legal obligation — where a law requires us to retain or disclose something.
  • Consent — for optional messages only. You can withdraw it at any time without affecting anything processed before you did.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with your national supervisory authority. You are not required to provide personal information to enter a contract with us beyond what the service needs to function.

Data is encrypted in transit and at rest. Keys are held encrypted and stored separately from account data. Access is limited to what operating the service requires.

No system is perfectly secure and we won't claim otherwise. If a breach affects your personal information we will notify you and any regulator we are required to notify, without undue delay.

PortMula is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

We and our providers operate in the United States and other countries. Using PortMula means your information may be processed outside the country where you live, including in jurisdictions with different data-protection laws. Where required, we rely on appropriate safeguards for those transfers.

We'll post updates here and change the version stamp above. Material changes will be notified in the app or by email before they take effect.

Will Media Services LLC, Hawai‘i, United Statesportmula@willmediaservices.com

© 2026 Will Media Services LLC · Terms of Service