F5ai privacy notice

Data we handle

• Account email, account and tenant identifiers, session and confirmation records, package selection, membership, and account status.
• Discord user and guild identifiers, installation and authority status, approved channel and role identifiers, and customer-directed message or action content.
• Subscription and checkout status plus Stripe customer, price, session, subscription, and event references. Stripe handles payment-card entry; F5ai does not store card numbers.
• Public Cardano stake, payment, and payout addresses, policy holdings evidence, verification timestamps, and proof hashes.
• API and internal executor identifiers, public keys, hashed credentials, readiness heartbeats, action commands, action state, bounded results, receipts, and audit records.
• Request data used to prevent abuse. The application hashes signup source addresses for throttling, and infrastructure providers may keep standard security logs.

Why we use it

We use this data to authenticate owners, confirm Discord authority, provision subscriptions and hosted execution, execute customer-directed services, verify public-chain holdings, deliver and audit actions, prevent abuse, troubleshoot failures, and keep necessary business, security, and accounting records.

Rule-based holdings checks can affect Partner pricing, holder roles, or giveaway eligibility. These decisions use configured thresholds rather than AI profiling. Contact us if a result appears wrong.

Where data goes

F5ai uses service providers where needed: Resend for confirmation email, Discord for OAuth and community operations, Stripe for hosted checkout and subscriptions, Koios or other Cardano data providers for public-chain queries, and infrastructure providers that host the service. A customer-selected AI or action provider receives the bounded response to an action it sends.

Public Cardano addresses and transactions are visible on-chain. Community operators also control the Discord content and member identifiers they submit to F5ai.

Wallet and agent boundaries

F5ai temporarily processes a wallet proof and public key to verify control, then retains public addresses and proof hashes rather than the raw signature. Seed phrases, recovery material, signing keys, witnesses, transaction CBOR, transaction construction, and submission remain in the customer environment. F5ai does not operate a hosted prize-wallet authority.

The agent contract is limited to bounded customer actions across entitled Discord, wallet identity, wallet role, customer wallet capability, and giveaway families. It excludes account, billing, wallet proof, admin, internal transport, wallet recovery, signing material, and direct raw-sign routes. Do not place passwords, API keys, one-time codes, card data, health data, government identifiers, wallet recovery or signing material, transaction CBOR, or unnecessary personal data in an agent prompt or action.

Cookies, local storage, and retention

The site uses a necessary HttpOnly session cookie that lasts up to 24 hours. It may remember a pending package or selected wallet provider in local browser storage. We found no advertising tracker in the F5ai site.

Security credentials have short validity windows: confirmation links 30 minutes, Discord OAuth transactions 10 minutes, wallet challenges 5 minutes, Partner eligibility evidence 1 hour, and account sessions 24 hours. Those limits do not mean the related service record is immediately deleted.

Account, subscription, action, and audit records are kept while needed to deliver and secure the service, resolve disputes, and meet legal or accounting duties. Expired or revoked records may remain, and immutable audit, payment, proof, or public-chain records may need to be retained.

Your choices

You may ask to access, correct, or delete information, or object to its use where applicable, by emailing hello@webot.agency. We may need to verify the request and retain records that cannot lawfully or safely be removed. Discord community members should also contact the community operator that submitted their data.

F5ai is intended for community operators and business users. Do not knowingly submit personal data about children under 13, or below the applicable digital-consent age, through an agent action.

Changes

We will update the effective date when this notice changes materially.