Privacy Policy

Reviewed and approved by counsel. Effective July 10, 2026.

Provider: Meridian Bridge Advisors LLC d/b/a Lazaretto. Effective date: July 10, 2026 Contact: contact@lazaretto.dev

This policy explains what we collect when you use the Lazaretto API, distribution skill, MCP server, or website (the "Service"), and what we do with it. It is written to be short and true.

1. What we collect

• Scan metadata. For each scan: the content hash of what we analyzed (target_hash), the verdict, confidence, rule findings and their metadata, the reputation notes, the rules version, and timestamps.
• Hashed source identifiers. We record hashed identifiers for the source of a request — an API-key identifier, a payment wallet address, and/or an IP address — for rate limiting, abuse prevention, and reconciliation. We do not publish these.
• Payment records. Where you pay per call, we record the transaction reference, amount, asset, the USD value at receipt, and the paying wallet address, for reconciliation, tax, and legal compliance. Wallet addresses are pseudonymous payment data, not identity data we seek to de-anonymize.
• Website/log data. Standard server logs (request time, endpoint, coarse status) for operating and securing the Service.

2. What we do NOT do

• We do not retain the bodies of fetched artifacts. We inspect an artifact and store its hash and metadata, not its source code or file contents (PRD §12). This deliberately limits our data footprint.
• We do not sell your data, and we do not use it for advertising.
• We do not knowingly collect personal information from you beyond what is described above; the Service is designed for machine and developer use.

3. Why we use it

We use the data above only to: provide and operate the Service; compute and cache verdicts; enforce rate limits and prevent abuse and iterative evasion; reconcile payments and meet tax and accounting obligations; improve detection quality (using hashes and metadata, not artifact bodies); and comply with law.

4. Sharing

We share data only with:

• Payment facilitator / network. Per-call payments are settled through a third-party facilitator on the Base network; on-chain settlement is inherently public blockchain data.
• Service providers. Infrastructure and security vendors that process data on our behalf under confidentiality obligations.
• Legal. Where required by law, or to protect the rights, property, or security of Lazaretto, our users, or the public.

5. Retention

We retain scan metadata, hashes, and payment records for as long as needed for the purposes above and to meet legal, tax, and reconciliation obligations, then delete or aggregate them. Because we do not store artifact bodies, there is no artifact content to retain.

6. Security

We use administrative and technical measures appropriate to a service of this size, including secret management for credentials, least-privilege access, and transport encryption. No method of transmission or storage is perfectly secure; we cannot warrant absolute security.

7. Your privacy rights; international users

We operate from the United States and process data in the U.S. If you use the Service from outside the U.S., you consent to that processing.

• United States (including California). We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor verifiable requests to access or delete the limited data we hold about you (Section 1); email contact@lazaretto.dev. We do not believe we currently meet the business thresholds that make the CCPA/CPRA apply to us, but we honor these core rights regardless.
• EU / UK. We process only the limited data described in Section 1 (scan metadata, hashed identifiers, and pseudonymous payment data), to perform our agreement with you and for our legitimate interest in operating and securing the Service. You may request access, correction, or deletion at contact@lazaretto.dev.

8. Changes and contact

We may update this policy prospectively; material changes will be posted with a new effective date. Questions or requests: contact@lazaretto.dev.

Meridian Bridge Advisors LLC d/b/a Lazaretto.