Privacy Policy

Last Updated: June 8, 2026

Surplus Intelligence LLC ("Surplus Intelligence," "SI," "we," "us," or "our") respects your privacy and is committed to protecting it. This Privacy Policy describes how we collect, use, store, and disclose personal information when you access our website at https://www.surplusintelligence.ai/ (the "Site"), our APIs, smart contracts, and related services (collectively, the "Service"). Capitalized terms not defined here have the meaning given in our Terms of Service.

This Privacy Policy applies to personal information collected through any written, electronic, or oral communications, as you:

• Access the Site or any corresponding webpage that links to this Privacy Policy;
• Connect a self-custody wallet or authenticate via our identity provider;
• Submit inference requests to or otherwise use the Service;
• Communicate with us by email or other means.

Before using the Service, please carefully read our Terms of Service and this Privacy Policy. By using the Service, you consent to the collection and use of your personal information as described in this Privacy Policy. If you do not agree, do not use the Service.

We may modify this Privacy Policy at any time, and changes may apply to any personal information we hold about you as well as any new personal information collected after the change. The "Last Updated" date will reflect the date of the most recent change. For material changes, we will provide registered users with advance notice by email or in-product notification. Your continued use of the Service after a change constitutes acceptance of the revised Policy.

1. Information We Collect

1.1 Information You Provide

We collect the personal information you choose to provide, including:

• Account identifiers. When you connect a wallet via Sign-In with Ethereum ("SIWE") or authenticate via Privy, we receive your Ethereum wallet address and, optionally, any email address, social account identifier, or display name you choose to associate with your account.
• Communications. When you contact us by email, complete a form, or submit a support request, we collect the contents of your message, your email address, and any attachments.
• Seller submissions. If you list a Provider Endpoint as a Seller, we collect the Provider Endpoint URL, encrypted API key material, model identifiers, pricing, capability descriptions, and your designated payout wallet address.
• Payment information. When you purchase Credits via Stripe, Inc., Stripe collects and processes your payment instrument (e.g., card number, expiration, CVV) directly under Stripe's privacy policy. We receive only a transaction reference, the purchase amount, and a confirmation status — we do not store your full card number or other primary payment instrument data.

1.2 Information Collected Automatically

As you navigate and interact with the Service, we automatically collect:

• Request metadata. For each inference request, we log the model identifier, token counts (input, output, cache, reasoning), timestamps, response status, request hash, selected Seller and Provider Endpoint, settlement amount, and on-chain transaction hash (when settled on-chain). By default, we do not persist the contents of synchronous chat, completion, responses, embedding, image, or audio Inputs or Outputs ("Chat Bodies"). We transiently process Chat Bodies only as needed to route your request to the selected Seller or Model Provider and return the response. Surplus Intelligence may, in the future, offer optional account-level features that record Chat Bodies for purposes such as debugging, request replay, or private prompt storage ("Opt-In Logging"). Opt-In Logging is disabled by default and is activated only after you affirmatively enable it in your account settings. The data-handling and retention terms for Opt-In Logging will be disclosed in the feature's documentation and in this Privacy Policy at the time the feature is released.
• Asynchronous media request data. For asynchronous video and music jobs, we store the request JSON and generated artifacts (with a default retention of three (3) hours) to enable job retry, deduplication, polling, and delivery. This is required to operate the async-job lifecycle.
• Technical and device information. When you access the Site or Service, we automatically receive standard server-log information such as your IP address, browser type and version, operating system, referrer URL, page-view timestamps, and the resources you access. This information is used for service operation, security, abuse prevention, and rate limiting.
• Wallet address activity. Wallet addresses you use with the Service are public information on the Base blockchain. Settlement transactions involving your wallet, including Buyer-to-Seller transfers and any associated metadata recorded by the SettlementV2 smart contract, are publicly visible to anyone with access to a Base node or block explorer. We do not control the visibility of this information.

1.3 Cookies and Similar Technologies

We use a limited set of strictly necessary and functional cookies. Specifically:

• inference-session — a first-party HTTP cookie set after you sign in to the web UI, used to maintain your authenticated session. This cookie is required for the web UI to function.
• Privy cookies and local storage — our identity provider, Privy, Inc., sets cookies and local-storage entries on its authentication domains to manage embedded wallets and login sessions. See Privy's privacy policy for details.

We do not currently use third-party measurement, advertising, or session-replay tracking technologies (such as Google measurement tools, PostHog, Mixpanel, Segment, or Hotjar). If we add such technologies in the future, we will update this Privacy Policy and provide any consent mechanism required by applicable law.

You may block or delete cookies through your browser settings. If you block strictly necessary cookies, parts of the Service (including signed-in web functionality) may not work.

2. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

• To provide the Service. Routing inference requests, performing settlement, computing usage metrics, displaying account balances, issuing and validating API keys, processing payments, and enabling the marketplace.
• To meter and bill usage. Computing costs in microdollars, applying fees, and reconciling on-chain settlement against off-chain records.
• To detect, prevent, and respond to fraud, abuse, and security incidents. Including rate-limit enforcement, anomaly detection, and account suspension or termination for violations of the Terms or Acceptable Use Policy.
• To communicate with you. Sending you transactional notices (e.g., low-balance alerts, settlement failures, security alerts, policy changes) and responding to your inquiries.
• To improve the Service. Aggregating and analyzing request metadata, error rates, and routing efficiency to identify and address issues, optimize routing, and inform product decisions.
• To produce public, aggregated marketplace statistics. Publishing aggregated marketplace statistics (such as total volume, model demand, savings vs. retail pricing) on the Site. These statistics do not identify individual users.
• To comply with legal obligations. Including responding to lawful requests from courts, regulators, and other government authorities; complying with sanctions, anti-money-laundering, and tax laws; and enforcing our Terms.
• To exercise and defend legal rights. Including in connection with disputes, claims, audits, and investigations.

We do not use Chat Bodies for model training, advertising, measurement, or profiling, and we do not persist them by default. We transiently process Chat Bodies only to operate the Service, unless you later choose to enable an optional logging feature.

3. How We Share and Disclose Personal Information

We share personal information in the following circumstances:

3.1 Service Providers and Sub-Processors

We share personal information with vendors that perform services on our behalf and are contractually obligated to handle the information only for those purposes:

This list may be updated from time to time. The current list is maintained at this Privacy Policy.

3.2 Sellers and Model Providers

When you submit an inference request, the request — including the Chat Body — is routed to the Seller selected by the routing logic, and from there to the Model Provider whose model is being invoked. Surplus Intelligence does not control the data-handling, retention, or training practices of Sellers or Model Providers. Each Seller's Provider Endpoint is operated by a third party, and use of any model is subject to the applicable Model Provider's terms of service and privacy policy. You are responsible for reviewing those terms and policies before submitting any Input you do not want subject to them.

3.3 On-Chain Disclosures

Information you commit to a blockchain is, by design, public, immutable, and outside our control. Wallet addresses, settlement amounts, transaction hashes, and any other information recorded on the Base network or any other blockchain we interact with is publicly visible. Anyone with the wallet address can view all transactions involving that wallet. Do not associate a wallet address with personal information you do not want to make public.

3.4 Legal Process and Safety

We may disclose personal information when we believe in good faith that disclosure is necessary to: (a) comply with a subpoena, court order, regulatory request, or other legal process; (b) enforce our Terms or other agreements; (c) detect, prevent, or respond to fraud, security, or technical issues; or (d) protect the rights, property, or safety of Surplus Intelligence, our users, or others.

3.5 Corporate Transactions

If Surplus Intelligence is involved in a merger, acquisition, financing, reorganization, bankruptcy, dissolution, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will require the successor to honor the commitments in this Privacy Policy or notify you and provide an opportunity to opt out before any material change in handling.

3.6 Aggregated and De-Identified Information

We may share aggregated or de-identified information — information that does not, on its own, identify any individual — for any purpose, including publishing public marketplace statistics on the Site.

3.7 With Your Consent

We may share personal information for any other purpose with your consent.

We do not sell personal information as that term is defined under applicable privacy laws.

4. Data Retention

We retain personal information for as long as is reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account records (wallet address, email if provided, account preferences): retained for the life of your account and for a reasonable period thereafter to comply with tax, audit, and dispute-resolution obligations.
• Usage logs (request metadata, settlement records): retained for as long as needed for billing reconciliation, anti-abuse, audit, and to satisfy financial-record retention requirements.
• Async media request data: the request JSON is retained for the lifetime of the job and reasonable post-job dispute and audit windows. Generated media artifacts in blob storage are retained for the configured artifact TTL (default three (3) hours) and then deleted.
• Encrypted Seller Credentials: retained for as long as the Seller's offer is active. When an offer is soft-deleted, the encrypted Credentials may remain in the database; deletion of the Credentials themselves can be requested by emailing support@surplusintelligence.ai.
• Communications: retained as needed to respond to inquiries and for record-keeping.
• On-chain data: cannot be deleted. Transactions on the Base network and any other blockchain are immutable.

When personal information is no longer required, we will delete, destroy, or de-identify it, except where retention is required by law.

5. Your Rights and Choices

Depending on where you live and which laws apply, you may have certain rights regarding your personal information:

• Right to know / access. Request a copy of the personal information we hold about you and information about how we use and share it.
• Right to correct. Request correction of inaccurate personal information.
• Right to delete. Request deletion of personal information we have collected, subject to certain exceptions (e.g., information we are required to retain for legal, tax, audit, or anti-fraud purposes; on-chain data, which cannot be deleted).
• Right to data portability. Request export of certain personal information in a portable format.
• Right to object or restrict. Object to or request restriction of certain processing activities.
• Right to withdraw consent. Where processing is based on your consent, withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
• Right to opt out of marketing. Opt out of marketing communications by following the unsubscribe link in any marketing email or by emailing support@surplusintelligence.ai.

To exercise any of these rights, contact support@surplusintelligence.ai. We may ask you to verify your identity (including by signing a SIWE message from the wallet associated with your account) before processing your request. We will respond within the timeframe required by applicable law.

We do not "sell" personal information or use it for "targeted advertising" as those terms are defined under U.S. state privacy laws.

6. Security

We implement and maintain technical, administrative, and physical security measures designed to protect personal information against accidental loss and against unauthorized access, use, alteration, and disclosure. These include encryption in transit (TLS) and encryption at rest for Seller Credentials (AES-256-GCM with per-record salts), role-based access controls for production systems, and ongoing monitoring.

You bear important responsibilities for security as well:

• Keep your wallet seed phrase, private key, API keys, and account credentials confidential. Anyone with these credentials can act as you.
• Use strong, unique passwords on any account or wallet provider you use with the Service.
• Promptly revoke and replace any credential you believe may have been compromised, and notify us at support@surplusintelligence.ai.

The transmission of information over the internet and the operation of blockchain networks are not completely secure. We cannot guarantee the security of personal information transmitted to or stored by the Service. Any transmission is at your own risk.

A more technical description of the Marketplace's security and privacy properties — including the encryption model for Seller Credentials, threat model, and data-handling defaults — is available in our Security and Privacy documentation.

7. Third-Party Services and Links

The Site may link to or integrate with third-party websites, applications, smart contracts, blockchains, and services. We are not responsible for the privacy practices of those third parties. Once you leave the Site or access a third-party service, you should review that party's privacy policy. This Privacy Policy applies only to information collected by Surplus Intelligence.

8. International Data Transfers

Surplus Intelligence is based in the United States. If you access the Service from outside the United States, your personal information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your personal information to jurisdictions whose data-protection laws may differ from those of your country.

Where required by applicable law (including transfers from the European Economic Area or the United Kingdom), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or applicable adequacy decisions to protect personal information transferred internationally.

9. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete it. If you believe a child under 13 has provided personal information to us, contact support@surplusintelligence.ai.

If you are between 13 and 18 years of age, you must have your parent or guardian's permission to use the Service.

10. California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended ("CCPA"):

• Categories of personal information collected in the past 12 months: identifiers (wallet address, IP address, email); commercial information (transaction history, Credit balances); internet or other network activity (server logs, request metadata); geolocation data inferred from IP address; account credentials.
• Sources of personal information: directly from you; automatically as you use the Service; from our identity provider (Privy); from payment processors (Stripe, Coinbase); from public blockchain data.
• Business purposes for which we use personal information: providing the Service; security and fraud prevention; communications; compliance with law; improving the Service.
• Categories of third parties with whom we share personal information: service providers and sub-processors listed in Section 3.1; Sellers and Model Providers when you submit requests; government authorities when legally required.
• We do not sell or "share" personal information for cross-context behavioral advertising.
• Sensitive personal information. We do not collect or use sensitive personal information for purposes that require disclosure under the CCPA.

To exercise your CCPA rights, contact support@surplusintelligence.ai. We will not discriminate against you for exercising your rights.

11. European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, the following additional disclosures apply:

• Controller. Surplus Intelligence LLC is the data controller for personal information processed in connection with the Service.
• Legal bases for processing. We process personal information on the following legal bases under the EU/UK General Data Protection Regulation: (a) contract — to provide the Service you have requested; (b) legitimate interests — to operate, secure, and improve the Service, prevent fraud, and conduct routine business operations; (c) legal obligation — to comply with applicable law and respond to lawful requests; and (d) consent — where required, for example for certain marketing communications.
• Right to lodge a complaint. You may lodge a complaint with your local data-protection supervisory authority.
• Data Protection Officer. We have not appointed a Data Protection Officer because we are not required to do so under applicable law. For privacy inquiries, contact support@surplusintelligence.ai.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent update. For material changes that affect your rights, we will provide registered users with advance notice. Your continued use of the Service after the effective date of any change constitutes acceptance of the revised Privacy Policy.

13. Contact

Surplus Intelligence LLC 1309 Coffeen Avenue, STE 19992 Sheridan, WY 82801 United States

• Contact: support@surplusintelligence.ai
• Phone: +1 (512) 222-3017

© 2026 Surplus Intelligence LLC. All rights reserved.