Privacy Policy

1. Who is responsible

Rialto (galleriarialto.com) is run by its founding team, who decide how your data is used. You can reach us at @GalleriaRialto on X. Where Brazil's data protection law (LGPD) or the GDPR applies, the rights in section 7 are yours.

2. What we collect

• Account: your email address, the name you give us, and your password, stored only as a salted scrypt hash (we cannot read it).
• Sessions: a sign-in cookie (HttpOnly, about 30 days), stored on our side only as a hash, with when it was last used and your browser's user agent, so you can see and sign out your devices.
• Agents: their names, spending limits and a hash of their keys (we never store the key itself).
• Wallets: the Solana addresses you register to get paid or to pay from. Wallet addresses and every on-chain payment are public on the Solana blockchain by nature.
• Purchases: for each call, the API, the price, the commission, the result the API returned, the start of your agent's request (up to 500 characters), timings, and the links to the payment transactions.
• Sellers: your API's details and price; credentials for your API are stored encrypted (AES-256-GCM).
• Technical data: IP addresses, used in memory to limit abuse (sign-in attempts, request rates) and in short-lived server logs to keep the service secure.

We do not ask for, and will never ask for, your wallet's seed phrase or private key.

3. Why we use it

• To run the service you asked for: your account, your agents, purchases, payouts and receipts (performance of a contract).
• To keep Rialto secure and prevent fraud and abuse (legitimate interest).
• To keep records of transactions and meet legal obligations, including tax rules and requests from authorities (legal obligation).
• To understand, in aggregate, how the marketplace is used (purchases per hour, popular APIs) and improve it (legitimate interest).

We do not sell your data, use it for advertising, or train AI models on it.

4. Who else receives data

• The API you buy from. Your agent's request goes to the seller of that API, or, for Rialto's own integrations, to the AI provider that runs the model (for example fal.ai, ElevenLabs or Tripo). They process it under their own privacy policies. Do not send personal data you do not want them to receive.
• Payment infrastructure. Payment transactions and wallet addresses go to the x402 facilitator that settles them (PayAI), to our Solana RPC provider (Helius), and to the public Solana blockchain.
• Hosting. Our servers and backups run on a rented cloud server (Contabo). Code is hosted on GitHub; it contains no user data.
• Account email. Resend receives your email address and the message content to deliver confirmation and password-reset codes. We do not use these messages for marketing.
• Authorities, when the law requires it.

Some of these providers are outside your country. We choose providers that protect data adequately and only share what each one needs.

5. Cookies

Rialto uses one essential cookie, to keep you signed in. There are no analytics, advertising or third-party tracking cookies. Your browser may store a few preferences locally (for example a chosen tab), which never leave your device.

6. How long we keep it

• Account, agents and purchase records: while your account exists, and afterwards only as long as the law requires us to keep transaction records.
• Sessions: until they expire (about 30 days without use) or you sign out.
• Email confirmation and reset codes: valid for 10 minutes; pending records older than one day are removed when another code is issued. Used codes are removed immediately.
• Backups: the database is backed up daily and the last 14 copies are kept, so deleted data disappears from backups within about two weeks.
• On-chain payments: permanent on the Solana blockchain. Nobody, including us, can delete them.

7. Your rights

You can ask us to confirm what data we hold about you, give you a copy, correct it, delete it, or stop a particular use of it, and you can withdraw any consent you gave. Write to @GalleriaRialto on X from the account's owner, or with a way to verify it is yours. We answer within 15 days. You can change your name and password and sign out devices yourself in Dashboard → Settings, and revoke agents and wallet approvals in the dashboard.

You may also complain to your data protection authority (in Brazil, the ANPD).

8. Security

Passwords are hashed with scrypt, keys and session tokens are stored only as hashes, third-party credentials are encrypted, the site is served only over HTTPS, and sign-in attempts are rate limited. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

9. Children

Rialto is not meant for anyone under 18, and we do not knowingly collect their data. If you believe a minor has an account, tell us and we will delete it.

10. Changes

We may update this policy. The date at the top shows the current version, and we will warn you on the site before important changes take effect. See also our Terms of Service.