Version 2026-10-29 · Web3Firewall, Inc. (doing business as Prax Labs)
Web3Firewall, Inc. (doing business as Prax Labs) operates Prax Data Services. Contact: [email protected]. This policy explains what we collect through the developer portal and API, why, and your choices. It supplements, and is incorporated into, the Terms of Service.
Account data: email address, name, company, password (stored only as a salted scrypt hash), plan and billing status. Verification and security data: IP addresses at sign-up and sign-in, user agent, timestamps, one-time codes (stored hashed), sign-in events and failures. API data: for every request, the key used, tool name, parameters needed to answer the request (such as a blockchain address, transaction hash, transfer details or an entity name), response status, latency and size. Payment data: handled by Stripe; we store Stripe customer and subscription identifiers, never card numbers. Support data: anything you send us by email.
To provide and secure the Service (authentication, abuse prevention, one-account-per-network and verification rules, fraud and account-takeover detection); to meter usage, enforce plan limits and bill; to operate, maintain and improve the Service and Prax's detection capabilities, including in aggregated or de-identified form; to communicate about the Service (verification codes, security notices, billing, material changes); and to comply with law and enforce our Terms. Our legal bases, where the GDPR or similar laws apply, are performance of a contract, our legitimate interests in securing and improving the Service, consent for optional communications, and legal obligations.
We do not sell personal data. We do not use your request data to target advertising. Addresses, hashes and names you look up are not added to any public or shared list because you looked them up, and are not disclosed to other customers. Prax's threat-intelligence outputs are derived from Prax's own analysis and sources, not from customer queries.
Service providers acting on our instructions under contract: cloud and network providers (including Cloudflare for delivery and protection), Stripe for payments, an email delivery provider for transactional email. Authorities, where required by law or to protect rights, safety or the Service. A successor in a merger, acquisition or asset sale. No other sharing.
Account data for the life of the account and up to 7 years after for legal, tax and dispute purposes. Request metering and security logs for 24 months, then aggregated or deleted. Unverified accounts are deleted after 7 days. Backups age out on a rolling basis.
Transport encryption everywhere; keys and codes stored as one-way hashes and shown once; hardware and code integrity controls on our infrastructure; access limited to personnel who need it; monitoring and alerting. No system is perfectly secure, and you are responsible for safeguarding your own keys.
We are a U.S. company and process data in the United States. Where we receive personal data from the EEA, UK or Switzerland we rely on standard contractual clauses or other lawful transfer mechanisms.
Depending on where you live you may have rights to access, correct, delete, port or restrict personal data, or to object to processing, and to complain to a supervisory authority. Email [email protected]; we will verify your identity and respond within the time the law requires. You can change your password and view recent activity in the portal. Deleting your account revokes all keys.
The Service is for businesses and adults. We do not knowingly collect data from anyone under 18.
The portal uses only strictly necessary cookies: a session cookie and a CSRF token. No analytics or advertising cookies. Cloudflare may set cookies needed for security.
We will post changes here with a new version date and notify account holders of material changes by email or in the portal.