1. Introduction

Mazza Group LLC (“we,” “our,” or “us”) operates mazzagrp.com (the “Service”), a platform offering AI-powered API endpoints accessible via the x402 HTTP payment protocol. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

2.1 API Request Data

When you call our API endpoints, we collect:

IP address and request headers (User-Agent, Accept, etc.)
API endpoint requested and parameters submitted
Payment transaction hashes (USDC on Base mainnet)
Timestamp and response status codes

2.2 Website Analytics

We use Google Analytics 4 (GA4) and Cloudflare Analytics to understand usage patterns:

Page views, session duration, bounce rate
Approximate geographic location (country/city level)
Browser type, operating system, device type
Referrer and traffic source

2.3 Payment Data

Cryptocurrency payments (USDC) are processed on the Base blockchain. Transaction hashes, wallet addresses, and payment amounts are publicly visible on-chain. We do not custody, hold, or store your cryptocurrency at any time. Fiat-to-crypto onramp is provided by MoonPay, which processes any card or Apple Pay transactions directly — we do not see or store your card details.

3. How We Use Your Information

Provide and maintain the Service — process API requests, verify payments, return AI-generated results
Prevent fraud and abuse — detect automated scraping, rate-limit violations, payment fraud
Improve the Service — analyze usage patterns to prioritize features and fix bugs
Communicate with you — respond to support inquiries and send transactional emails
Comply with legal obligations — respond to lawful requests from authorities

4. Data Storage and Security

Our website is hosted on Vercel (edge network, global) with DNS and CDN services provided by Cloudflare. API responses are generated by Cloudflare Workers AI (Llama 3.3 70B). All traffic is encrypted in transit via TLS 1.3. We do not store API request payloads or AI responses beyond the duration needed to serve the response.

Payment verification is performed by the x402 facilitator at x402.org. We do not have access to your private keys or wallet contents.

5. Third-Party Services

Service	Purpose	Data Shared
Cloudflare	CDN, DNS, Workers AI, Analytics	IP address, request data
Vercel	Web hosting, edge rendering	IP address, server logs
Google Analytics	Usage analytics	Anonymized usage data
MoonPay	Fiat-to-crypto onramp	None (direct widget, separate session)
x402 Facilitator	Payment verification	Transaction hash, payment amount

6. Data Sharing

We do not sell your personal information. We may share data with the third-party services listed above (strictly for providing the Service), with law enforcement when required by law, or in connection with a business transfer (merger, acquisition, or asset sale).

7. Data Retention

Server logs (Vercel/Cloudflare): 30 days
Analytics data: 14 months
Payment transaction hashes: Retained on-chain permanently (blockchain)
Support correspondence: 3 years

8. Your Rights

You have the right to:

Access — request a copy of your personal data
Correction — update inaccurate information
Deletion — request deletion of your data (except on-chain records)
Objection — object to certain processing activities

CCPA (California): We do not sell personal information. California residents may exercise their rights by contacting us at the email below.

GDPR (EEA/UK): You have the right to lodge a complaint with your local supervisory authority. We process data under legitimate interest (fraud prevention, service improvement) and contractual necessity (providing the Service).

9. Cookies

We use minimal cookies for analytics (Google Analytics) and security (Cloudflare). We do not use tracking cookies for advertising. You can manage cookies in your browser settings.

10. International Data Transfers

The Service is available globally. Your data may be processed in the United States (Vercel/Cloudflare infrastructure). For EU/UK users, we rely on Standard Contractual Clauses (SCCs) for data transfers outside the EEA.

11. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect data from minors.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date.

13. Contact

Mazza Group LLC
30 N Gould St Ste R
Sheridan, WY 82801
United States
Email: [email protected]