BOP marketplace test API privacy notice

Effective date: November 5, 2026

This English version is provided for convenience. If there is any inconsistency, the Traditional Chinese version prevails.

This notice explains, under Taiwan's Personal Data Protection Act, how the BOP marketplace test API (https://market.balanceproject.ai, the "API") collects, processes and uses personal data. The API lets AI assistants search a test list of wellness services. It holds test data only, does not handle real bookings or payments, and offers no account sign-in. Bookings and online payments with real businesses are handled by the BOP connector; see the BOP connector privacy policy.

1. Who collects the data

Seller Technology Ltd. (台灣商戶科技有限公司, Taiwan; the "Company"). Questions and requests: tc@srct.tw.

2. Purposes

Checking the signatures and authorization of AI assistants' requests, keeping AI assistants' Sessions, stopping replayed requests, limiting request rates and usage, answering test searches, and information security and compliance with legal obligations.

3. Data we collect

• Session data sent by AI assistants: each request carries a Session header that the AI assistant signs itself. The Company stores the assistant's client identifier, the Session identifier the assistant chose, the service identity (domain), hashed forms of the User ID and Agent ID, and an expiry time. The Company does not store the User ID or Agent ID in their original form.
• Request identifiers used to stop replays: stored only in hashed form, with an expiry time.
• Usage counters: request counts per AI assistant, keyed by the hashed client identifier, with an expiry time.
• IP addresses: used only in server memory to limit request rates, and not written to the database.
• AI assistants' public data: to check signatures, the Company reads the AI assistant's public client description and public keys and caches them in memory for up to 10 minutes.
• Search criteria: used only to answer that request, and not written to the database.

The API does not collect names, phone numbers, email addresses, payment data or precise location. Please do not put health or medical information in requests.

4. How long we keep it

• A Session ends 24 hours after its last request.
• Request identifiers used to stop replays, and usage counters, are kept only until their own expiry.
• Expired records are no longer used and are cleared by the system during later requests; if no new requests arrive, expired records stay until the next clean-up.
• IP addresses held in memory and cached public data disappear when the cache expires or the server restarts.

5. Where it is processed

Taiwan (Republic of China), and the regions where Cloudflare's servers are located.

6. Who receives it

The Company; Cloudflare (hosting and database; for security and delivery, Cloudflare processes technical data such as IP addresses and request logs); and authorities entitled by law to obtain it. The Company does not sell this data, use it for advertising, or use it to train AI models.

7. How it is processed

Collected, processed, used and transferred internationally by automated means.

8. No linking across domains

Under the agent protocol we are compatible with, srct.tw and market.balanceproject.ai are separate service identities; User IDs and Sessions are not shared between the two domains.

9. If the data is not provided

If an AI assistant does not attach a Session header, or its signature cannot be verified, the API cannot answer that request.

10. Your rights

Under Article 3 of the Personal Data Protection Act, you can ask to access your personal data, get a copy, correct or add to it, stop its collection, processing or use, or have it deleted. Email tc@srct.tw. Because the Company keeps only hashed User IDs, we may need your User ID or your AI assistant's client identifier to find the related records.

11. Changes

The Company may revise this notice. Revisions are posted on this page with a new effective date, and earlier versions are kept in the version history below.

Version history