Privacy Policy
Toolstem operates two pay-per-call MCP servers: a Finance server at mcp.toolstem.com/mcp/finance and an SEC EDGAR server at mcp.toolstem.com/mcp/sec. This policy describes what data those servers handle and what they do with it.
What we collect
Tool requests
When your agent calls a tool, we receive: the tool name, the arguments you pass (e.g. a stock ticker), and HTTP headers required by the MCP and x402 protocols. We log these for operational reliability (debugging, abuse prevention, capacity planning) and retain them for up to 30 days.
Payment data (x402 path)
If you pay via x402, your agent's wallet signs an EIP-3009 transferWithAuthorization message which we relay to the Coinbase CDP facilitator for settlement on Base mainnet. We see the signed authorization (sender wallet address, amount, nonce) and the resulting on-chain transaction hash. We do not custody your funds. We do not see your private key.
Payment data (Apify path)
If you use the Apify path, Apify handles billing. We receive an Apify-issued token to confirm your account is funded; we do not see your payment instrument. See Apify's privacy policy.
Server logs
Standard server logs include: source IP, timestamp, response code, and request size. Logs are rotated and retained for up to 30 days for security and abuse mitigation.
What we don't collect
- We do not collect names, emails, phone numbers, or any other personally identifiable information through the API. The servers are designed for autonomous agent use.
- We do not run third-party analytics or trackers on the API endpoints. The marketing website (
toolstem.com) uses no analytics or tracking cookies as of this policy's date. - We do not sell or share request data with third parties except as required to fulfill your request (e.g. forwarding ticker queries to upstream financial data providers like Financial Modeling Prep, or fetching public filings from SEC EDGAR).
- We do not custody user funds. All x402 payments settle directly between your wallet and our receiving address on the Base blockchain.
Third parties
We use the following service providers in delivering the Toolstem servers:
- Cloudflare — hosts the proxy and edge for
mcp.toolstem.com. Cloudflare privacy policy. - Apify — hosts the underlying actor that fulfills tool calls. Apify privacy policy.
- Coinbase Developer Platform (CDP) — operates the x402 facilitator that settles payments. Coinbase privacy policy.
- Financial Modeling Prep — upstream data source for the Finance server. FMP privacy policy.
- SEC EDGAR — public US Securities and Exchange Commission filings database, used by the SEC server.
Blockchain transparency
All x402 payments settle on the public Base blockchain. The sender wallet, recipient wallet, amount, and timestamp of every payment are publicly visible on Base block explorers. This is inherent to public blockchains, not a Toolstem policy.
Your rights (GDPR, CCPA, and similar laws)
Depending on where you reside, you may have rights to access, correct, delete, restrict processing of, or port your personal data, and to object to certain processing or withdraw consent. The Toolstem servers are designed for autonomous agent use and do not collect personally identifiable information through the API. The data we do hold (request logs tied to wallet addresses or Apify tokens, plus on-chain payment records visible to anyone on Base) is described above.
If you are a resident of the EU/EEA/UK (GDPR), California (CCPA/CPRA), or another jurisdiction with data protection laws, and you would like to exercise any applicable right with respect to data we hold about you, email admin@toolstem.com with the wallet address or Apify account in question. We will respond within 30 days. We do not sell personal information.
Changes to this policy
We will update this policy when we change how data is handled. The date at the top reflects the most recent revision. Material changes will be announced on the Toolstem GitHub organization.
Contact
Questions about this policy: admin@toolstem.com.