Privacy Policy

Last updated 19 October 2026

This policy explains what data thepaymentsnotes.com (thePaymentsNotes) handles and why. thePaymentsNotes is a personal project. This policy also covers the YouTube uploader app that the site owner uses for their own channel.

In short

  • You can read the site without an account.
  • The site does not use analytics or advertising trackers, and its own code does not set cookies.
  • We only store an email address if you choose to join the waitlist.

Readiness report

When you enter a website address on the Readiness page, this is what happens:

  • Our scanner reads public pages of that website, such as its homepage, and a few public files that agents look for, such as robots.txt. It does not log in and does not send cookies.
  • The website address, our check results and text from those public pages are sent to OpenRouter, an AI model service, so that a model can write the explanations in the report. Your IP address and your answers are not sent.
  • The report for that address is saved for 24 hours, so that a repeat request is answered from the saved copy. An incomplete result is saved for up to 30 minutes. Expired reports are deleted during a later scan.
  • Each IP address can run 3 new scans per day (UTC). To count this, we store a one way hash of your IP address combined with the date and a server secret, plus a count. We do not store your IP address itself. These records are deleted during a later scan once they are more than a day old.
  • We keep daily totals of scans by business type and score band. These totals contain no website address and no IP address.
  • Your answers to the five questions are used to work out your score and are not stored. Requests to score answers are limited per IP address, counted in server memory only.

The report is automated and is not checked by a person.

MCP server for agents

Agents can request a readiness report through the check_agent_readiness tool on our MCP server. The tool receives a website address. It passes that address and the caller's IP address to the same scanner, so the same saved reports, daily limits and IP hashing apply.

The Ledger tools on the MCP server only read published Ledger data. As stated on the For agents page, they keep no request bodies, and logs hold only hashed IPs, tool names and outcomes for rate limiting and usage counts.

Waitlist

When the daily scan limit is reached, the Readiness page shows a waitlist form. If you join, we store your email address, the page you joined from and the time you joined, in our database on Supabase. The site owner may also receive an email notification with the same details, sent through the email service Resend.

The same email address is not saved twice within 24 hours, and signups are limited per IP address, counted in server memory only.

To have your email address removed, contact thepaymentstack@gmail.com.

Newsletter on Substack

The Home and Readiness pages embed a signup form from Substack, and the Subscribe links go to Substack. If you subscribe, Substack handles your subscription under its own terms and privacy policy. What you type into the embedded form goes to Substack, not to this site.

Ledger and data exports

The Ledger and its JSON and CSV exports contain only published information about protocols, platforms and companies. They contain no visitor data.

Other services your browser contacts

Your browser loads fonts from Google Fonts and some company logos from Clearbit and the Google favicon service. As with any web request, these services receive your IP address and basic browser details. The site is hosted on Lovable and uses Supabase for its database and server functions.

Cookies and local storage

  • The site's own code does not set cookies and does not use analytics.
  • Browser local storage is used only to keep the site owner signed in to the private admin page. Visitors do not sign in.
  • Embedded content from other services, such as the Substack form, may use its own cookies.

YouTube uploader app

The site owner uses a small app to upload their own videos to their own YouTube channel through the YouTube Data API, using the youtube.upload permission.

  • Only the site owner signs in to the app and uses it.
  • The app collects no data from visitors to this site or from other YouTube users.
  • Google API data is used only to upload the owner's videos to the owner's channel.
  • Use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Uploads are also covered by the Google Privacy Policy and the YouTube Terms of Service.

Contact

Questions or requests about your data: thepaymentstack@gmail.com.

Changes

We may update this policy. The date at the top shows the latest version.