Privacy

This notice explains how Mastery Labs LLC, a South Carolina limited liability company (“Mastery Labs,” “we,” “us,” or “our”), handles information in connection with the website and interface it operates.

Indeficient Financial is a brand of Mastery Labs LLC. Protected Payments is a product of Indeficient Financial.

• There are no accounts. We do not ask for your name or contact details, except an email address if you choose to request business API access.
• If you use a dispute case, you sign in by signing a message with your wallet, and the statements and files you submit are stored by us and shown only to the other party and the payment’s designated arbiter.
• The interface includes no analytics, advertising, or tracking scripts, and we do not sell personal information or share it for targeted advertising.
• Your wallet address and your blockchain transactions are public by the nature of the network, whether or not you use this interface.
• A few items are kept in your own browser so the interface works as expected. They never include private keys.

Solana is a public network. Wallet addresses, token balances, transactions, and the accounts that hold protected payments, including their sender, recipient, amount, and status, can be seen by anyone, through block explorers and other tools, independently of us.

We cannot hide, change, or delete information recorded on the blockchain. Anyone who can link your wallet address to you may be able to see your payment activity.

When you create a payment, you enter a recipient address, an amount, and a protection window. If you submit the payment, those details become part of a public transaction and a public payment account on Solana.

If you take part in a dispute, you may give us dispute information: the sender’s reason for the dispute, written statements from the sender and the recipient, and files they upload (JPEG, PNG, or WebP images, or PDF documents, up to 10 MB each). We store each item with the submitting wallet address, that wallet’s role in the payment, and the time it was submitted.

To reach a dispute case you sign in by signing a message with your wallet. Signing does not authorize a transaction or move funds. We record your wallet address and a session identifier, which we store only in a one-way hashed form.

If you request business API access, you give us an email address. We store it with the time it was first submitted, and use it only to contact you about API access. Submitting the same address again changes nothing.

Images you upload through the interface are re-encoded in your browser first, which removes embedded details such as camera information and location. PDFs are uploaded as they are, so check them before you upload.

The interface stores a small amount of information in your own browser. Apart from the sign-in cookie, it stays on your device and is not sent to us.

• Local storage: the name of the wallet you last connected and its address, so the interface can reconnect when you return.
• Local storage: if a payment was signed but the network had not confirmed it, a record of that attempt (addresses, amount, protection window, and transaction signature), so the interface can check it instead of creating a duplicate payment. It is removed once the outcome is known.
• Session storage: transaction signatures for payments you created or acted on in the current tab, so the interface can link to them. They are cleared when the tab closes.
• A sign-in cookie, only if you sign in to a dispute case: it lets our server recognize your session, cannot be read by page scripts, and expires after 12 hours, or earlier when you sign out or disconnect your wallet.

You can remove all of these at any time by clearing this site’s data in your browser settings.

To work, your browser connects directly to services we do not operate. Each has its own privacy practices.

• Your wallet: the interface asks your wallet to connect and to approve transactions. What your wallet records is governed by its provider.
• A Solana RPC provider: the interface reads from and sends to the network through an RPC service, configured for the network. That service receives your IP address and the addresses the interface looks up, including your wallet address when it lists your payments.
• Block explorer: links to transactions and accounts open the Solana Explorer, which applies its own practices when you visit it.
• Our hosting and storage provider, Cloudflare, runs the interface and stores dispute case records, sign-in sessions, and uploaded files on our behalf.

Fonts and wallet icons are served from this site, so viewing a page does not contact a font or icon provider.

The status page runs its checks on our server against the network. Those checks involve no information about you. To keep dispute cases accurate, our server also reads the payment involved from the network through an RPC service; those reads concern the payment, not your device.

Like any website, the server that hosts the interface may receive standard request information, such as IP addresses and browser type, in its logs.

We use the limited information described in this notice to provide, operate, secure, and improve the interface, and to:

• run dispute cases: show each case’s statements and files to that payment’s sender, recipient, and designated arbiter so the dispute can be reviewed and decided;
• contact you about business API access, if you asked for it;
• comply with applicable laws, lawful requests, and legal process, such as subpoenas or requests from government authorities;
• protect our rights, privacy, safety, or property, or those of our users or others, including by making and defending legal claims;
• enforce the terms that govern the interface; and
• prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, or illegal activity.

We may disclose information we hold to service providers that help us operate the interface, such as hosting; to professional advisors, such as lawyers and auditors; to law enforcement, government authorities, or others where we believe in good faith it is necessary for the purposes above; and to a buyer, investor, or successor in connection with an actual or prospective merger, sale, financing, or other business transaction.

Do Not Track: some browsers send “Do Not Track” or similar signals. Because the interface does not use tracking technologies, it does not change its behavior in response to them.

A dispute is opened on-chain by the sender and decided by the payment’s designated arbiter. Through the interface, the sender can give a reason, a written account, and supporting files; the recipient can respond and add files; and both can add further statements.

Who can see it: the payment’s sender, recipient, and designated arbiter, after signing in with their wallet. Files are kept in private storage and are served only to them, never at a public address. A sender’s draft, and any file a party has uploaded but not yet submitted, is visible only to that party.

Submitted statements and files cannot be edited or withdrawn through the interface; a correction is added as a new statement, so the record stays complete for the arbiter.

Submit only what is needed to decide the dispute. Avoid unnecessary personal information about yourself or others, and do not upload anything you do not have the right to share.

Uploaded files are checked for type and size but are not scanned for malware. Images are shown only as images, and PDFs are offered only as downloads; open downloaded files with care.

We do not keep accounts or a database of users. We keep the following for the periods described:

• Drafts and files that never became part of an opened dispute: deleted after 7 days.
• Sign-in sessions: kept until they expire or end, and then removed during routine cleanup.
• Business API-access email addresses: kept for as long as needed to follow up on your request for API access.
• Submitted dispute statements and files: kept for as long as reasonably necessary to operate, resolve, secure, and maintain the dispute service, and to meet our legal and operational obligations, including establishing, exercising, or defending legal claims.
• Case records without statement text or files, such as when a dispute was opened and resolved, its reason category, which parties took part, its outcome, and the verified blockchain facts about the payment: these may be kept separately from, and longer than, the statements and files, to operate the service and understand how disputes are resolved. They are not used for advertising.

Information in your browser stays there until it is removed as described above, or until you clear it. Information recorded on the blockchain, including every payment and its outcome, is public and kept by the network permanently, according to how that network works. We cannot change or delete it, and deleting case material does not affect it.

Your private keys stay in your wallet. We will never ask for your recovery phrase, and nobody acting for us will. Treat any such request as an attempt to steal your funds.

We use technical and organizational safeguards designed to protect the information we handle. Dispute files are kept in storage that is not publicly accessible and are served only to the parties to that dispute and its designated arbiter. No method of transmission or storage is completely secure, and we cannot guarantee the security of information, including information in your browser or on the blockchain.

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information we hold about you, and to appeal a decision about your request. We do not maintain accounts. If you have taken part in a dispute, we hold the case material described above; otherwise we generally hold little or no personal information about you. Because the other party and the arbiter rely on a dispute’s record, we may be unable to delete dispute material while the dispute is open, or where it is needed to resolve the dispute, comply with law, or establish or defend legal claims. Information kept in your browser can be deleted by you at any time. Information recorded on the blockchain cannot be changed or deleted by us or anyone else.

To make a request, use the contact details below once they are published. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

The interface is not intended for anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

Mastery Labs is based in the United States. If you use the interface from elsewhere, information we hold may be processed in the United States, where data protection laws may differ from those in your country. Public blockchain data is replicated by network participants around the world.

We will update this notice as the product changes. The date at the top shows when it last changed.

A contact address for privacy questions will be published here.