Privacy Policy

1. Introduction

ScriptMaster Labs (“we”, “our”, or “us”) operates scriptmasterlabs.com and the software products in the ScriptMasterLabs ecosystem, including SqueezeOS (institutional AI market intelligence), the SqueezeOS Slack App, Ghost Layer, 402Proof, and related services.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights regarding that information. By using any of our services you agree to the practices described here.

2. Information We Collect

2a. Website & API visitors

• Usage data — Pages visited, HTTP request metadata (IP address, browser/agent string, referrer, timestamp). Collected automatically by server access logs and Google Analytics (GA4).
• Contact information — Name, email address, and any message content you voluntarily submit via contact forms or email.
• API call metadata — Endpoint called, User-Agent string, response time, and payment token status (paid / unpaid). No payload body content is logged to persistent storage.

2b. SqueezeOS MCP / REST API

• Agent wallet address — The XRPL or Base wallet address submitted by an AI agent when invoking premium endpoints (passed via X-Agent-Wallet header). Used solely to verify payment proof and compute Credit Bureau score.
• Payment token — A short-lived signed JWT (1-hour TTL) issued by 402Proof after a confirmed on-chain payment. We verify and discard it; we do not store the full token or the underlying transaction details.
• Symbol / ticker input — The market symbol you supply to endpoints like /api/council or /api/preview. Processed in real time; not linked to your identity.

3. SqueezeOS Slack App — Data Disclosure

3a. OAuth Installation

When a Slack workspace administrator installs the SqueezeOS app via OAuth 2.0, Slack issues us a bot access token. We store this token (encrypted at rest) solely to post command responses back to the channel where the command was invoked. We do not use the token to read message history, browse channels, or access any data beyond what is necessary to respond to the triggering slash command.

3b. Data collected per slash command invocation

Command	Data received from Slack	How it is used	Stored?
/squeeze [SYMBOL]	workspace ID, channel ID, user ID, command text (the ticker symbol)	Symbol is passed to the SqueezeOS AI council engine to produce a real-time market verdict. Response is posted to the originating channel.	No
/scan	workspace ID, channel ID, user ID	Triggers a full squeeze scan across the live $1–$50 universe. No user-supplied text is processed.	No
/preview [SYMBOL]	workspace ID, channel ID, user ID, command text (the ticker symbol)	Symbol is passed to the free bias + regime preview endpoint. Response posted to originating channel.	No
/ftd [GME|AMC]	workspace ID, channel ID, user ID, command text	Command text (GME or AMC) is used to fetch SEC Reg SHO Fails-To-Deliver data. Response posted to originating channel.	No
/sqstatus	workspace ID, channel ID, user ID	Returns engine health status. No user-supplied text processed.	No

Data fields explained:

• Workspace ID — Slack's identifier for your organization. Used to route the response to the correct workspace. Never shared or cross-referenced with other data.
• Channel ID — Slack's identifier for the channel where the command was typed. Used only to send the response back to that channel.
• User ID — Slack's anonymous identifier for the invoking user. Used only to display “@username requested this” in the response header. We do not resolve this to a real name, email address, or any external identity.
• Command text (ticker symbol) — The text argument to the slash command (e.g., GME). Passed directly to our market data engine. Not stored after the response is delivered.

3c. What the SqueezeOS Slack App does NOT collect

3d. OAuth scopes requested

Scope	Why it is needed
commands	Register and receive slash command payloads.
chat:write	Post signal responses to channels the bot is a member of.
chat:write.public	Post responses to public channels without requiring an explicit invite.
incoming-webhook	Deliver async command responses via the Slack response_url webhook.
app_mentions:read	Receive events when users @mention the bot to ask a question.
im:history / im:read / im:write	Respond to direct messages when a user invokes a supported command in a DM with the bot.
channels:read	Verify the bot can post to the requested channel before attempting delivery.

3e. Premium features & x402 micropayments

Certain SqueezeOS commands (e.g., /squeeze full AI council verdict) require a micropayment via the x402 protocol using RLUSD on the XRP Ledger. This payment flow occurs outside of Slack — the user obtains a payment token from our 402Proof service by completing an on-chain transaction using their own XRPL wallet. We receive the XRPL wallet address and a proof-of-payment token. We do not receive or store any payment card numbers, bank details, or personally identifying payment information.

4. How We Use Your Information

• To deliver the real-time market intelligence service you requested.
• To verify payment proof for premium endpoints (HMAC-SHA256 token check, no network call to third parties).
• To monitor system health, detect abuse (honeypot pattern matching), and maintain service reliability.
• To respond to support inquiries submitted via email or contact forms.
• To improve our services based on aggregate, anonymized usage patterns.
• To comply with applicable laws and regulations.

We do not sell, rent, or trade your personal information with third parties. We do not use your information for behavioral advertising.

5. Data Retention

Data type	Retention period	Storage location
Slack slash command payloads	Not stored. Processed in-memory and discarded after the response is sent (typically <3 seconds).	In-memory only (Render.com instance RAM)
Slack bot access token (OAuth)	Until the workspace admin revokes app authorization or uninstalls the app.	Encrypted environment variable on Render.com
Signal history (market verdicts)	Up to 200 most recent verdicts per ticker symbol; cleared on server restart.	In-memory ring buffer (Render.com instance RAM)
API access logs	Up to 30 days in Render.com server logs.	Render.com managed log storage
Website analytics	26 months (Google Analytics 4 default).	Google Analytics infrastructure
Contact form submissions	Until the inquiry is resolved, then deleted within 90 days.	Email inbox (Google Workspace)
XRPL agent wallet address	Not stored to disk. Held in memory only for the duration of the API request.	In-memory only

6. Third-Party Data Processors

We share the minimum necessary data with the following processors to deliver our services:

Processor	Purpose	Data shared
Slack Technologies, LLC	Slack platform — delivers app responses to your workspace.	Bot access token, formatted message payloads (no user PII beyond Slack-native IDs).
Tradier Brokerage	Real-time and delayed market data, options chains.	Ticker symbol only. No user identity is transmitted.
Alpaca Markets	Fallback real-time quote provider.	Ticker symbol only.
Polygon.io	Fallback market data provider.	Ticker symbol only.
Render.com	Cloud hosting for the SqueezeOS API.	Server access logs (IP, User-Agent, timestamp).
Google Analytics (GA4)	Website usage analytics.	Anonymized page-view events, browser/device metadata.
Neo4j (AuraDB)	Market relationship graph (optional feature). Only active if Neo4j credentials are configured.	Ticker symbols and computed Greek/flow metrics. No user identity.

We do not share data with any ad networks, data brokers, or analytics companies beyond what is listed above.

7. Revoking Slack App Access

You can remove the SqueezeOS Slack App from your workspace at any time:

1. Go to Slack → Apps → SqueezeOS → App Settings → Remove App.
2. Alternatively, a workspace admin can revoke access from Manage Apps.

Upon removal, Slack immediately invalidates the bot access token. We stop receiving any events from your workspace. Any residual in-memory data is flushed on the next server restart (typically within 24 hours on our free Render tier due to inactivity spin-down).

To request deletion of any data we may hold about your workspace or any contact information you provided, email us at scriptmasterlabs@gmail.com with the subject line DATA DELETION REQUEST. We will respond within 10 business days.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate data.
• Deletion — Request deletion of your personal data.
• Portability — Request your data in a machine-readable format.
• Objection — Object to certain uses of your data.
• Restriction — Request restricted processing of your data.

To exercise any of these rights, contact us at scriptmasterlabs@gmail.com. We do not charge for data rights requests and will respond within 30 days (or 45 days where permitted by law).

If you are located in the European Economic Area (EEA), you have the right to lodge a complaint with your local data protection supervisory authority.

California residents may have additional rights under the California Consumer Privacy Act (CCPA). Because we do not sell personal information, many CCPA provisions do not apply, but you may still contact us to exercise your access and deletion rights.

9. Data Security

We employ the following technical and organizational measures to protect your information:

• All data in transit is encrypted using TLS 1.2 or higher.
• API payment tokens use HMAC-SHA256 signatures with a server-side secret; they are verified and discarded without being written to disk.
• The SqueezeOS API is deployed on Render.com with HSTS, X-Content-Type-Options, and X-Frame-Options security headers enforced on every response.
• Slack bot tokens are stored only as encrypted environment variables on Render.com’s managed infrastructure.
• Slash command payloads are verified against a cryptographic HMAC-SHA256 signature from Slack before any processing occurs (Slack’s signing secret validation).
• Honeypot routes actively detect and log malicious scanners before they reach real application logic.

No electronic transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to scriptmasterlabs@gmail.com.

10. Cookies & Tracking Technologies

Our website uses the following tracking technologies:

• Google Analytics 4 (GA4) — First-party analytics cookie (_ga, _ga_*). Tracks page views and session data in aggregate. You can opt out via Google Analytics Opt-out Browser Add-on.
• Google AdSense — May place advertising cookies. You can manage preferences at Google Ads Settings.

The SqueezeOS REST API and Slack App do not use cookies. All session state is managed via short-lived signed tokens.

11. Children’s Privacy

Our services are not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately at scriptmasterlabs@gmail.com and we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated “Last Updated” date. We encourage you to review this page periodically. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: