Account privacy notice

Updated 21 October 2026. This notice covers the AUN website, optional human account and utility API. Technical data provenance, service limitations and detailed operational disclosures are also available.

Who operates AUN

AUN / Agent Utility Network is operated by Filippo Meneghello, a natural person, not presented as an incorporated company. For account privacy requests and questions: tourcamino@gmail.com.

Why and which data we process

• Account and requested services: account ID, display name, creation/update times, login methods, sessions, credential policies and usage counters. These support the account and service you request (GDPR Article 6(1)(b)). A nickname is sufficient; there is no payment checkout.
• Google sign-in, if you choose it: Google account identifier and verified email. AUN uses them to identify your account, not for marketing. AUN does not request your Google password, Gmail, Drive, contacts or profile-photo permissions. Its Google integration requests only openid and email. Provider access, refresh and ID tokens are not retained in AUN account records after verification.
• Passkeys, if you choose them: public credential key, credential ID, authenticator metadata and verification counters. AUN never receives the passkey private key, biometric data or device PIN. Passkey-only accounts use an internal .invalid identifier rather than a collected contact email.
• Security and capacity: limited request/execution metrics, quota counters and keyed abuse-protection hashes. The purpose is to protect access, prevent abuse and control the free service's capacity (Article 6(1)(f), legitimate interests). New application metric events exclude request inputs, results, raw IP, email and stable visitor IDs. Infrastructure providers may process network and request logs independently. Authentication session IP/user-agent fields are cleared.
• Support or legal requests: information you choose to send to the operator, used to answer the request or comply with applicable legal duties (Article 6(1)(b), (c) or (f), as applicable). Do not send passwords, API keys or special-category personal data.

Service inputs and recipients

Direct lookups process the submitted DOI, domain or text. DOI/bibliography queries are sent to Crossref; DNS queries use Cloudflare and may fall back to Google Public DNS. Deterministic text utilities run on the AUN backend. The optional order flow temporarily stores submitted inputs and results. Avoid submitting confidential or unnecessary personal information.

The frontend and request proxy use Vercel; the backend and private database use Hostinger. Google handles the Google authentication step you request. Data may also be disclosed when legally required. AUN does not sell account data, use it for advertising, or use login data to train AI models.

International processing

Infrastructure and authentication providers operate internationally, including outside the EEA. Their processing and transfer safeguards are described in their applicable terms and privacy documents: Hostinger, Vercel, and Google. This notice does not promise that all processing stays in the EU. Contact the operator for information about the arrangements applicable to your data; provider-contract coverage and transfer documentation remain part of the ongoing compliance review.

Retention and deletion

Live account and passkey records remain until you delete the account. Sessions last up to 24 hours; expired sessions and short-lived authentication challenges are pruned on later account requests. Authentication throttle hashes are pruned on later requests after 24 hours. Usage periods follow the approximately 93-day pruning policy. API credentials expire or can be revoked; account deletion removes their live records.

Order results become unavailable after 24 hours, with physical cleanup triggered by later requests. Deleting the account removes its live profile, passkeys, sessions, API credentials and associated root/delegated order data. Separately enrolled agent identities are not linked automatically and are not removed by deleting an unrelated human account.

Daily encrypted VPS recovery copies use 14-day retention after successful backups. Separately held off-server recovery copies currently have manual retention and are not immediately erased by an account-deletion request. Application journals and independent infrastructure logs have their own rotation and retention settings; a single fixed duration for every infrastructure log has not been established. This is a disclosed operational limitation, not a promise of immediate erasure from every copy. We retain support correspondence only for handling the request and justified legal follow-up.

Your choices and rights

Registration and Google sign-in are optional. Public anonymous services remain available subject to shared limits. Without login information AUN cannot provide the personal account. Google and passkey access can be linked explicitly after authentication; accounts are not automatically merged by matching email.

From the dashboard you can update your display name, download account data, revoke account API keys, manage passkeys and delete the account. For access, rectification, erasure, restriction, portability or objection where applicable, contact the operator above. You may complain to the competent supervisory authority, including the Italian Garante. Requests normally receive a response within one month, subject to the extensions and conditions allowed by the GDPR.

Removing AUN account data does not remove your Google account or automatically erase the connection listed in Google's own account settings. You can manage Google's authorization there. Passkey-only accounts have no email/manual identity recovery; keep a second passkey available.

Essential cookies and updates

Account pages use first-party Secure, HttpOnly session/challenge cookies. Session cookies use SameSite=Strict; the short-lived OAuth state cookie uses Lax to allow the return from Google while preserving signed-state checks. No advertising cookies are introduced by the AUN account UI. Google applies its own policies when you visit its sign-in page. Material changes to data use will be explained before the new use, with any authorization required by law.