ToolCall Store provides an action API for AI agents. This policy explains what we collect, what we don't, and how long we keep it. We collect the minimum needed to run the service safely and to give you verifiable receipts.
What we store
- Your email address — for your account, approval notifications, and billing.
- API key hashes — we store a hash of each key, never the raw key after it's shown to you once.
- Action receipts — the record of every action taken: action type, cost, timestamp, status, and outcome.
- Provider transaction IDs — references like an OpenProvider order ID, so an action can be verified or reversed.
- Spend, balance, and approval history — to enforce caps and show you what your agent did.
What we do NOT store
- Your provider API keys in plaintext — BYOK keys are encrypted at rest and never returned after registration.
- Domain registrant info beyond what OpenProvider requires to register a domain on your behalf.
- Raw API keys, card numbers, or other secrets in logs.
Data retention
- Receipts are kept for 2 years for audit and dispute resolution, then deleted or anonymized.
- API keys are rotatable at any time — rotating immediately invalidates the old key.
- You can request deletion of your account and associated personal data by emailing us; receipts tied to completed financial transactions may be retained where required by law.
Third-party providers
To execute actions we send the minimum necessary data to the relevant provider (OpenProvider for domains, our Stalwart server for email, Stability AI / Together AI / fal.ai for images, and Anthropic / OpenRouter / DeepSeek / Groq for LLM routing). Each provider handles that data under its own terms.
Security
Keys are transmitted over TLS, stored hashed, and scoped to the minimum permissions you grant. Provider credentials you bring (BYOK) are encrypted at rest. Approval gates and spend caps limit the blast radius of any single key.
Contact
Questions, data requests, or deletion requests: hello@toolcallstore.com.