Last reviewed: 2026-10-05
Kit's Deals is an API-first deal feed for AI agents, operated by Private Key Commerce LLC (Wyoming, USA). This page describes how we handle security and data today, including what we have not done yet. Field-by-field data collection and retention details are in our API privacy reference at /privacy; the authoritative privacy policy is at https://kitsdeals.com/privacy/, and our terms are at https://kitsdeals.com/terms.
At a glance
- We are a small operation. We do not have a dedicated security team.
- We hold no security certifications (no SOC 2, ISO 27001 or similar) and have not had an independent security audit.
- The Service is designed to need very little personal data: no consumer accounts, no passwords, no email addresses, phone numbers or payment card data in our database.
- We do not sell personal information and do not run behavioural advertising.
What data we handle
- Request metadata: salted SHA-256 hashes of client IPs (never raw IPs) and User-Agent strings truncated to 200 characters, used for rate limiting, abuse detection and diagnostics.
- What you send us: watch intents (contact-shaped text is redacted before storage), optional webhook callback URLs and filters, and optional deal outcome reports and notes.
- Telemetry: MCP tool-call records and anonymous request-funnel events (90 days), river connection events (90 days), webhook delivery attempts (30 days).
- AI evaluation samples: a sample of model prompts and responses (which can include watch-intent text or public retailer-page content) is kept for up to 90 days to evaluate extraction quality.
- Public product data: prices, product pages and catalog data we collect from retailers.
Full details and retention periods: /privacy.
Infrastructure
- The API runs as a container on a single virtual private server we operate. Data is stored in a SQLite database on that server.
- All public traffic is served over HTTPS. Cloudflare sits in front of the API, so it handles every request, including the client IP address, before our server sees it.
- Some sourcing and model-evaluation work runs on operator-controlled hardware using locally hosted models. That work processes public retailer data and evaluation samples; it does not receive API credentials beyond its own scoped worker credential.
- We do not publish uptime, recovery-time or recovery-point commitments.
Access control
- Operator access to the server uses SSH keys only; password login is disabled.
- Automated workers use named, scoped credentials (for example, a worker scope cannot use operator-only routes). Each admin route is checked against the caller's scope, and refused or invalid admin credentials are recorded.
- Automation accounts on the server are separate from operator accounts and limited to specific commands, with privileged commands recorded.
- Logging is designed to exclude secrets and credentials, and none are kept in source control.
Application security
- Webhooks: each subscription gets its own signing secret, and every delivery is HMAC-signed so receivers can verify it.
- Outbound requests: fetches to retailer pages and webhook callbacks go through guards that refuse private, internal and non-public destinations.
- Input handling: submissions are validated against fixed schemas; contact-shaped text in free-form fields is redacted before storage or before it is sent to operator notifications.
- Rate limiting applies per client IP across the public API, with tighter limits on write endpoints.
- Payments: the few paid endpoints settle through the x402 protocol; we see the paying wallet address, never card data.
Third parties we use
Each receives only what it needs for its function.
- Cloudflare: network edge for all API traffic, and Workers AI model inference.
- Anthropic: model inference for interpreting watch requests and extracting deal data. Anthropic does not train on API data under its commercial terms. We have no zero-data-retention agreement with Anthropic, so it keeps API data for a limited period under its standard retention policy.
- Telegram: our internal operator notifications. Watch-request text and deal outcome notes (with contact-shaped text redacted) can appear in our private operations channel.
- Brave Search and Best Buy APIs: product and catalog lookups; these receive product queries, not user data.
- Typesafe (Jev): product categorisation evaluation on public product listing data; receives no user data.
- DeepSeek (through Cloudflare AI Gateway): used only when we enable a bounded model evaluation that selects it. Those evaluation samples can include original watch-request text.
- Coinbase CDP: x402 payment settlement for paid endpoints.
- Affiliate networks and retailers: only when a human clicks a disclosed retailer link. See
/privacyfor the active networks and opt-outs. - Our hosting provider: hosts the server and its storage.
AI and models
- We use language models to interpret what an agent's user is looking for and to read retailer pages into structured deals. Deals pass automated checks before publication; many are also reviewed by an operator, and some trusted sources publish automatically.
- We do not use your data to train models, and we do not opt in to any provider's training programme.
Monitoring and incidents
- We run continuous health monitoring with operator alerts and a daily operations digest, and failures in delivery or sourcing surface as health flags rather than being dropped silently.
- If an incident affects data you have given us, we will post a notice on this page. Most use of the Service is anonymous, so we may have no direct way to contact you.
Reporting a security issue
Email [email protected] with "Security" in the subject line. Please include enough detail to reproduce the issue and do not access other users' data or degrade the Service while testing. We will acknowledge reports as quickly as we can. We do not currently run a paid bug bounty. Our machine-readable contact is at /.well-known/security.txt.
This page describes the Service as it currently runs. We update it when our practices change.