Privacy policy

01Who we are

Tesera is an independent team building the MCP gateway for on-chain networks, starting with Elysium. This policy covers teseralab.com and the gateway at mcp.teseralab.com. We handle personal information in line with the privacy laws that apply to us.

02The short version

No accounts. You do not sign up, sign in or give us an email address to use the gateway.

No keys. We never receive, store or ask for private keys or seed phrases. The gateway prepares unsigned transactions and you sign them in your own wallet.

No IP addresses kept. We do not store the IP address of anyone who uses the gateway, and we do not keep a record of the requests your AI client makes.

No tracking. No advertising trackers, no analytics profiles, and nothing is ever sold.

03What the gateway handles

When your AI client calls a tool, the gateway reads the inputs it sends, such as an address, a contract or a transaction to prepare, does the work and returns the result. Those inputs are used to answer that request and are not written to a log.

Rate limits. To stop one connection from flooding the gateway, each request is counted against a one-way, salted fingerprint of the connecting IP address. The IP address itself is never stored, and the fingerprint is held by our host only for the current minute so the count can work.

Error records. If something fails inside the gateway, we keep a short line saying which tool failed and why, with any web addresses and long codes removed. These lines contain no IP address and no request contents, and they are deleted automatically within 7 days.

Our hosting provider. The gateway runs on Cloudflare. Like any network provider, Cloudflare sees the IP address of each connection in order to deliver it, under its own privacy policy. We have turned off per-request logging on our side.

04Things you choose to create

Some tools create something that lives on our servers because you asked for it. Each one is tied to an ID, not to you.

Watches. A watch stores the contract and events you asked to follow, the webhook address if you gave one, and the matches it finds. Only someone holding the watch ID and its secret can read or delete it. Deleting a watch removes its matches, its queued webhook deliveries and its webhook address straight away. A watch expires after the time you set, at most 90 days, and everything left in it is removed 7 days later.

Indexes. An index stores public event data from Elysium for the contract you named. It holds nothing about who asked for it, and any client can reuse an index someone else started.

Builds. When you compile a contract, the source and compiled output are kept under a random build ID for 30 days so you can deploy it, then removed automatically.

Access keys. Keys are optional. If you make one, we store the wallet address that signed for it, the name you gave it, a SHA-256 fingerprint of the key (never the key itself), when it was made and last used, and how many calls it made to each tool on each day. A fingerprint of each signature is kept for an hour so it cannot be reused. Usage counts are deleted after 90 days, and a revoked key and its counts are deleted 30 days after it is revoked. A wallet address is public on the network, so keys are tied to it rather than to your name or email.

05Services the gateway calls for you

To answer a request, the gateway sometimes asks another service. The request comes from our servers, not from your device, so these services see the address or contract being looked up but not who you are or your IP address.

These are the Elysium network nodes, the Elysium block explorer, Sourcify for verified contract sources, the OpenChain signature database for naming unknown functions, and a public IPFS gateway for reading agent registration files. Tesera Shield checks every transaction the gateway prepares: the addresses in it are sent to GoPlus Security, and to Chainalysis where that check is turned on, and the gateway downloads the public US sanctions list from GitHub. The perps tools send the account and market you ask about to the public Hyperliquid API.

Anything you send to Elysium itself, such as a signed transaction, becomes public on the network by design.

06What this site collects

Messages you send us. The contact form does not send anything to us by itself. It writes your name, email address, organisation if you give one, the reason, the urgency and your message into an email in your own email app, addressed to contact@teseralab.com. Nothing reaches us until you press send, and we keep what you send only as long as we need to reply and follow up.

Technical information. Our hosting provider handles the IP address and browser details of each visit in order to serve the site and protect it from attacks.

Third-party resources. The site loads fonts from Google Fonts and code libraries from jsDelivr. When your browser requests them, those providers receive your IP address under their own privacy policies.

07How long we keep it

Rate limit fingerprints last about a minute. Gateway error lines are deleted automatically within 7 days. Builds are removed after 30 days. Access key usage counts are deleted after 90 days, and revoked keys 30 days after they are revoked. Watches are removed 7 days after they end or straight away when you delete them. Emails you send us are kept only as long as we need to reply and follow up, and you can ask us to delete them at any time.

08Your choices

Because the gateway does not know who you are, there is usually nothing about you to see or delete. If you have sent us a message, or you want a watch removed and have lost its secret, email contact@teseralab.com and we will help.

If you are unhappy with how we have handled your information, tell us first so we can put it right. If you are still not satisfied, you can contact the privacy regulator where you live.

09Security

We hold very little, and nothing that can move your funds: a breach of our systems cannot expose private keys because we never have them. Webhook messages are signed so you can check they came from us, secrets are compared in a way that does not leak them through timing, and text that comes from the chain or from other people is cleaned before it reaches your AI. To report a vulnerability, use the contact form.

10Changes to this policy

If we add features that handle more information, we will update this page before they launch and change the date at the top.