RailCall Data-Flow Disclosure

Version 1.0 · Effective: July 14, 2026 · Applies to: RailCall Station v0.4+ ("Action Airlock" release)

Local-first by design. RailCall is architected so that your code, data, provider keys, and receipts stay on your machine (127.0.0.1). This disclosure shows exactly what data flows where — and what never leaves localhost.

Complete Data-Flow Table

Flow	When it happens	Where it goes	What data	Routed through RailCall?	Your control
Account & sign-in	You create/use an account	Our account gateway	Email, password hash, account ID	Yes (first-party)	Required for an account; local-only free tier available
Seat validation ping	Periodically, while a paid seat is active	Our seat-validation gateway	SHA-256(key) + nonce only — no action name, no per-action counts, no business data	Yes (first-party)	Inherent to a paid seat; the free single-seat tier sends no validation ping
Hosted compose (hosted builds only)	You use server-side compose instead of BYOK/local	Gateway → model provider	The description you type (zero-retention)	Yes (first-party, optional)	Use BYOK/local model to avoid entirely
Connected-service action (v1)	You approve a send	Your machine → the provider you keyed	The action content you approved	No — never transits RailCall	Full: dry-run, approve/deny, per-action
MCP session (v1)	You connect a local MCP host	Local only (loopback/stdio)	Governed plans/receipts; host sees what you type into it	No — RailCall sends nothing	Full: local; host governed by its own terms
Support	You contact support	Our support channel (e.g., Discord/email)	What you send us	Yes (first-party)	Optional

Key Points

✓Connected-service providers (Stripe, Slack, GitHub, etc.) are recipients you choose and direct; they are not RailCall sub-processors.
✓Each provider is governed by its own terms and privacy policy.
✓v1 introduces no new AiTrade-side egress — your action data goes directly from your machine to your provider, never through RailCall's servers.
✓All credentials are stored in a local 0600 vault on your machine and never transmitted to AiTrade.
✓MCP sessions are loopback/stdio only — nothing leaves your machine to reach RailCall.
✓Receipts are stored locally and Ed25519-signed for offline verification.

Controller/Processor Role (GDPR/UK GDPR/LGPD)

For data you send to a connected service through RailCall's BYOK model:

• You are the controller
• The provider is your processor (or independent controller, per your arrangement)
• AiTrade is neither controller nor processor of connected-service action content — that data never reaches us

RailCall is the local software tool you operate to direct those flows.

Entity: AiTrade LLC · Governing law: Florida · Last updated: July 14, 2026
This disclosure supplements our Privacy Policy and Terms of Service.