RailCall Data-Flow Disclosure

Version 2.0 · Effective: August 27, 2026 · Applies to: RailCall Station v0.4+ ("Action Airlock" release)

Published for review. Version 2.0 adds four flows Version 1.0 omitted — metering, the installer and update fetch, Marketplace checkout and install, and publisher key registration — because the Terms of Service define all of them as Services and point at this page for what leaves your machine. The seat-validation row is also restated: its frequency is an open question across our own pages and is flagged rather than guessed. Not yet reviewed by counsel.

Local-first by design. RailCall is architected so that your code, data, provider keys, and receipts stay on your machine (127.0.0.1). This disclosure shows exactly what data flows where — and what never leaves localhost.

Complete Data-Flow Table

Flow	When it happens	Where it goes	What data	Routed through RailCall?	Your control
Account & sign-in	You create/use an account	Our account gateway	Email, password hash, account ID	Yes (first-party)	Required for an account; local-only free tier available
Entitlement / seat validation	While a paid plan is active — trigger and interval still to be confirmed; see the counsel note below the table	Our entitlement gateway	SHA-256(key) + nonce only — no action name, no per-action counts, no business data	Yes (first-party)	Inherent to a paid plan; running the free local protocol involves no account and no such call
Metering	When you use a metered hosted Service (e.g. hosted compose)	Our billing gateway	A blind usage record — key hash + nonce + a count. No prompt content, no action content, no workflow names	Yes (first-party)	Only reaches us for a hosted Service you chose. Local execution is never metered
Installer & update fetch	You run the install script, or the client checks for a release	railcall.ai and our release host	An ordinary HTTPS request. Your IP address and user agent are visible to the server, as with any download	Yes (first-party)	Mirror the release and install from your own copy to avoid it entirely
Marketplace browse, checkout & install	You browse, buy, or install a Listing	Our Marketplace, and our payment processor for a paid Listing	Account ID, what you viewed or bought, and billing details handled by the processor. We do not receive your full card number	Yes (first-party)	Optional — the Marketplace is not required to run RailCall
Publisher key registration & payouts	You register as a Marketplace Publisher	Our Marketplace, and our payment processor for identity verification and payouts	Your Ed25519 public key, seller profile, and — for paid Listings — identity and payout details held by the processor. Your private signing key never leaves your machine	Yes (first-party)	Optional — only if you choose to publish
Hosted compose (hosted builds only)	You use server-side compose instead of BYOK/local	Gateway → model provider	The description you type (zero-retention)	Yes (first-party, optional)	Use BYOK/local model to avoid entirely
Connected-service action (v1)	You approve a send	Your machine → the provider you keyed	The action content you approved	No — never transits RailCall	Full: dry-run, approve/deny, per-action
MCP session (v1)	You connect a local MCP host	Local only (loopback/stdio)	Governed plans/receipts; host sees what you type into it	No — RailCall sends nothing	Full: local; host governed by its own terms
Support	You contact support	Our support channel (e.g., Discord/email)	What you send us	Yes (first-party)	Optional

Counsel — completeness of this tableTerms of Service §12.3 points at this page as the description of what leaves your machine, so a flow missing here is a disclosure gap, not a documentation gap. Version 1.0 of this table had six rows and omitted metering, entitlement and licence issuance, the Marketplace, publisher key registration, and the installer and update fetch — all of which the Terms define as Services. Those rows are added above from the architecture as documented; each one still needs checking against the code before adoption, and any crash or error reporting the client performs needs a row of its own if it exists. Two specific items: (1) confirm the trigger and interval for entitlement and seat validation — this page previously said “periodically, while a paid seat is active,” which ToS §25 contradicts, and the Privacy Policy and Security page carry the same unresolved question; (2) name the downstream inference provider in the hosted-compose row, which Art. 13 requires and which ToS §13.5 assumes is disclosed here.

Key Points

✓Connected-service providers (Stripe, Slack, GitHub, etc.) are recipients you choose and direct; they are not RailCall sub-processors.
✓Each provider is governed by its own terms and privacy policy.
✓Your action data goes directly from your machine to your provider, never through RailCall's servers. The first-party rows above are account, billing, and distribution flows — none of them carries action content.
✓All credentials are stored in a local 0600 vault on your machine and never transmitted to AiTrade.
✓MCP sessions are loopback/stdio only — nothing leaves your machine to reach RailCall.
✓Receipts are stored locally and Ed25519-signed for offline verification.

Controller/Processor Role (GDPR/UK GDPR/LGPD)

For data you send to a connected service through RailCall's BYOK model:

• You are the controller
• The provider is your processor (or independent controller, per your arrangement)
• AiTrade is neither controller nor processor of connected-service action content — that data never reaches us

RailCall is the local software tool you operate to direct those flows.

Counsel — registered addressCounsel supplied the jurisdiction of formation on 2026-08-27, and the entity block below now reads "AiTrade LLC, a Florida limited liability company". The registered business address was not supplied and is not published anywhere on this site — we have not invented one. Provide it.

Entity: AiTrade LLC, a Florida limited liability company · Governing law: Florida · Last updated: July 14, 2026
This disclosure supplements our Privacy Policy and Terms of Service.