Privacy Policy

Account data

When you sign up we collect your email address and, if you use Google OAuth, your name and profile picture. We use this to authenticate you and communicate about your account.

Workspace and agent data

We store the content you create: workspaces, agents (names, system prompts, model settings), run logs, event streams, uploaded resources, and tool configurations. This data is necessary to provide the service.

Integration credentials

When you connect a third-party integration (Gmail, Slack, GitHub, etc.) we store the OAuth tokens required to act on your behalf. These tokens are encrypted at rest using AES-256-GCM and are only used to execute actions explicitly requested by your agents.

Billing data

Payments are processed by Stripe. We store your subscription status and Stripe customer ID but never your card number or CVV — those are held exclusively by Stripe under their PCI-DSS compliance programme.

Usage data

We collect aggregate telemetry such as run counts, token usage, and error rates to operate and improve the service. We do not sell this data or use it to profile you for advertising.

Cookies and sessions

We use session cookies to keep you signed in. We do not use tracking cookies or third-party advertising cookies.

• Providing the service — running your agents, storing your data, serving the dashboard.
• Billing — managing subscriptions and processing payments via Stripe.
• Transactional email — account confirmations, password resets, and onboarding messages.
• Support — investigating issues you report; run logs may be accessed by our team to diagnose bugs.
• Service improvement — aggregate, anonymised usage data to understand how features are used.

We do not use your agent content, system prompts, or run data to train AI models.

We share data with the following subprocessors to operate the service. Each is bound by a data processing agreement or equivalent contractual safeguard.

When agent runs call AI model APIs, the content of those requests is transmitted to the relevant provider. Please review Anthropic's and OpenAI's own privacy policies for how they handle API data.

We retain your account and workspace data for as long as your account is active. Run logs and events are retained for 7 days on the free plan and 30 days on team plans. Enterprise workspaces may have custom retention windows. Uploaded resources are retained until you delete them or close your workspace.

When you delete a workspace or close your account, we mark your data for deletion. It is permanently deleted within 30 days, giving you a grace period to request restoration if the deletion was accidental. Data retention required by law (e.g. billing records retained by Stripe for 7 years) is excepted from this policy.

We encrypt data in transit (TLS 1.2+) and at rest. OAuth tokens are encrypted with AES-256-GCM. Access to production data is restricted to authorised personnel. Row-level security policies ensure workspace data is isolated between tenants.

To report a security vulnerability, email bernabranco@agentos-ai.dev. We aim to acknowledge reports within 48 hours.

If we become aware of a personal data breach that compromises your personal data, we will notify you and the relevant supervisory authority without undue delay, and in any case within 72 hours of becoming aware of the breach, as required by the GDPR and other applicable data protection laws.

Notifications will include:

• The nature and scope of the breach
• The categories and approximate number of data subjects affected
• The likely consequences of the breach
• Steps you should take to protect yourself
• Our contact point for further information

We maintain an internal breach register and will cooperate fully with data protection authorities in their investigations. For urgent security incidents, contact bernabranco@agentos-ai.dev.

GDPR (EU/EEA residents)

If you are resident in the EU/EEA, you have the following rights under the GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your personal data, subject to legal obligations.
• Right to data portability — receive your data in a machine-readable format and transfer it to another provider.
• Right to object — object to processing of your data based on our legitimate interests.
• Right to restrict processing — ask us to limit how we use your data while a dispute is resolved.

To exercise any GDPR right, email bernabranco@agentos-ai.dev with your request. We will respond within 30 days. You may also lodge a complaint with your local data protection authority at any time.

CCPA (California residents)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act:

• Right to know — request what personal information we have collected, used, and shared about you.
• Right to delete — request deletion of personal information we have collected from you.
• Right to opt-out of sale or sharing — direct us not to sell or share your personal information with third parties for their direct marketing purposes. We do not currently sell personal information, but you can opt out at any time.
• Right to correct — request that we correct inaccurate personal information.
• Right to non-discrimination — you have the right not to be discriminated against for exercising your CCPA rights. We will not deny you goods or services, charge different prices, provide lower quality service, or suggest that you will receive different treatment based on your exercise of these rights.

To exercise any CCPA right, submit a request to bernabranco@agentos-ai.dev and include “CCPA Request” in the subject line. We will verify your identity and respond within 45 days. You may authorise an agent to submit a request on your behalf; we may ask for a signed authorisation.

Sale of personal information

We do not sell your personal information as defined by the CCPA. We do not exchange personal information for monetary consideration.

Sharing of personal information

We may share personal information with third-party service providers (our subprocessors) to operate the service. Sharing personal information with our service providers for their use in performing services on our behalf is not a "sale" under the CCPA. You have the right to opt out of the sale or sharing of your personal information at any time.

Personal information of minors

We do not knowingly solicit the sale or sharing of personal information of minors (consumers under 16 years of age). If you are between 13 and 16 years old and believe your personal information is being used, please contact us immediately.

AgentOS is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have done so, contact us and we will delete it promptly.

We may update this policy as the service evolves. When we make material changes, we will notify you by email or by displaying a notice in the dashboard at least 14 days before the changes take effect. Continued use of the service after the effective date constitutes acceptance.

For privacy-related questions or requests: bernabranco@agentos-ai.dev