Privacy policy

[LEGAL ENTITY], [REGISTERED ADDRESS] ([COMPANY NUMBER]), is the controller of the personal data described here. Write to [PRIVACY CONTACT EMAIL] about anything on this page.

For the content your agents work on, the relationship is the other way around: you are the controller and we are your processor. Clause 6 and the data processing agreement say what that means.

Your account. Name and email address, from whoever you signed in with, and which workspaces you belong to. Held by Clerk on our behalf.

Your workspace. The agents you write, their instructions, your skills, departments, schedules and approval rules; the conversations you have with your agents and the documents they produce.

Credentials you store. When you connect a service, the credential is encrypted with AES-256-GCM before it is written down and is never shown again, to you or to us. What you can see afterwards is a hint, such as the last few characters, so you know which one it is.

What you were charged. Tokens used, what they cost, which model and which agent, plus credits bought and a Stripe customer reference. Card details never reach us. They are entered on Stripe’s own pages.

When things break. Error records, with the message and where it happened, so a fault can be found and fixed.

Running the service for you, which is most of it, is performed under our contract with you (Article 6(1)(b)). Keeping it secure and working, including the error records above, rests on our legitimate interests (Article 6(1)(f)). Keeping records of what you were charged is a legal obligation (Article 6(1)(c)), which is why clause 5 says they outlive a deletion request.

We do not sell your data, we do not advertise to you, and nothing here is used to build a profile of you.

An agent works by sending what it has been asked, and what it reads while working, to a language model. That means the model provider sees the content of the task and of anything the agent opens on the way: a page it fetches, a document it was pointed at, an email it was asked to read.

Which provider that is depends on the model you choose for each agent, and the table in clause 6 names them. If you bring your own key, the request goes to your own account with that provider instead, under whatever terms you have with them, and we bill you nothing for it.

What follows from this. Anything you would not send to a third party should not be something you point an agent at. Approval rules exist for exactly this: they hold an action until a person says yes, and they are the right tool when an agent can reach something sensitive.

Your workspace is kept while it exists. Close it from Your Data in the app and your agents stop immediately; thirty days later everything in it is permanently deleted, and during those thirty days you can undo it.

One thing survives that, and only one. Records of what you were charged are accounting records we are required to keep for 10 years. We also keep a minimal record that an export or a deletion happened, with the date, who asked and how many rows were involved, so we can show that we did what this page says. It contains no content of yours.

A credential you stored is destroyed with the rest. A key you added to your own account is destroyed as soon as your account is, without waiting thirty days, because it is a working credential at somebody else’s service.

These are our processors. Each one is used for what its row says and nothing else. Telegram and Google appear only if you choose to connect them.

Some of them are outside the European Economic Area, as the table says. Those transfers rely on the European Commission’s standard contractual clauses, or on an adequacy decision where one covers the country.

The application runs in Frankfurt and the database is in Frankfurt. The isolated environments your agents work in run in Paris. Sign-in and payments are handled by Clerk and Stripe, which are United States companies. What your agents send to a model can be processed in any region its provider serves from, including the United States, because inference is not pinned to the EU by default. The data residency statement lists each kind of data and how we verified where it is.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and object to processing that rests on our legitimate interests.

Two of those do not need you to write to anyone. Your Data in the app hands you a complete copy of your workspace as one file, and closes it for deletion, on every plan including the free one. For anything else, write to [PRIVACY CONTACT EMAIL] and we will answer within one month.

If you think we have handled your data badly you can complain to your data protection authority, and we would rather you told us first so we can fix it.

This is a product for work and is not directed at children. We do not knowingly hold data about anybody under 16.

If we change anything that matters we will say so in the app before it takes effect, rather than quietly changing the date at the top of this page.