Privacy policy

1. Responsibility and scope

The publisher identified in the legal notice is responsible for Agentik’s account administration, security, billing and website processing. This policy covers website visitors, account holders and workspace users. For personal data submitted on an organisation’s instructions through a tool, the respective controller and processor roles depend on the agreed processing terms and the selected provider.

• Publisher and privacy contact
• Data processing

2. Data we process

We receive information from you, your sign-in provider, workspace administrators, your agents and the services involved in the requests you make. Tool providers may return information about third parties, including professional contact details, when you request a search or enrichment tool.

• Accounts and workspaces: name, email address, identity-provider identifier, membership, role, invitations and settings.
• Credentials and security: hashed API keys, key labels and permissions, authentication grants, timestamps, audit events, network information such as IP prefix, country and network operator, and user agent. New plaintext API keys are shown at creation and are not retrievable from their stored hash.
• Trial-credit eligibility: verified sign-in provider identifiers, account age, email addresses and previous trial decisions. Additional matching uses keyed hashes of the browser context associated with your authenticated session, network context and normalised profile names, together with email-similarity links. These records are linked to accounts and are pseudonymous, not anonymous.
• Executions and billing: tool and run identifiers, input fingerprints for idempotency, provider task references and metering evidence, prices, reservations, charges, refunds, status, timing and sanitised errors. The execution ledger does not store raw tool inputs or outputs as a payload history.
• Payments: Stripe customer and transaction references, purchase and billing details needed for payment, accounting and disputes. Card entry takes place with Stripe; Agentik does not store full card numbers.
• Internal account notifications: account name, primary email address and account identifier for new registrations, and workspace, purchase reference and payment amounts for successful purchases, sent to authorised staff through configured Discord channels. When trial notifications are enabled, they also include trial-credit decisions, limited matching indicators, account and workspace references, and operator review notes. Delivery payloads are erased after sending or expiry.
• Transactional email: recipient addresses, message content and delivery references for selected authentication messages, invitations, welcome messages, payment confirmations and alerts. Pending message bodies are encrypted in the delivery queue.
• Optional lifecycle emails: new accounts receive setup help, trial reminders, product tips and occasional feedback requests about Agentik unless they turn them off. We use your account setup, workspace connection, completed tasks, trial-credit expiry and purchase status to keep them relevant. Your email preference is separate from cookie consent. You can turn them off during onboarding or in account settings, or unsubscribe from any message, free of charge. Feedback is optional and pauses the getting-started sequence; authorised staff can review your answers to help you and improve Agentik. Delivery and rejection events help us avoid emailing unavailable addresses.
• Support: messages you send, staff or assistant responses, conversation references and authorised account information used to answer you. When Discuss with us on the website or human Support is enabled, messages are stored by Agentik and mirrored to private Discord channels for authorised staff. Website chat includes any optional name or email you provide; app Support includes your account and workspace identifiers. Do not send passwords, API keys, payment-card details or sensitive tool payloads to support.
• Affiliate attribution: consented campaign and referral references associated with a new account and its initial workspace, together with confirmed payment adjustments, support commission accounting. Affiliate contact details and external payment references are restricted to authorised operators. Affiliate links do not expose customer identities or commission statements.
• Website use: page and device information for service operation and Vercel Web Analytics; consent choices stored in your browser; optional PostHog and Google Analytics measurement and advertising events only when configured and you consent.

3. Purposes and legal bases

Account access, requested tool execution, payments and support are processed to perform our contract with you, or in our legitimate interests in providing an organisation’s users with the contracted service. Necessary account and request information is required to provide those features.

Security, abuse prevention, service diagnostics and limited audience measurement support our legitimate interests in protecting and improving the service. Accounting, tax records and lawful disclosure requests are processed to meet applicable legal obligations. Optional product analytics and advertising rely on consent, which can be withdrawn without affecting earlier lawful processing. Lifecycle emails about Agentik itself rely on our legitimate interest in helping account holders use the service; you can object at any time by turning them off or unsubscribing.

Spending rules and security checks may automatically reject a request or pause a key. Contact us for a review if you believe access was restricted incorrectly.

To prevent repeated claims for free trial credit, we compare account and sign-in information with earlier claims and use the additional matching signals described above. A trial offer may be withheld automatically or sent for staff review. These checks do not close your account or remove purchased credit. Contact info@agentik.cc to request a review of a trial-credit decision.

4. Recipients and international processing

Authorised personnel and the service providers listed in our register can process the information needed for their role. Workspace administrators can access workspace information within their permissions. Selected tool providers receive the requests needed to fulfil your calls; a catalog listing does not mean every provider receives your data. We may disclose information when legally required or necessary to establish or defend legal claims.

Providers may process data outside your country, including in the United States. We do not promise EU-only processing. Applicable transfers require a valid legal mechanism, such as an adequacy decision or contractual safeguards, for the actual service and recipient. Contact us for the safeguards and processing locations applicable to your use; a link to a vendor’s public DPA does not establish that all account-specific arrangements have been completed.

• Subprocessors and other service providers

5. Cookies and browser storage

Cookies and similar browser storage help operate the service and, where enabled, measure visits or advertising performance. You can accept or reject optional analytics and advertising cookies from the banner. Rejecting them does not prevent you from using Agentik.

• Acquisition measurement: after optional measurement consent, a signed first-party cookie links a random visitor identifier and campaign parameters through signup for up to 30 days. We store that acquisition source on your account and use server-confirmed signup, connection, execution and payment milestones for funnel reports. Tool inputs and outputs are excluded. Withdrawing analytics consent stops pending PostHog and Google Analytics delivery; withdrawing marketing consent stops pending advertising delivery; it does not delete earlier lawful records.
• Essential storage: authentication cookies support sign-in and security. We also save your cookie choice in your browser so you are not asked on every visit. That preference remains until you change it or clear your browser storage.
• When you open Discuss with us on the website, an essential first-party HttpOnly cookie preserves your random visitor session for up to 30 days, and browser storage remembers that you opened the chat. Replies remain available in that browser; an optional email address does not recover access. Keyed network fingerprints help enforce abuse limits. These support functions do not depend on optional analytics consent.
• Trial-credit checks reuse the browser context already associated with your signed-in Clerk session. These checks do not add a tracking cookie or use canvas fingerprinting. Rejecting optional analytics and advertising has no effect on trial-credit eligibility.
• Vercel Web Analytics: when enabled, it measures page views and aggregate traffic without analytics cookies. Data can include the page URL, referrer, device and browser information, and approximate location. Vercel uses a request-derived hash to distinguish visitors; that visitor session is discarded after 24 hours. This measurement is separate from your advertising-cookie choice.
• PostHog: when configured and you accept analytics, we measure reviewed page views and workspace and API-key actions, signup, setup, tool-execution outcomes, confirmed payments and payment adjustments. Reviewed campaign parameters are sent separately from page URLs. Signed-in actions use account identifiers; automated tool and payment activity uses workspace identifiers. Browser storage maintains analytics identity. We exclude URL query strings and fragments, account and connection authorization pages, form contents, credentials and tool payloads. Session replay and automatic interaction capture are disabled. Older advertising consent does not automatically enable PostHog; the updated notice asks for a new choice.
• Google Analytics: when configured and you accept analytics, Google receives reviewed page views, campaign labels, limited browser and device information, random browser and session identifiers, and server-confirmed account setup, tool-use and payment milestones. Confirmed payment events include their amount and currency. After consent, Agentik stores a random browser identifier in local storage for up to 390 days and shares the same identifier with Google; an existing Google browser identifier is reused when available. Google cookies maintain session identity. These identifiers link consented website visits to server-confirmed conversions. We send reviewed page names, sanitized campaign parameters and referrer origins, excluding account authorization pages, raw URL queries, form contents, email addresses, credentials and tool payloads. Automatic interaction measurement, Google Signals and advertising personalization are disabled. Earlier PostHog consent does not enable Google Analytics; the updated banner asks for a new choice. Rejecting analytics prevents Google requests and cookies; withdrawal disables collection, clears our Google Analytics cookies and stored browser identifier, and reloads the page.
• Reddit Ads: no Reddit advertising pixel is currently installed on Agentik. If introduced, it will require your advertising consent before loading. Reddit’s pixel can use cookies and similar identifiers, page visits and advertising events to measure conversions, attribute visits to campaigns and support relevant advertising. Its cookie notice describes the technology and available controls.
• X Ads: when configured, the X advertising pixel loads only after you accept advertising cookies on public marketing pages, onboarding and dashboard pages. Confirmed signup, first tool use and top-ups can be sent to X, including the payment value in USD and your X ad click identifier. Consented signup and purchase events can also be sent server-to-server, with a shared conversion identifier to avoid double counting. Authentication and connection approval pages remain excluded; tool inputs, outputs and payment-card details are not included in these events. Rejecting advertising cookies keeps it off; you can withdraw consent through Cookie settings.

• PostHog privacy controls
• Google Analytics privacy controls
• Vercel Web Analytics privacy
• Reddit Ads cookie notice
• X Ads conversion tracking and privacy

Your cookie choices

Open Cookie settings in the footer at any time to change or withdraw your analytics and advertising consent. Withdrawal stops future optional analytics and pixel loading; it cannot recall data already sent. You can also remove existing cookies and site storage through your browser settings. Clearing essential cookies may sign you out; clearing your saved choice makes the banner appear again.

6. Retention and deletion

Account and membership records are needed while a workspace remains active. Closure and erasure requests are reviewed against outstanding executions, security investigations and legal recordkeeping duties; there is no automatic promise that all account records are erased within 30 days.

Scheduled database cleanup targets key-usage records and run network context older than 90 days, delivered security events older than 180 days, and processed run events older than 90 days. Expired OAuth codes and tokens become eligible for cleanup after one additional day. Cleanup runs in batches, so eligibility is not an exact deletion timestamp.

Additional trial-matching hashes for browser context, network context and normalised profile names, and email-similarity links, become eligible for scheduled cleanup after 30 days. Verified Google sign-in identifier hashes, canonical email addresses, GitHub identifiers, grant IP digests and trial decisions remain with claim and audit evidence to prevent repeated rewards and resolve disputes; they do not share that 30-day deadline.

Financial ledger entries, run receipts, audit records and unresolved incidents do not currently have a blanket automatic deletion deadline. Their retention depends on reconciliation, applicable legal duties and the need to resolve disputes. Contact us for the retention applicable to a particular record and to request deletion where those grounds no longer apply.

Queued email payloads are erased after sending, cancellation or expiry; delivery metadata remains. Delivery windows depend on message type: ten minutes for relayed authentication messages, 72 hours for invitations and up to seven days for other transactional messages. Retries stop after ten attempts or 23 hours from the first attempt. These delivery windows do not extend the validity of an authentication code.

Optional reminder payloads expire within 23 hours and are erased after sending, cancellation or expiry. Feedback comments are removed after 90 days. Consent history, feedback categories, ratings and delivery metadata remain available for preference enforcement and service measurement. Suppression records retain a digest of the address rather than its plaintext so we can respect delivery blocks.

Support assistant conversations become inaccessible through the application after 30 days and can be removed from history earlier. Removal revokes application access; it does not establish physical deletion from every workflow store, backup or model provider. Infrastructure backups, provider logs and analytics have their own retention settings and terms.

Human Help and Support conversations expire 30 days after creation. Scheduled cleanup redacts local message content and identities, then deletes the mirrored Discord thread and control card. Failed remote cleanup retains minimal routing references for another attempt. Cleanup runs in batches, so expiry is not an exact physical-deletion timestamp across infrastructure or backups.

7. Your rights and contact

Where applicable, you can request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. If your organisation controls the data, contact its administrator first; we can assist with requests concerning our processing.

Use the contact in the legal notice. We may need proportionate information to verify your identity, but will not ask for your password or API key. We normally respond within one month; where the law permits an extension, we will explain it. You may complain to the CNIL or your competent data-protection authority.

• Contact the publisher
• CNIL complaints

8. Security and policy changes

Safeguards include encrypted transport, hashed API keys, workspace access checks, revocation, optional spending restrictions and security monitoring. No system is completely secure. Personal-data incidents are assessed and notified to affected customers and authorities as required by applicable law.

We update this policy when our practices change. The date above identifies the current version; material changes will be communicated where required.