Privacy Policy

1. Who We Are and Data Controller

AgentCloud (“AgentCloud”, “we”, “us”) operates the website and platform available at agentcloud.agency and its subdomains (the “Service”). AgentCloud is the data controller for the personal data described in this policy.

You can contact us for any privacy matter, including exercising your rights, at privacy@agentcloud.agency; for account and product support the address is support@agentcloud.agency. We answer privacy requests within 30 days.

This policy covers our website, the AgentCloud platform and the AI agents you subscribe to. It does not cover third-party websites and services you choose to connect to AgentCloud, which are governed by their own privacy policies.

2. What AgentCloud Does

AgentCloud is a no-code platform that lets businesses deploy and manage AI agents. You create an account, choose agents from our marketplace, connect the tools you already use (for example Shopify, Gmail, Google Calendar, Google Sheets, Slack, Notion or HubSpot), and chat with the agents from our web interface.

To provide this service we process account data, billing data, the messages you exchange with agents, the data your connected tools send to the agents, and the technical data needed to keep the platform secure and to measure usage.

3. Information We Collect

Account and profile data: name, email address, profile picture (when you sign in with Google), authentication method, language and interface preferences, account creation date and account status.

Authentication data: sign-up and sign-in are handled by Supabase Auth. If you register with email and password, your password is stored by our authentication provider only as a salted hash — we never see it or store it in plain text. If you sign in with Google, we receive your name, email address and profile picture from Google.

Billing data: the plan and agents you subscribe to, amounts, currency, invoices, payment status, billing country and the type of payment method used (for example card, Klarna or Amazon Pay). Card numbers and full payment credentials are collected and stored directly by our payment processors (Stripe and PayPal); they never pass through or are stored on AgentCloud servers, which only receive a token, the card brand and the last digits.

Conversation and usage data: the messages you send to agents, the responses generated, the tools or integrations the agent uses on your behalf, the number of tokens consumed, and timestamps. This data is needed to deliver responses, enforce plan limits and bill metered overage.

Connected integration data: when you connect a third-party tool we store the OAuth access and refresh tokens you authorise (encrypted at rest) and the small amount of metadata needed to identify the connection (for example the shop domain for Shopify). Agent actions run with those tokens only when you trigger them.

Form and communication data: name, surname, email address and the content of your message when you use our contact form or join the waitlist.

Technical and security data: IP address, user agent and request metadata used for rate limiting, abuse prevention, error diagnostics and security logging.

4. How We Collect Information

Directly from you, when you create an account, subscribe, chat with an agent, connect an integration, or fill in one of our forms.

From the identity provider you choose, such as Google, or from the third-party services you connect, which send us the data the agent needs to perform the task you asked for.

Automatically, from your browser or device, through the cookies and similar technologies described in section 8.

5. Why We Use Your Data and Our Legal Bases

To provide the Service you requested (performance of a contract): creating and managing your account, running the agents you subscribed to, storing your conversation history, enforcing plan and token limits, and providing support.

To process payments and comply with tax and accounting obligations (contract and legal obligation): issuing invoices, handling refunds, preventing payment fraud and keeping accounting records.

To keep the platform secure and reliable (legitimate interest): rate limiting, abuse and fraud prevention, security logging, debugging and protecting our infrastructure.

To send transactional and account emails (contract): welcome messages, receipts, subscription and usage notices, security alerts. We do not send marketing emails without your consent, and you can opt out of non-essential communications at any time.

To improve the Service (legitimate interest): aggregate statistics about usage and errors, so that we can fix issues and prioritise features. We do not use your conversation content to train models.

To comply with the law (legal obligation): responding to lawful requests from authorities and retaining records we are required to keep.

6. AI Processing of Your Conversations

Agent responses are generated by a third-party large language model (Anthropic Claude). The content of your messages, the relevant conversation context and the results of connected tools are transmitted to the model provider solely to generate the response you requested.

Neither we nor our model provider use your conversation content to train AI models. Your conversations are never sold and are not used for advertising.

Do not send agents special categories of data (for example health data) or data you are not allowed to share: the agents are general-purpose automation tools and are not designed for such content.

7. Sharing and Disclosure

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

We share data with the service providers (processors) that operate the Service on our behalf: Supabase (database and authentication); Stripe and PayPal (payments, billing and refunds); Resend (transactional email delivery); Anthropic (AI model inference); Google (sign-in with Google and, when you connect them, Gmail, Google Calendar, Google Sheets, Google Docs, Google Forms and Google Analytics); Microsoft (when you connect Microsoft 365 or Outlook: files, notes, email and calendar); the integration provider you choose to connect (for example Shopify, Slack, Notion, HubSpot or Mailchimp); and Vercel (hosting and aggregate web analytics).

These providers may access personal data only to deliver the service for us, under contract, and are required to protect it. A current list of our processors is available on request at privacy@agentcloud.agency.

We may also disclose data where required by law, to comply with a legal obligation, or to protect the rights, safety and security of AgentCloud, our users or the public.

If AgentCloud is involved in a merger, acquisition or sale of assets, data may be transferred to the successor entity; we will notify you and this policy will continue to apply to your data until it is updated.

8. Cookies and Similar Technologies

We use a small number of cookies, all of them necessary to operate the Service. Supabase authentication cookies keep you signed in. A preference cookie stores your language and another stores your light or dark theme, so the site opens with the right language and appearance. A short-lived cookie is set while you complete a waitlist or OAuth authorisation flow, to protect it against forgery.

Some information is stored locally in your browser rather than in a cookie — for example the contents of your shopping cart. You can clear it by emptying the cart or clearing your browser storage.

We use Vercel Analytics and Speed Insights to understand aggregate traffic and performance. They are privacy-friendly and do not use cookies to profile you across sites; we do not run advertising or cross-site tracking cookies. Because we only use technically necessary technologies and aggregate measurement, no consent banner is required for them; you can still block cookies in your browser settings, although parts of the Service (such as the login session) will then stop working.

9. International Data Transfers

Some of our providers are located outside the European Economic Area, in particular in the United States (for example Vercel, Supabase, Anthropic and Stripe). When personal data is transferred outside the EEA we rely on the European Commission's Standard Contractual Clauses and, where applicable, on the provider's EU-US Data Privacy Framework certification, together with technical measures such as encryption in transit and at rest.

10. How Long We Keep Data

Account and profile data: while your account is active, and up to 30 days after you delete it so that we can complete the deletion across backups.

Conversation history and usage records: for up to 12 months, or until you delete the conversation or your account, whichever comes first.

Invoice, billing and tax records: for 10 years, as required by Italian tax law, even after the subscription is cancelled.

Integration tokens: until you disconnect the integration or delete your account, and in any case removed on the provider side when you revoke access. Tokens are encrypted at rest.

Waitlist and contact requests: for up to 24 months from our last contact.

Security logs and rate-limiting counters: for a maximum of 12 months (counters are typically kept for hours to days).

11. Security

We protect your data with technical and organisational measures: TLS encryption in transit, AES-256-GCM encryption of third-party OAuth tokens at rest, database access rules (row level security) that scope data to the owning account, encrypted secrets managed only on the server, least-privilege access for our systems, and rate limiting against abuse.

No method of transmission or storage is 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify you and the competent supervisory authority without undue delay.

12. Your Rights

If you are in the European Economic Area (or another jurisdiction with equivalent rules) you have the right to: access your personal data and receive a copy; rectify inaccurate data; erase data when there is no overriding legal obligation to keep it; restrict or object to processing, including processing based on legitimate interest; receive the data you provided in a structured, machine-readable format (portability); withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to privacy@agentcloud.agency from the email address of your account. We reply within 30 days and never charge a fee for a reasonable request. You can also delete your account directly from your account settings.

If you believe your data is being processed unlawfully, you can lodge a complaint with the competent supervisory authority — in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it) — or with the authority of your habitual residence, place of work or place of the alleged infringement.

13. Automated Decisions and Children

We do not make decisions that produce legal or similarly significant effects on you through automated processing without human involvement, and we do not profile you for advertising purposes.

The Service is a business tool and is not directed at children. You must be at least 16 years old (or 14, the minimum age set by Italian law for consenting to information society services) to create an account. We do not knowingly collect data from children below that age; if you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to This Policy

We may update this policy to reflect changes to the Service, our providers, or the law. When we make material changes we will update the date at the top of this page and, where the change is significant, notify you by email or in the app before it takes effect. Continuing to use the Service after the update means you accept the revised policy.

15. Contact

Privacy requests, data subject rights and security reports: privacy@agentcloud.agency

Account and service support: support@agentcloud.agency