Privacy policy

We collect personal data in four categories:

Account data — your email, plan, billing information (handled by our payment processor), and account preferences. We need this to provide the Services.

Usage data — logs of which features you use, how often, performance metrics, and errors. We use this to operate, debug, and improve the Services.

Content data — the prompts, scraped data, drafts, application code, generated media, and other content you create or upload while using the Services.

Tool-call data — when your agent runs a paid tool through us, we record which tool ran, when, what it cost, and whether it succeeded, so we can meter your balance and show you your own call log. The inputs you send to a tool are passed to that tool's provider to fulfil the call.

We rely on the following GDPR lawful bases:

• Contract (Art. 6(1)(b)) — to deliver the Services you've signed up for.
• Legitimate interests (Art. 6(1)(f)) — to secure the Services, prevent abuse, debug, and improve. We balance this against your rights and will tell you if our balance changes.
• Consent (Art. 6(1)(a)) — for non-essential cookies, certain marketing emails, and any processing that requires explicit consent.
• Legal obligation (Art. 6(1)(c)) — to retain records required by tax, accounting, or other applicable law.

• Provide, operate, and maintain the Services;
• Process payments and manage your subscription;
• Communicate with you about your account, security, and product changes;
• Meter what your agent spends, and enforce the caps you set;
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Comply with legal obligations and respond to lawful requests;
• Improve the Services through aggregate, anonymised analytics.

We do not use your content to train AI models — ours or any third party's. Your prompts, leads, drafts, and generated assets stay yours.

We share personal data only with third parties acting as our processors, and only as needed to deliver the Services:

• Hosting — Hetzner Cloud (Frankfurt, Germany);
• CDN and edge — Cloudflare (with EU data localisation where supported);
• Payment processing — Stripe, for subscriptions;
• AI model providers — for AI generations, your prompts and the necessary context are sent to the model provider you've selected;
• Tool providers — when your agent runs a paid tool, the inputs for that call go to the provider behind it (a search, scraping, company-data, social-data or media-generation vendor). Which providers exist is public: each one is named on its tool in the catalog, so you can see who would receive a call before you make it;
• Content screening — free text you write is classified by a small model before a paid call runs, so that use of our shared vendor accounts stays within those vendors' terms;
• Code execution — E2B, which provides the isolated sandbox an agent works in when a task needs to run code;
• Email infrastructure — Resend, for account email and for sending outreach from your verified sender domains;
• Voice — Vapi, where you use AI calling.

A note on tool providers. We hold the vendor credentials, so a provider sees the call, not your identity with us — no account of yours is created there and no signup of yours is involved. What a provider does receive is the input the call needs, which is why the catalog names the provider on every tool before you run it.

Each processor is bound by a Data Processing Agreement and is permitted to use your data only for the purposes we specify. We never sell your personal data.

We may also disclose data when required by law, to respond to lawful requests by public authorities, or to protect our rights, the rights of our users, or public safety.

We keep personal data only as long as needed for the purposes described above. As a rule:

• Account data — for as long as your account is active, plus a short grace period after closure;
• Usage logs — typically 30 to 90 days, except where longer retention is required for security or legal reasons;
• Content data — until you delete it, or until your account closes;
• Billing records — as required by Dutch tax law (typically 7 years).

If you're in the EU/EEA, you have the right to:

• Access — request a copy of the data we hold about you;
• Rectification — ask us to correct inaccurate data;
• Erasure — ask us to delete your data (subject to legal retention obligations);
• Restriction — ask us to limit the processing of your data;
• Portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on our legitimate interests;
• Withdraw consent — where processing is based on consent, at any time without affecting prior processing;
• Lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

To exercise any of these rights, write to rick@agentmore.app. We'll respond within 30 days.

The Services are primarily hosted in the EU. Some third-party processors (e.g. certain AI model providers) may process data in the United States or other jurisdictions. Where transfers outside the EU/EEA take place, we rely on appropriate safeguards such as Standard Contractual Clauses or recognised adequacy decisions.

We apply reasonable technical and organisational measures to protect your data — encryption in transit (TLS), encryption at rest where appropriate, principle-of-least-privilege access controls, audit logging, and security review for every release. No system is perfectly secure; we don't promise a perfect outcome, but we work hard to earn your trust.

If a breach affecting your personal data occurs, we'll notify you and the relevant supervisory authority within the timeframes required by GDPR.

We use a small number of strictly-necessary cookies for authentication and preferences (such as your theme choice). We don't use third-party advertising cookies. If we later introduce analytics cookies, we'll ask for consent first.

The Services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we've collected data from a child, please contact us and we'll delete it.

The Services are built around AI agents. Your inputs are processed by AI models — ours, a provider you've selected, or the model behind an agent you connect — and an agent may act on your account through a scoped API key you create, running tools and spending from your balance until you revoke that key.

Two automated checks run before a paid tool call. We classify the free text you wrote, to keep the call within the tool provider's terms; and we price the call, refusing it outright if the worst case cannot be priced or would exceed a limit you set. Both are narrow, mechanical checks on a single call. Neither profiles you, and neither produces a decision with legal or similarly significant effects for you within the meaning of GDPR Article 22.

AI-drafted email is presented to you as a draft for review before anything is sent, so a human stays in the loop on every outbound message, in line with the EU AI Act and consumer-protection rules.

We may update this policy from time to time. If we make material changes, we'll notify you in advance by email or in-app notice. The "effective" date at the top of this page reflects the latest revision.

Questions about this policy or how we handle your data? Reach our privacy team at rick@agentmore.app.