Privacy Policy

01Scope

This policy explains how AgentPlane handles personal data when you visit our website, use the console, or when your organization sends agent action data to the Service. For data your organization submits, your organization is the controller and we act as its processor.

02Data we process

Account data

• Name, work email, role and authentication identifiers for console users.

Agent action data

• Agent identifiers, the initiating principal, stated objective, action type, target resource, correlation identifiers and a hash of the payload.
• Payload contents only where your configuration requires them for approval or verification.

Usage and technical data

• Request identifiers, timestamps, IP addresses and error codes used to operate and secure the Service.

03How we use it

• To evaluate actions, show approvers what they are deciding, enforce decisions and keep the audit trail.
• To secure the Service, including rate limiting and detecting misuse.
• To provide support and tell you about changes to the Service.

We do not sell personal data, and we do not use customer action data to train machine learning models.

04Redaction and minimization

Fields that look like secrets, tokens, keys or card data are removed before an audit event is written. Email addresses are masked in audit data. Agent credentials are stored only as one-way hashes. Exports are redacted by default.

05Legal bases

Where data protection law requires a legal basis, we rely on performance of our contract with your organization, our legitimate interest in operating a secure service, and consent where we ask for it.

06Sharing

We share data with infrastructure and support subprocessors who are bound by written terms, and with authorities when the law requires it. A current list of subprocessors is available on request.

07International transfers

Where data moves across borders, we use recognized safeguards such as standard contractual clauses.

08Retention

Audit and decision records are kept for the retention period your workspace sets. Account data is kept while the account is active and deleted within ninety days after closure unless the law requires longer.

09Security

We isolate each tenant server-side, sign decision tokens, chain audit events with hashes so edits are detectable, and limit access to production systems. We describe our trust boundaries and known limits on the Security page. No system is perfectly secure, and we will notify affected customers of a personal data breach as the law requires.

10Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, or to object to processing. If your data was submitted by your employer through the Service, contact them first. Otherwise write to us and we will respond within the time the law allows.

11Cookies

The console uses a strictly necessary, HttpOnly session cookie. The marketing site does not use advertising or cross-site tracking cookies.

12Children

The Service is for businesses and is not directed at children.

13Changes

We will post updates here and notify customers of material changes in advance.

14Contact

Privacy questions and requests: privacy@agentplane.example.