Privacy

01What we store

• Your account: name, email, a password hash (never the password), and whether two-factor sign-in is on.
• Your organization: its name, time zone, the answers you gave when you set it up, members and their roles.
• Agents, groups, limits, policies, budget requests and decisions, and the audit log of every change.
• For each model call: agent, provider, model, token counts, cost, status and the task tag your agent sent. Not the prompt and not the model's answer.
• Provider keys, encrypted. Only the last four characters are ever shown.
• If you connect a usage key: the provider's usage report as numbers per day and model (tokens, requests, cost). Not prompts or answers; providers' reports do not contain them.
• Sign-in sessions with the browser and network address they came from, so you can see and end them.
• Where your organization signed up from, if the link said so: the campaign tags in the link (utm_source and similar) and the site that linked to us. We use it, with the dates of setup steps, to count how many new organizations get to their first call; never your keys, prompts or amounts.

02What we do not store

• Prompts, model responses, files or anything else your agents send to a provider. They pass through and are not written down. When a provider refuses a call, we keep its error type and the first 200 characters of its message, which can quote a part of the request.
• Payment cards or bank details. Paid plans are paid through Paddle, which handles the card itself; we only see the plan, its status and Paddle's customer and subscription ids.

03Who else sees it

• Your model providers receive your agents' calls, as they would without us, under your own agreement with them.
• Our hosting provider (Render) runs the service and its database.
• If email is on, an email delivery service sends invitations, approval requests and password resets.
• If your organization buys a paid plan, Paddle (our reseller) receives the buyer's name, email, address and payment details to take the payment, charge tax and issue invoices, under its own privacy notice.
• If the AI recommendation for budget requests is on, the request's text and the budget figures are sent to Anthropic to draft it. It never decides anything.
• Nobody else. We do not sell data, show ads or use third-party analytics or tracking scripts.

04Cookies

One cookie, set when you sign in, to keep you signed in. It is first-party and HTTP-only, and lasts at most 12 hours. Before signup, the campaign tags of the link you arrived by are kept in this browser tab only (session storage) and sent once with the signup.

05How long we keep it

• As long as your organization uses the service. Spending records and the audit log are kept for as long as the organization exists, because finance and audit rely on them.
• An Owner can close the organization in Settings. Access ends at once and the accounts of people in no other organization are deleted then; everything else is deleted 30 days later, except payment event ids from Paddle. Copies in backups disappear as those backups expire.