Privacy policy

What we store

Your account: the email address and display name your sign-in provider returns, and an identifier for that provider account. If you sign in with Google or GitLab we never receive your password, and we do not ask you for one.

Your organization and its contents: the organization’s name, who its members are and what role each holds, and the projects, agents, deployments, and templates you create. A deployment record keeps the configuration that was deployed and the identifiers of the images it used, which is what lets you see what changed and re-send an earlier deploy.

Your usage and cost records: the model calls your agents report, their token counts, and the cost attributed to each agent, so the console can show you what an agent costs.

Your billing relationship: a customer and subscription identifier issued by Stripe, and your current plan. Card numbers are entered on Stripe’s own pages and never reach Agentify.

The credentials you paste, encrypted — set out in full in the next section.

The credentials you paste, and why we keep them

Three of the values you give Agentify are credentials to accounts that are not ours: your Hostinger account, your Discord application, and your model provider. We store all three encrypted, and we store them because the work you asked for continues after your browser has gone.

Each one is encrypted before it is written down, under a key belonging to your organization alone, which is itself wrapped by a key held in a managed key service rather than by Agentify. Your organization’s identity is bound into the encryption, so a ciphertext of yours that somehow landed among another organization’s records would fail to decrypt rather than be read. Once stored, a credential is never displayed again — the console shows a mask — and the deploy logs and container logs it reaches you through are masked too.

You can remove any of them. Removing your Hostinger connection deletes its stored token; deleting an agent deletes the credentials stored for that agent. Removal deletes our copy, and does not revoke the credential at Hostinger, Discord, or your model provider — do that there as well if the value has been exposed.

Your Hostinger API token

Why we store it. It is the only way Agentify can act on the VPS you chose. Deploying a bot, reading its container state and logs, re-sending an earlier deploy, and tearing it down all happen after you have closed the page, so the token has to outlive the request you pasted it in.Where it goes. Decrypted in memory for the duration of one Hostinger API call, and sent only to Hostinger, as the bearer token on that call.

Your Discord bot token

Why we store it. It is your bot’s identity on Discord. Agentify writes it into the container’s environment on every deploy, so a re-deploy, a rollback, or a restart after your VPS reboots needs the same value again — and Discord only shows it to you once.Where it goes. Decrypted when a deploy is assembled and sent only to your VPS, as an environment value of the container Agentify starts there. The bot presents it to Discord itself; Agentify does not connect to Discord on your behalf.

Your model API key

Why we store it. Your bot calls your model provider directly on your own account, with your own key, so the model spend stays yours. The key is needed on every deploy for the same reason the Discord token is.Where it goes. Decrypted when a deploy is assembled and sent only to your VPS, as an environment value of the container. Agentify does not call your model provider with it.

How we use it

To run the service you asked for: generate a deployment, send it to your VPS, report back what happened, show you status, logs, and cost, and keep enough history that you can roll back.

To operate and secure the platform: application and server logs, which record what was requested and whether it succeeded, so a failure can be diagnosed. Secret values are masked in them.

To bill you if you are on a paid plan, and to tell you about something that affects your account — a failed deploy, a billing problem, a change to this policy.

We do not sell your data and we do not use it to train models. We do run Google Analytics, to count page views and the steps of a flow so we can see where people get stuck. Every advertising signal is switched off, and the paths it receives are templated — `/:org/projects/:project` — so it is never told which organization, project, or agent you were looking at.

Who else sees it

Hostinger, for everything to do with the VPS you chose: Agentify calls the Hostinger API with your token, and your bot and its configuration live on your VPS under your Hostinger account.

Discord and your model provider, because that is where your bot works. Your bot connects to them directly from your VPS, under your own accounts and their own terms and privacy policies. What your bot says, and what your users say to it, passes between your VPS and those two services without passing through Agentify.

Stripe, for payments and for the billing portal. Amazon Web Services, where the Agentify console and its database run, and where encrypted backups are stored. Google, for the analytics described above — page paths with the identifiers removed, never your email address or anything you typed.

Otherwise: nobody, unless you ask us to, or unless we are legally required to and are permitted to tell you.

Cookies

Three functional ones. One holds your signed-in session. One remembers whether you chose the light or dark theme, and is absent until you choose. One remembers that you dismissed a site announcement, and holds that announcement’s identifier so a later one still reaches you.

Google Analytics sets its own cookies as well, to recognise a returning browser and to join the pages of one visit together. They are not advertising cookies — advertising storage and personalisation are denied — but they are analytics cookies. If you are somewhere that requires consent before they are set, that consent is not yet asked for here, and this page will say so until it is.

How long we keep it, and how to get rid of it

Your organization’s records last as long as your organization does. Deployment, usage, and cost history is kept so the console can show you a history; deleting an agent or a project deletes its records along with it.

To delete your account and your organization, write to legal@agentify.fyi from the address you signed in with. We delete the organization and everything stored under it, including every stored credential. Encrypted backups are kept for a short rolling window and age out on their own, so a deleted record can survive in a backup until that window passes.

Billing records are kept for as long as tax and accounting obligations require, even after an account is deleted.

Your choices

Ask us for a copy of what we hold about you, for a correction, or for deletion, at legal@agentify.fyi. Depending on where you live you may have these as legal rights; we answer the request either way.

Agentify is operated from, and stores its data in, Amazon Web Services infrastructure. If you use it from elsewhere, your data is processed there.

Contact

Questions about this policy, or about anything described on it: legal@agentify.fyi.