Privacy Policy

1. Who we are and when this applies

Agerra is operated by UTILHELP SOFTWARE & SOLUTIONS SRL, Romania. Contact us at andrei@asynnc.com for privacy requests, questions, and company identification details. This notice covers our website, account administration, billing, support, and our own use of the service.

For conversations, leads, documents, and other personal data processed for a workspace, the workspace customer determines the purposes and acts as controller; Agerra acts as processor under the Data Processing Agreement. If you interact with a customer’s agent, consult that customer’s privacy notice and contact them first. We assist them with requests.

2. Information we process

Account information includes name, email, profile image, password hash for email sign-in, and Google account identifiers and authentication tokens when Google sign-in is used. Workspace information includes membership, roles, invitations, settings, and integration credentials.

Service content includes prompts, messages, AI responses, conversation identifiers, uploaded files, extracted website content, questions and answers, source chunks and embeddings, agent configuration, leads and submitted contact fields, tool inputs and results, and WhatsApp identifiers and messages when enabled.

Billing data includes billing name, country, address, VAT identifier, Stripe customer and subscription identifiers, invoices, plan and credit usage. Stripe handles payment details through its payment interfaces.

Technical data can include IP addresses, device and browser information, timestamps, request and access logs, errors, and performance diagnostics. With analytics consent, Google Analytics measures usage and Microsoft Clarity provides interaction analytics, including session recordings. Avoid entering sensitive data into public forms or agents.

3. Purposes and legal bases

We process account and service administration data to perform our contract with you, or take requested steps before a contract (GDPR Article 6(1)(b)). Where an organization is the customer, administration of its representatives’ accounts is based on our legitimate interests in providing that organization’s service (Article 6(1)(f)).

Our legitimate interests also include preventing abuse, protecting accounts, diagnosing errors, maintaining the service, and handling business communications and legal claims. We balance those interests against individuals’ rights. Accounting, tax, and lawful disclosure obligations rely on Article 6(1)(c). Optional analytics relies on consent (Article 6(1)(a)); you can withdraw it through Cookie settings.

Customer content is processed on the customer’s documented instructions. The customer is responsible for its lawful basis and notices. Required account and billing information is necessary to provide the requested features; optional profile details and analytics consent are voluntary.

4. Recipients and AI processing

Relevant content is sent to the selected AI provider (OpenAI, Anthropic, or Google Gemini) to generate responses. OpenAI also processes source text and search queries to generate embeddings, even when a different chat model is selected. Relevant source excerpts, conversation history, prompts, and tool results may be included in requests.

DigitalOcean hosts the application on a private VPS; AWS S3 stores uploaded files and logos; Trigger.dev runs source-processing jobs; Firecrawl processes submitted website URLs and extracted content; Sentry receives error and performance diagnostics. Google supports optional sign-in. Stripe provides billing. See the provider register for purposes and official notices.

A workspace can connect WhatsApp, external APIs, webhooks, and tools, including Stripe and Instantly configurations. Data sent to those destinations depends on the workspace configuration. Customer-selected services operate under their own terms and privacy notices.

OpenAI API content is not used for general model training unless the account holder opts in. Its standard abuse logs may retain content for up to 30 days, with legal and safety exceptions. Zero Data Retention requires approval and configuration; it is not established for this integration. Provider retention is separate from Agerra database retention.

Anthropic’s commercial API excludes model training by default, subject to explicit opt-ins such as feedback or its Development Partner Program. Its standard API input/output retention is within 30 days, subject to contractual, policy-enforcement, and legal exceptions.

Google Gemini Paid Services do not use prompts and responses to improve Google products. The same data-use treatment applies under its terms to users in the EEA, Switzerland, and UK, including unpaid services. Other unpaid use can involve model improvement and human review. The applicable provider account and service terms must be checked.

These describe provider defaults, not verified account settings. Platform and customer-supplied API keys may have different account-level choices. Agerra does not offer an application setting that guarantees no training or zero provider retention across all providers. Official sources are linked below.

We may disclose information to authorized workspace members, advisers, authorities where law requires it, or parties to a corporate transaction subject to appropriate protections.

5. International processing

Providers may process data outside Romania and the EEA, including in the United States. A European endpoint alone does not establish that all processing remains in Europe. Where required, transfers must use an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where necessary. Contact us for information about the safeguards applicable to your processing.

The current integration uses the standard OpenAI API endpoint and does not configure an EU regional endpoint or an EEA-only processing restriction. EEA-only processing or access is therefore not assured. The exact countries, remote-access arrangements, and transfer mechanism for each recipient must be confirmed against the deployed infrastructure and applicable agreements; naming a safeguard in this policy does not establish that it has been executed.

6. Retention and security

Conversation storage: Agerra stores user messages and AI responses in its application database. Conversations have no scheduled expiry in the current application and remain until deleted. This behavior does not change with the selected AI provider. No automatic conversation deletion period or customer-configurable retention interval is currently provided. Cancelling a subscription alone does not delete content.

Manual deletion: authorized workspace owners, administrators, and the agent creator can delete conversations from the agent Activity view. Deleting a conversation also deletes its associated message records from the active application database. You may request assistance at andrei@asynnc.com. This action does not by itself erase separate logs, backups, lead records, webhook deliveries, or copies held by AI and integration providers; these require their applicable deletion processes.

Technical and security logs: the application does not set a fixed log retention period or provide customer-configurable log expiry. Duration depends on the deployed hosting, logging, monitoring, and backup settings. Older deployments logged message text, AI request context, and source excerpts. Direct content logging has been removed from the chat, retrieval, and WhatsApp paths in the current code; historical logs and other diagnostic systems may still contain personal data. Contact us for confirmed deployment-specific retention periods; do not assume logs are metadata-only or share the conversation deletion lifecycle.

Account and workspace records are retained while needed to provide the service; billing and dispute records may need to be kept after service ends. Backup retention, downstream deletion, and any legally required retention must be handled separately. Ask us for the arrangements applicable to your workspace before relying on a fixed deletion deadline.

We use authentication, workspace access controls, password hashing, and encryption for stored integration and provider API credentials. No service is completely secure. Do not assume all content is end-to-end encrypted: the service and selected providers need to process it to perform requested tasks.

7. Your rights and complaints

Where applicable, you may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Withdraw consent at any time without affecting earlier lawful processing. We may need proportionate identity verification; we ordinarily respond to GDPR requests within one month, with extensions only as permitted by law.

Contact andrei@asynnc.com. For customer-controlled content, identify the relevant workspace so we can route the request. You may complain to your local supervisory authority or Romania’s ANSPDCP at www.dataprotection.ro. We do not use account administration data to make solely automated decisions producing legal or similarly significant effects. Customer-configured AI workflows remain the customer’s responsibility.

8. Children and changes

Accounts are intended for adults authorized to enter a business agreement. Customers must assess any use involving children and provide legally required protections and notices. Contact us if children’s information was submitted improperly.

We update this notice when practices change, show the revision date, and provide additional notice of material changes where required.

Official AI provider data policies

• OpenAI API data controls
• Anthropic API retention
• Anthropic model training policy
• Google Gemini API terms