Privacy Policy
PRIVACY POLICY
1. Data Collection and Usage
We collect only the data necessary to provide the Service. This includes: (a) Account Information: Email addresses and billing details for service access. (b) Agent Metadata: Public keys and agent configurations. (c) Vault Data: Encrypted credentials stored using multi-layer envelope encryption. (d) Usage Logs: Timestamps and sanitized action summaries for the audit trail.
2. Biometric Authentication
The Mobile App supports biometric verification (e.g., FaceID, TouchID). You acknowledge that AgentLock does not collect, store, or transmit your biometric templates. Verification is performed locally by your device’s operating system. We only receive a success/failure confirmation to authorize the approval action.
3. Data Security and Encryption
We implement industry-standard security measures: (a) All credentials are encrypted at rest using a Master Key and per-workspace Content Keys. (b) Automatic Redaction: Sensitive terms like “api_key” or “secret” are automatically replaced with [REDACTED] in our logs and timeline. (c) Database Protection: We use database-level access policies to ensure that users can only access data belonging to their own workspace.
4. Data Sharing and Subprocessors
We do not sell your personal data. We share data only with trusted subprocessors necessary for service delivery, such as database providers (Supabase), cloud infrastructure hosts, analytics/advertising providers (Google LLC) and PostHog for product analytics and session recording. PostHog runs on its EU Cloud in Frankfurt, Germany; because PostHog Inc. is a U.S. company whose staff may access this data for support purposes, we rely on Standard Contractual Clauses for this provider. All transfers outside the EEA are protected by Standard Contractual Clauses or the EU-US Data Privacy Framework.
Sentry: Crash and error reports for the mobile app, and error reports from the servers behind agentlock.net. When the app crashes or runs into an error we receive the technical report, that is the stack trace, the app version, the device model and the operating system, together with your user ID if you are signed in. Command text, approval replies, policy patterns, workspace and agent names are never transmitted, and screenshots are switched off. Sentry stores this data in its European region (Frankfurt, Germany); because Functional Software, Inc. (USA) operates the service and its staff may access the data for support purposes, we rely on the European Commission’s standard contractual clauses for this provider. When a request to our servers fails, Sentry receives the technical report as well: the stack trace and the route that failed, without IP address, without cookies and without the content of the request. The privacy switch in the app’s settings turns the app’s crash reports off together with analytics; the reports from our servers are part of running the service and are not tied to that switch.
5. Data Retention and Deletion
We retain account data as long as your account is active. Timeline logs are kept for a period sufficient to support the UndoLayer functionality (depends on the subscription and settings). Upon request for account deletion, we will scrub all encrypted secrets and personal identifiers within thirty (30) days, except where retention is required by law.
6. User Rights
You have the right to access, rectify, or erase your personal data. You may also object to certain processing activities or request data portability. To exercise these rights, please contact our support team.
7. Cookies and Tracking
We use the following categories of cookies:
a) Essential Cookies: These cookies are strictly necessary for the operation of the Service, including session management and security. They do not require consent.
b) Analytics Cookies: With your consent, we use Google Analytics and PostHog to understand how visitors and customers interact with our website and dashboard. Google Analytics collects anonymized usage data such as pages visited and session duration. PostHog additionally records clicks and other interactions with our interface, aggregated heatmaps, browser error reports, performance measurements and session recordings that replay how a page was used — including the content shown on your screen and text you type into forms; password fields are always masked and are never recorded. If you are signed in, these events are linked to your user ID. We run PostHog on its EU Cloud, so the data is stored on servers in the European Union (Frankfurt, Germany), and requests are routed through our own domain, so your browser does not contact PostHog directly.
c) Advertising Cookies: With your consent, we use Google Ads cookies to measure the effectiveness of our advertising campaigns and to deliver relevant advertisements.
We have implemented Google Consent Mode V2, which ensures that non-essential cookies are only set after you have given your explicit consent through our cookie banner. You can manage your cookie preferences at any time via the cookie icon on our website. You may withdraw your consent at any time.
8. Changes to this Policy
We may update this policy periodically. Users have to read this Policy periodically to ensure their acceptance. If you use this service you agree to this policy.
9. Contact
If you need assistance or have any questions, please contact our support team. Further details can be found on the legal notice page.
10. Web Analytics
We use Cloudflare Web Analytics, a privacy-first, cookieless measurement service, to understand aggregate site usage (page views, referrers, country, device and browser type, page performance). It sets no cookies, stores no IP addresses and does not track you across websites; the metrics are anonymous and cannot be linked to individual visitors. Cloudflare, Inc. processes this data on our behalf.