1. Introduction
This Privacy Policy explains how Agentkit ("we", "us", "our") collects, uses, and protects your personal information when you use our service. We are committed to protecting your privacy and handling your data transparently.
2. Information We Collect
Account Information
When you create an account, we collect your email address, display name, and authentication credentials. If you sign up via a third-party provider (such as Google), we receive your name and email from that provider.
Chatbot Content
We store the content you provide to train your chatbots, including:
- Website URLs and crawled page content
- Uploaded documents and files
- Chatbot configuration and settings
Conversations
We store conversations between your chatbots and their end users, including message content, timestamps, and any lead information voluntarily submitted by end users (such as name and email).
Usage and Analytics Data
We collect usage data to improve the Service, including:
- Chatbot interaction metrics (conversation counts, message volumes)
- Feature usage patterns
- Error logs for debugging and reliability
Technical Data
When you access the Service, we automatically collect:
- IP address
- Browser type and version
- Device information
- Pages visited and referral URLs
3. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Process your chatbot training data and generate AI responses
- Send transactional emails (account verification, password resets, notification digests)
- Send optional marketing and lifecycle emails (which you can unsubscribe from)
- Monitor and prevent abuse of the Service
- Comply with legal obligations
4. Third-Party Services
We use the following third-party services that may process your data:
- Supabase — Database hosting, authentication, and file storage
- OpenAI / Anthropic — AI model providers for chatbot responses and embeddings. Conversation messages are sent to these providers for processing. Please review their respective privacy policies.
- Stripe — Payment processing and billing (merchant of record). We do not store your payment card details. See Stripe's Privacy Policy.
- PostHog — Product analytics, error monitoring, and session replay
- Upstash (QStash) — Background task processing
- Resend — Transactional and marketing email delivery
5. Cookies
We use cookies and similar technologies as described below.
Essential Cookies (required for the Service to function):
- Authentication Session — maintains your logged-in state
- CSRF Protection — validates form submissions originate from our application
Preference Cookies (remember your choices):
- Theme Preference — stores your light/dark mode selection
- Language Preference — stores your preferred language
We do not use third-party tracking or analytics cookies. Most browsers let you control cookies through their settings. Blocking essential cookies will prevent you from using the Service.
6. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete your personal data, chatbot configurations, training data, and conversation logs within 30 days, except where retention is required by law or for legitimate business purposes (such as fraud prevention).
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you
- Correction — Request correction of inaccurate personal data
- Deletion — Request deletion of your personal data and account
- Export — Request a portable copy of your data
- Objection — Object to processing of your personal data for certain purposes
- Restriction — Request restriction of processing in certain circumstances
To exercise any of these rights, please contact us through our help page. We will respond to your request within 30 days.
GDPR (European Economic Area)
If you are in the EEA, our legal bases for processing your personal data include performance of a contract (providing the Service), legitimate interests (improving the Service, preventing abuse), and consent (marketing emails, optional analytics).
CCPA (California)
If you are a California resident, you have the right to know what personal information we collect, request deletion of your personal information, and opt out of the sale of personal information. We do not sell your personal information.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS) and at rest
- Secure authentication with hashed credentials
- Role-based access controls and row-level security policies
- Regular security reviews of our infrastructure
9. Children's Privacy
The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service.
11. Contact
If you have questions or concerns about this Privacy Policy or our data practices, please contact us through our help page.