Privacy Policy
Last updated: February 27, 2026 | Effective: February 27, 2026
1. Introduction
AgentDeploy ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI agent marketplace and deployment platform (the "Service"). By accessing or using AgentDeploy, you agree to the terms of this Privacy Policy.
2. Information We Collect
We collect information that you provide directly to us, information collected automatically, and information from third parties.
2.1 Personal Information You Provide
Account Information
Fields: email, display_name, username, password_hash
Purpose: Account creation and authentication
Legal Basis: Contract performance | Required: Yes
Profile Information
Fields: avatar_url, banner_url, bio, twitter_handle, github_profile, website, location, timezone, response_time, specializations
Purpose: Public seller profile display
Legal Basis: Consent | Required: No | Visibility: Public for sellers
Payment Information
Fields: stripe_customer_id, billing_address, payment_method
Purpose: Transaction processing
Legal Basis: Contract performance | Required: Yes
Note: Processed by Stripe, not stored by AgentDeploy
KYC Information
Fields: government_id, identity_verification_status
Purpose: Seller verification and compliance
Legal Basis: Legal obligation | Required: Yes
Note: Processed by Stripe Identity, not stored by AgentDeploy
Communication Data
Fields: support_tickets, chat_messages, emails
Purpose: Customer support and dispute resolution
Legal Basis: Legitimate interest | Required: No
2.2 Information Collected Automatically
Usage Data
Fields: page_views, clicks, session_duration, features_used
Purpose: Analytics and service improvement
Legal Basis: Legitimate interest
Device Information
Fields: ip_address, browser_type, operating_system, device_id
Purpose: Security and fraud prevention
Legal Basis: Legitimate interest
Transaction Data
Fields: purchase_history, template_views, deployment_logs
Purpose: Service delivery and analytics
Legal Basis: Contract performance
2.3 Information from Third Parties
OAuth Providers (Google, GitHub)
Fields: email, name, avatar, email_verified_status
Purpose: Account creation and authentication
Legal Basis: Contract performance
Payment Processors (Stripe)
Fields: payment_status, customer_id
Purpose: Transaction processing
Legal Basis: Contract performance
Hosting Providers
Fields: deployment_status
Purpose: Deployment tracking
Legal Basis: Contract performance
3. How We Use Your Information
We use the information we collect for the following purposes:
- 1
Provide and maintain the Service
Data: Account Information, Profile Information | Legal Basis: Contract performance
- 2
Process transactions and send related information
Data: Payment Information, Transaction Data | Legal Basis: Contract performance
- 3
Send technical notices and support messages
Data: Account Information, Communication Data | Legal Basis: Contract performance
- 4
Respond to comments and questions
Data: Communication Data | Legal Basis: Legitimate interest
- 5
Detect and prevent fraud and abuse
Data: Device Information, Usage Data, Transaction Data | Legal Basis: Legitimate interest
- 6
Improve our Service and develop new features
Data: Usage Data, Transaction Data | Legal Basis: Legitimate interest
- 7
Comply with legal obligations
Data: KYC Information, Transaction Data | Legal Basis: Legal obligation
4. Data Sharing and Disclosure
We share your information with the following third parties to provide our Service:
GitHub
Purpose: Repository access and code transfer
Data Shared: GitHub username, repository access tokens
Location: United States (EU-US Data Privacy Framework certified)
Stripe
Purpose: Payment processing and KYC verification
Data Shared: Payment information, Identity verification data
Location: Ireland (EU)
Hosting Providers
Purpose: Agent deployment
Data Shared: Deployment credentials, Environment variables
Providers: Railway, Vultr, Render, Hostinger
Security Scanning Services
Purpose: Template security verification
Data Shared: Code bundles (anonymized)
Note: No credentials or secrets shared
Analytics Providers
Purpose: Usage analytics
Data Shared: Anonymized usage data
Opt-out available: Yes
Legal Authorities
Purpose: Legal compliance
Data Shared: As required by law
Note: Only when legally required
5. Data Security
We implement industry-standard security measures to protect your information:
Encryption at Rest
All credentials encrypted using AES-256
Scope: Database storage
Encryption in Transit
All data transmitted via TLS 1.3
Scope: All network communications
Access Control
Strict access controls and audit logging
Scope: Internal systems
Data Isolation
Seller code never exposed to other users
Scope: Marketplace infrastructure
No Credential Logging
We don't log API keys, passwords, or sensitive prompts
Scope: Application logs
Ephemeral Processing
Code deleted immediately after security scanning
Scope: Security scanning pipeline
6. Your GDPR Rights
Depending on your location, you may have the following rights:
Right of Access
Access your personal data
How to exercise: Email [email protected] with your request
Response time: 30 days | Fee: Free
Right to Rectification
Correct inaccurate data
How to exercise: Edit profile in Dashboard or email [email protected]
Response time: 30 days | Fee: Free
Right to Erasure
Delete your data (right to be forgotten)
How to exercise: Email [email protected] with your request
Response time: 30 days | Fee: Free
Exceptions: Transaction records retained for 7 years (legal requirement)
Right to Data Portability
Export your data
How to exercise: Email [email protected] to request a JSON export of your data
Response time: 30 days | Fee: Free
Right to Object
Opt-out of marketing communications
How to exercise: Unsubscribe link in emails or email [email protected]
Response time: Immediate | Fee: Free
Right to Restrict Processing
Limit how we use your data
How to exercise: Email [email protected]
Response time: 30 days | Fee: Free
Right to Withdraw Consent
Revoke OAuth permissions or GDPR consent
How to exercise: Dashboard ➡ Settings ➡ Connected Accounts or email [email protected]
Response time: Immediate | Fee: Free
7. Data Retention
We retain your personal information for as long as necessary to provide the Service, comply with legal obligations, and resolve disputes.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account Information | Until account deletion | Service provision |
| Transaction Records | 7 years | Tax compliance (Portuguese law) |
| Security Scan Reports | 1 year | Quality assurance, then archived |
| Deployment Logs | 90 days | Troubleshooting |
| Chat Messages | 2 years | Dispute resolution |
| Deleted Accounts | 30 days after deletion request | GDPR compliance |
8. International Data Transfers
AgentDeploy is based in Portugal. Your information may be transferred to and processed in countries other than your own.
Standard Contractual Clauses (SCCs)
EU-approved contracts for data transfers
Applies to: United States, Other non-EU countries
EU-US Data Privacy Framework
Certified providers for US transfers
Applies to: GitHub, Other US providers
GDPR Compliance
All processors comply with GDPR requirements
Applies to: All third-party processors
9. Children's Privacy
Our Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected such data, we will take steps to delete it.
Minimum Age Requirement
18 years
Verification Method
Terms of Service acceptance
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Material changes will be communicated via email 30 days before implementation.
Notification Method
Email + In-app notification
Notice Period
30 days for material changes
11. Contact Us
If you have any questions about this Privacy Policy, please contact us:
Data Protection Officer
[email protected]Address
Lisbon, Portugal
Supervisory Authority
Comissão Nacional de Proteção de Dados (CNPD) - Portugal
You have the right to lodge a complaint with your local data protection authority
Document ID: PRIVACY-001 | Next Review: February 27, 2027