Privacy policy

01Who we are

Secret Agents LLC is a Nevada limited liability company. Our address is:

For the personal information described in this policy, we are the controller under the EU and UK General Data Protection Regulation (“GDPR”), except for Customer Content, which the next section covers. You can reach us about anything in this policy at privacy@thesecretagents.ai.

02Our role with Customer Content

Businesses use the Service to run AI agents that work from their own knowledge and talk to their own customers. When we process Customer Content, we do it on the Customer’s behalf and on its instructions. The Customer is the controller (a “business” under US state privacy laws), and we are its processor (a “service provider”).

So this policy does not govern Customer Content. Our agreement with the Customer, including our data processing agreement, governs how we handle it, and the Customer’s own privacy policy explains what the Customer does with it.

If you talked to an agent run by a business and want to see, correct or delete what you shared, contact that business. If it asks us to, we will help it respond.

03Information we collect

Information you give us

• Account information. Your name, work email, company, role and sign-in credentials when you or your organization create an account.
• Business contact information. Your name, email, phone number, company and what you tell us when you contact us, ask for a demo, sign an agreement or meet us at an event.
• Billing information. Your billing contact and address. Card details go straight to our payment processor; we see only limited details such as the card type, last four digits and expiry date.
• Support and feedback. What you tell us when you ask for help or tell us what you think.

Information we collect automatically

• Service usage. What happens in your account: sign-ins, features used, agent settings, actions taken, errors and when each happened.
• Device and connection information. Your IP address, browser, device type and operating system, and the page that referred you, from the requests your browser makes to the Service.

Information from others

• Your organization. If your employer sets up your account, it may give us your name, email and role.
• Integrations. If you connect the Service to another system, such as a CRM, calendar or inbox, we receive the information you authorize that system to share.
• Payment providers. Our payment processor tells us whether a payment succeeded, and may flag suspected fraud.

On the website

The Site is a static website. It uses no cookies, analytics, advertising or tracking pixels, and it makes no requests to anyone else: even its fonts are served from our own address. Amazon Web Services hosts the Site and processes your IP address and request details to deliver the pages and protect the Site from abuse. If we ever add analytics or cookies to the Site, we will update this policy before we do.

04How we use information

• To provide the Service: to create and manage accounts, run agents, take payment and give support.
• To keep it secure: to authenticate users, prevent fraud and abuse, and detect and investigate security incidents.
• To improve it: to understand how features are used, diagnose problems and build new features.
• To communicate with you: service announcements, security notices, invoices and replies to your messages, and, where the law allows, news about our products. Every marketing email has an unsubscribe link.
• To meet legal obligations: for tax and accounting, to respond to lawful requests, to enforce our agreements and to establish or defend legal claims.

We do not make decisions about you, based solely on automated processing, that have legal or similarly significant effects on you.

Our legal bases (EEA, UK and Switzerland)

• Contract: to provide the Service that you or your organization signed up for, and to take the steps you ask for before signing.
• Legitimate interests: to run, secure, improve and market the Service to businesses, and to keep in touch with business contacts, where your rights do not outweigh those interests. You can object at any time.
• Consent: where we ask for it, for example for some marketing. You can withdraw it at any time.
• Legal obligation: where the law requires us to keep or disclose information.

05AI and your content

Customer Content is what makes a Customer’s agents its own. We use it to run those agents: to ground their work in the Customer’s documents and data, to follow its processes and to talk to its End Users.

We do not use Customer Content to train AI models. The AI model providers we use process it only to provide the Service to us, under written contracts.

Some Customers use the Service in healthcare. We process protected health information (“PHI”) only for Customers that have signed a Business Associate Agreement with us, and only as that agreement allows. If you are subject to HIPAA, do not put PHI into the Service until that agreement is in place.

06How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows.

• Service providers. Companies that run parts of the Site and the Service for us: cloud hosting, AI models, payment processing, email and customer support. They may use the information only to provide their services to us, under contracts that require them to protect it. Ask us for the current list.
• Your organization. If your employer provides your account, its administrators can see and manage your account and what you create in it.
• At your direction. With the integrations you connect, and anyone else you ask us to share with.
• For legal reasons. When we believe in good faith that the law, a subpoena or a court order requires it, or that it is needed to protect the rights, property or safety of Secret Agents, our Customers or others.
• In a business transfer. If we are involved in a merger, acquisition, financing or sale of assets, the information may transfer with the business, and this policy will continue to protect it.
• With your consent. In any other case, only when you agree.

07International transfers

We are based in the United States. We and our service providers process information in the United States and other countries, whose data protection laws may differ from yours. When we transfer personal information out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum and the Swiss amendments where they apply, or another lawful transfer mechanism. Write to privacy@thesecretagents.ai for a copy.

08How long we keep it

We keep personal information only as long as we need it for the purposes in this policy. In practice:

• Account information: while the account is open, and for a limited time after it closes so that you can reopen it and we can resolve any disputes.
• Customer Content: as long as the Customer’s agreement says. When the agreement ends, we delete or return it as the agreement provides; copies in backups are overwritten on their normal cycle.
• Billing records: as long as tax and accounting laws require.
• Business contact and marketing information: until you ask us to stop, or it is no longer relevant.
• Security and service logs: for a short period, unless we need them to investigate an incident.

When we no longer need information, we delete it or make it anonymous.

09Security

We protect personal information with technical and organizational measures suited to the risk, such as encryption, access limited to the people who need it, and monitoring. No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the authorities as the law requires.

10Your rights and choices

Depending on where you live, you have rights over your personal information. However you use them, we will not treat you differently for doing so.

Everyone

• Update your account information in the Service’s settings, or ask us to.
• Stop marketing email with the unsubscribe link in any message. We will still send service and security messages.

EEA, UK and Switzerland

• Access your personal information and get a copy of it.
• Correct it if it is wrong, or complete it if it is incomplete.
• Have it erased.
• Restrict how we use it.
• Receive it in a portable format, or have it sent to someone else.
• Object to how we use it, including at any time to direct marketing.
• Withdraw consent, where we rely on it, without affecting what we did before.
• Complain to your data protection authority.

California and other US states

Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws can ask to know what personal information we hold about them and get a copy of it, to correct it and to delete it. They can also opt out of its sale, of its use for targeted advertising, and of profiling that has legal or similarly significant effects. We do none of those things.

We collect these categories of personal information, from the sources and for the purposes described above:

• Identifiers: name, email address, phone number and IP address.
• Commercial information: purchase and billing records.
• Internet or other network activity: how you use the Service.
• Professional information: your company and role.
• Sensitive personal information: account sign-in credentials, used only to provide the Service and keep it secure, and never to infer anything about you.

We disclose each category for business purposes only to the service providers described in “How we share information”. Because we do not sell or share personal information, browser signals such as Global Privacy Control change nothing about how we treat yours, but we accept them as a valid opt-out.

Nevada

Nevada residents can ask us not to sell their covered information. We do not sell it, but you can still send that request to privacy@thesecretagents.ai.

How to make a request

Email privacy@thesecretagents.ai, from the address on your account if you have one. We will verify your identity before we act, which may mean asking you for more information. Someone you authorize can make a request for you with your signed permission; we may ask you to confirm it.

We will respond within the time the law allows: one month in the EEA and UK, and 45 days in California, which may be extended where the law permits. If we turn down your request, you can appeal by replying to our decision. If we turn down your appeal, you can contact your state attorney general.

If your request is about Customer Content, meaning information you gave an agent run by a business, we will refer you to that business, because it decides what happens to that information.

11Cookies

The Site uses no cookies or similar technologies. The Service uses only strictly necessary cookies: to sign you in, keep your session secure and remember your settings. We do not use advertising cookies. If we ever add analytics or other non-essential cookies, we will update this policy and ask for your consent where the law requires it.

12Children

The Site and the Service are for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13Changes to this policy

We will post any change to this policy on this page and update the effective date at the top. If a change is material, we will tell you before it takes effect, by email or in the Service. We will not apply a material change to information we have already collected without your consent where the law requires it.

14Contact us

For questions, requests or complaints about privacy, email privacy@thesecretagents.ai or write to us at:

If you are in the EEA, the UK or Switzerland and we have not resolved your concern, you can complain to your local data protection authority. In the UK, that is the Information Commissioner’s Office.