1. Who we are
AgentX is run by AgentX ApS (CVR 44710641). Address: Åbogade 15, Aarhus N, Denmark. Websites: agentxhq.com and myserverguy.net.
We are the data controller for the personal data described in this policy. Privacy contact: [CONFIRM: privacy contact email].
2. The short version
AgentX is a cloud console and billing service for AI agents that run on your own machines. You install the AgentX daemon on your own Linux, macOS or Windows computers. Your agents use your own AI subscriptions or model keys (or local models such as Ollama).
- Your work stays on your machine. Agents, sessions, messages and artifacts are stored in a local database on the machine that runs the daemon. They are not stored on our servers.
- We are not on the model path. We never proxy, see or bill your AI model traffic, and we never receive your model API keys.
- What we do hold: your account (email, name, password hash), team membership, billing status, a registry of which daemons and agents exist, and counts of messages for your quota.
3. What stays on your machine — and when it leaves
| Data | Where it lives | What reaches AgentX, and when |
|---|---|---|
| Agents, sessions, messages, artifacts (your work) | Local database on your machine | Nothing at rest. While your console is open, terminal output is streamed live and transcripts/artifacts are relayed on request through our edge. This content is held only in memory for that stream or request and is not saved. |
| Messages between agents on different machines | Your machines | Relayed through our Bridge only when agents on separate machines coordinate. Not stored by us. |
| Messages addressed to a human team member | Your machines | If an agent or teammate sends a message to a person on your team, we can deliver it to that person by email (the email contains the message text and a link to the console). We keep only a message ID and timestamp for quota counting, not the text. |
| AI model API keys and subscriptions | Your machine / environment | Never. |
| Usage counts | Our control plane (Core) | Periodically: a number of messages, never message content. |
4. What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: email address, display name (optionally given/family name), password (stored only as a hash), two-factor (TOTP) settings, email verification and password-reset tokens (stored hashed) | Create and secure your account, sign you in | Contract (6(1)(b)) |
| Team data: workspace (tenant), memberships and roles, invitations (invitee email and role), API tokens you create (name, hashed secret) | Run multi-user workspaces and seats | Contract (6(1)(b)) |
| Daemon and agent registry: daemon hostname, version, capabilities, the operating-system user names agents run as, the network address the daemon connected from, a public-key fingerprint, last-seen time; which agents and sessions exist and which daemon owns them | Connect your machines, route your console to the right daemon, show what is online | Contract (6(1)(b)); security (6(1)(f)) |
| Usage counts: number of messages per period | Meter your plan's message quota | Contract (6(1)(b)) |
| Billing: plan, subscription status, Stripe customer and subscription IDs, and an audit trail of billing events (e.g. checkout completed, plan changed) | Take payment, manage subscriptions, keep accounts | Contract (6(1)(b)); legal obligation — bookkeeping (6(1)(c)) |
| Governance audit log: who invited, removed or changed the role of whom; agent ownership changes | Security and accountability inside your workspace | Legitimate interest (6(1)(f)) |
| Sign-in session: a session cookie and a server-side session record | Keep you signed in | Contract (6(1)(b)) |
| Enquiries: name, work email, company, fleet size/use case and message you send through the "Talk to us" form | Answer your enquiry | Pre-contract steps / legitimate interest (6(1)(b)/(f)) |
| Bot protection on sign-up: Cloudflare Turnstile check (Cloudflare processes your IP address and browser signals) | Stop automated sign-ups | Legitimate interest (6(1)(f)) |
| Website analytics: page views via our self-hosted Plausible instance, which works without cookies [CONFIRM: item 4] | Understand which pages are used | Legitimate interest (6(1)(f)) |
| Support: what you write to us on Discord or by email | Help you | Legitimate interest / contract |
We do not sell personal data, and we do not use it for advertising.
Card details are entered directly with Stripe. We never see or store your card number. When you first buy a plan we create a Stripe customer that carries only your workspace ID as a reference; Stripe collects your email and payment details on its own checkout page.
5. Cookies
We only use cookies that the service needs, plus remembering your own settings. We do not use advertising or tracking cookies, so we do not show a cookie consent banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
_agentx_session | Keeps you signed in | 48 hours |
_csrf | Protects forms against cross-site request forgery | Up to 1 hour |
_agentx_contact_receipt | Shows the "thanks" confirmation after an enquiry | 10 minutes |
_wp_detail, _wp_created | One-time notices after an action in the console | Short-lived |
language, tz | Remember your language and time zone | 1 year |
agentx_theme, side_collapsed, side_pins | Remember your theme and sidebar layout | Until cleared [CONFIRM: lifetime] |
Cloudflare Turnstile on the sign-up page may set its own technical cookies or storage to complete the bot check.
6. Who processes data for us
| Processor | What for | Location |
|---|---|---|
| Stripe | Card payments, subscriptions, billing portal | [CONFIRM: item 9 — Stripe Payments Europe Ltd., Ireland; may transfer to the US] |
| Amazon Web Services (Amazon SES) | Sending email (account confirmation, password reset, invitations, member notices, messages to team members) | EU — region eu-west-1 (Ireland) |
| Amazon Web Services (Amazon S3) | Hosting public website media (e.g. the landing-page video). No personal data is stored there, but your browser connects to it. | EU — region eu-west-1 (Ireland) |
| Cloudflare (Turnstile) | Bot check on sign-up | [CONFIRM: Cloudflare entity and transfer basis] |
| Hosting of our servers | Runs Core, Bridge and web edge | [CONFIRM: item 2 — provider and country] |
| Discord | Community support, if you choose to use it. Discord is an independent service with its own privacy policy. | US |
Transfers outside the EU/EEA: where a provider transfers data outside the EU/EEA, we rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses [CONFIRM: item 9].
7. How long we keep data
[CONFIRM: item 5 — all periods below are placeholders the owner must set.]
- Account and team data: while your account is active, and [CONFIRM] after it is closed.
- Sign-in sessions: expire after 48 hours; database records kept [CONFIRM].
- Billing records: as required by the Danish Bookkeeping Act (Bogføringsloven) [CONFIRM: 5 years].
- Audit logs: [CONFIRM].
- Enquiries: [CONFIRM].
- Content relayed live through our edge: not stored; held in memory only for the stream or request.
8. Your rights
Under the GDPR you have the right to:
- see the data we hold about you (access),
- have wrong data corrected,
- have data deleted ("right to be forgotten"),
- restrict or object to processing based on legitimate interest,
- receive your data in a portable format,
- withdraw consent where processing is based on consent.
To use these rights, write to [CONFIRM: privacy contact email] [CONFIRM: item 7 — account deletion process]. We answer within one month.
Data stored by your daemon on your own machines is under your control; you can delete it there at any time.
If you are a member of a workspace someone else pays for, that workspace owner manages your membership and role. For business customers we may act as the customer's processor [CONFIRM: item 8 — DPA offering].
9. Complaints
You can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — www.datatilsynet.dk. We would appreciate the chance to sort it out with you first.
10. Changes
We may update this policy. If a change matters, we will tell account holders by email or in the console before it takes effect. The date at the top shows the current version.
11. Contact
AgentX ApS, Åbogade 15, Aarhus N, Denmark. CVR 44710641. Privacy: [CONFIRM: privacy contact email]. Support: Discord — https://discord.gg/C4aPUKmE2b