Privacy Policy
DRAFT — under review, not yet in effect. This policy has not been finalized and does not yet govern the service.
We keep data collection minimal. This policy explains what we hold, who processes it for us, and how long we keep it.
What we collect
- Account data — your email address, and a password stored only as a cryptographic hash (or a linked identity-provider binding). We never store your password in plain text.
- Billing records — your credit balance and a ledger of purchases and usage deductions. Your card details are handled by Stripe; we never see or store your full card number.
- Box data — the contents of your boxes (code and files your agent writes) live on the box's disk while it exists.
- Your provider API key — the key you bring is injected into your box's environment so the agent can use it.
- Technical data — your IP address, used to rate-limit signups and sign-ins and prevent abuse, plus limited diagnostic error data.
How we use it
To run your account, provision and bill your boxes, keep the service secure and abuse-free, and contact you about your account (for example, email verification and password resets). We do not sell your personal data.
Who processes data for us
We rely on a small set of service providers, each handling only what its function needs:
| Processor | Purpose |
|---|---|
| Stripe | Payments and card data |
| Fly.io | Cloud hosting for your boxes |
| Postmark | Transactional email (verification, password reset) |
| Sentry | Error monitoring |
| Better Stack | Uptime monitoring and status page |
How long we keep it
- Account data — for the life of your account; deleted when you close it, except where we must keep records by law.
- Billing and purchase records — retained as long as needed for accounting and tax.
- Box contents — kept only while the box exists. When a box is destroyed its disk is erased, and we do not keep a separate backup of it.
Your choices
You can access, correct, or delete your account data, or ask us what we hold about you, by emailing us. We'll respond within a reasonable time. We are a small US-based operator and are not currently subject to the CCPA, but we'll honor reasonable privacy requests regardless of where you live.
Contact
For any privacy question or request, email support@openagent.example.