We collect what we need to run Agentmatica for you and nothing more. We don't sell your data, we don't use it to train public AI models, and we delete it when you ask us to.

• Account info: email, password hash, name (if provided).
• Connected sources: content from the tools you connect (docs, tickets, deals, messages). We index this content to answer questions.
• Usage: messages sent through the agent, actions taken, and how features are used.
• Site analytics: if you consent via the cookie banner, aggregate page-view and event data collected through Google Analytics. See our cookie policy for the full list of cookies set.
• Billing: handled by DodoPayments. We receive a customer ID and subscription status; we never see your full card number.
• Affiliate referrals: if you reach us through a link shared by one of our affiliates, we record which affiliate referred you, along with the IP address and browser details of that visit, so they can be paid commission if you subscribe. If you create an account we also pass your email address and account ID to our affiliate platform to link the signup to the referral. This only happens if you actually arrived through an affiliate link.

For your account, billing, and site analytics data, Agentmatica is the data controller. For content your agent indexes and for conversations, leads, and contact details your website visitors submit through the widget, you are the controller and Agentmatica is your data processor — we process that data only on your instructions, under our Data Processing Agreement. If you are a visitor chatting with an agent on someone else's website, the privacy policy of that website governs; direct requests about your chat data to the site owner, and we'll assist them.

Where the GDPR applies, we rely on:

• Contract (Art. 6(1)(b)) — account data, indexed content, conversations, and billing needed to provide the Service.
• Consent (Art. 6(1)(a)) — analytics cookies, and affiliate attribution for visitors in the EEA, the UK and Switzerland. Nothing is stored on your device for either purpose until you opt in, and you can withdraw consent at any time from the cookie preferences panel.
• Legitimate interests (Art. 6(1)(f)) — abuse prevention, rate limiting (IP addresses are used transiently and not stored), service security, transactional service emails, and paying our affiliates the commission they have earned. Outside the EEA, the UK and Switzerland, affiliate attribution starts on arrival and you can switch it off at any time from the cookie preferences panel.
• Legal obligation (Art. 6(1)(c)) — tax and billing records we must retain.

To:

• Operate the Service (answer questions, run actions)
• Improve your specific workspace based on your feedback
• Send service emails (security alerts, billing notices)
• Detect abuse and protect users

We do not train public or shared AI models on your data. Your connected source content stays scoped to your workspace.

We use the following processors to run the Service. Each is bound by a data processing agreement.

• Supabase — authentication, database, file storage (EU & US regions)
• Anthropic, OpenAI, Google — AI model inference (zero-retention APIs)
• DodoPayments — payment processing and merchant of record
• Resend — transactional email
• Upstash — caching and rate limiting
• Google Analytics (Google LLC) — site usage analytics, only loaded after you accept analytics cookies. IP addresses are anonymized and advertising features are disabled.
• Affonso — affiliate program management and referral attribution. Receives referral visit data, and the email address and account ID of anyone who signs up through an affiliate link.

Primary storage is in the United States via Supabase. Where personal data of EU/UK residents is transferred outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our subprocessors, plus each provider's own safeguards. EU / APAC data residency is evaluated case-by-case for Enterprise. Our Data Processing Agreement covers this in detail.

If you are in the EU/EEA, UK, or a region with similar laws, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data (you can edit your name and account details in Settings);
• Erase your data (“right to be forgotten”) — request deletion from Settings or by email;
• Port your data — conversations and leads can be exported as CSV from your dashboard at any time;
• Restrict or object to certain processing;
• Withdraw consent at any time (e.g., analytics cookies via the cookie preferences panel), without affecting prior processing;
• Complain to your local supervisory authority. We'd appreciate the chance to resolve it first, but you're not required to contact us before them.

Email hello@agentmatica.com from your account address and we'll respond within 30 days. We don't discriminate against you for exercising any of these rights.

We keep your data while your account is active. When you delete your account, we remove personal data within 30 days, except where retention is required by law (e.g., billing records).

Data is encrypted in transit (TLS) and at rest by our infrastructure providers (Supabase / Postgres). We're working toward SOC 2 Type II — currently aligning our internal controls and processes, not yet certified. Report security issues to hello@agentmatica.com.

We use a small number of essential cookies for authentication and session management — these are always on. If you accept the cookie banner, we also set analytics cookies through Google Analytics to measure aggregate site usage. If you arrived through an affiliate link we set affiliate cookies to credit the referral. We do not run advertising trackers, retargeting pixels, or sell data to advertisers.

Separately, when you open our site from a link tagged with a campaign name (for example from one of our social posts), our server adds one to a daily total for that campaign, and adds one to its sign-up total if you then create an account. This uses no cookies and stores nothing on your device, and the totals hold no IP address, device details, or anything else that could identify you or link a count to your account.

You can change your choice at any time on our cookie policy page.

We'll notify you of material changes by email or in-product notification at least 30 days before they take effect.

For privacy questions, email hello@agentmatica.com. For data deletion requests, email hello@agentmatica.com from the address on your account.