We collect what we need to run Agentmaticafor you and nothing more. We don't sell your data, we don't use it to train public AI models, and we delete it when you ask us to.

• Account info: email, password hash, name (if provided).
• Connected sources: content from the tools you connect (docs, tickets, deals, messages). We index this content to answer questions.
• Usage: messages sent through the agent, actions taken, and how features are used.
• Site analytics: if you consent via the cookie banner, aggregate page-view and event data collected through Google Analytics. See our cookie policy for the full list of cookies set.
• Billing: handled by DodoPayments. We receive a customer ID and subscription status; we never see your full card number.

For your account, billing, and site analytics data, Agentmatica is the data controller. For content your agent indexes and for conversations, leads, and contact details your website visitors submit through the widget, you are the controller and Agentmatica is your data processor — we process that data only on your instructions, under our Data Processing Agreement. If you are a visitor chatting with an agent on someone else's website, the privacy policy of that website governs; direct requests about your chat data to the site owner, and we'll assist them.

Where the GDPR applies, we rely on:

• Contract (Art. 6(1)(b)) — account data, indexed content, conversations, and billing needed to provide the Service.
• Consent (Art. 6(1)(a)) — analytics cookies and any optional marketing communications. You can withdraw consent at any time from the cookie preferences panel.
• Legitimate interests (Art. 6(1)(f)) — abuse prevention, rate limiting (IP addresses are used transiently and not stored), service security, and transactional service emails.
• Legal obligation (Art. 6(1)(c)) — tax and billing records we must retain.

To:

• Operate the Service (answer questions, run actions)
• Improve your specific workspace based on your feedback
• Send service emails (security alerts, billing notices)
• Detect abuse and protect users

We do not train public or shared AI models on your data. Your connected source content stays scoped to your workspace.

We use the following processors to run the Service. Each is bound by a data processing agreement.

• Supabase — authentication, database, file storage (EU & US regions)
• Anthropic, OpenAI, Google — AI model inference (zero-retention APIs)
• DodoPayments — payment processing and merchant of record
• Resend — transactional email
• Upstash — caching and rate limiting
• Google Analytics (Google LLC) — site usage analytics, only loaded after you accept analytics cookies. IP addresses are anonymized and advertising features are disabled.

Primary storage is in the United States via Supabase. Where personal data of EU/UK residents is transferred outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our subprocessors, plus each provider's own safeguards. EU / APAC data residency is evaluated case-by-case for Enterprise. Our Data Processing Agreement covers this in detail.

If you are in the EU/EEA, UK, or a region with similar laws, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data (you can edit your name and account details in Settings);
• Eraseyour data (“right to be forgotten”) — request deletion from Settings or by email;
• Port your data — conversations and leads can be exported as CSV from your dashboard at any time;
• Restrict or object to certain processing;
• Withdraw consent at any time (e.g., analytics cookies via the cookie preferences panel), without affecting prior processing;
• Complainto your local supervisory authority. We'd appreciate the chance to resolve it first, but you're not required to contact us before them.

Email privacy@agentmatica.com from your account address and we'll respond within 30 days. We don't discriminate against you for exercising any of these rights.

We keep your data while your account is active. When you delete your account, we remove personal data within 30 days, except where retention is required by law (e.g., billing records).

Data is encrypted in transit (TLS) and at rest by our infrastructure providers (Supabase / Postgres). We're working toward SOC 2 Type II — currently aligning our internal controls and processes, not yet certified. Report security issues to security@agentmatica.com.

We use a small number of essential cookies for authentication and session management — these are always on. If you accept the cookie banner, we also set analytics cookies through Google Analytics to measure aggregate site usage. We do not run advertising trackers, retargeting pixels, or sell data to advertisers.

You can change your choice at any time on our cookie policy page.

We'll notify you of material changes by email or in-product notification at least 30 days before they take effect.

For privacy questions, email privacy@agentmatica.com. For data deletion requests, email privacy@agentmatica.com from the address on your account.