AgilityOS / Privacy Policy

Privacy Policy

Last updated: September 30, 2026

This policy applies to all users of the AgilityOS platform and related services provided by Agility Automations, Inc..

1. Introduction

Agility Automations, Inc. ("Agility OS," "we," "us," or "our") operates the Agility OS platform and related services accessible at agilityos.co (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

Account registration data: name, email address, password, company name, job title, and billing information.
Profile and configuration data: preferences, AI agent settings, custom instructions, and uploaded files.
Communications: messages, support tickets, feedback, and any other content you submit to us.
Payment information: processed by our payment processor (Stripe); we do not store full card numbers.

2.2 Information Collected Automatically

Log data: IP address, browser type and version, operating system, referring URL, pages viewed, and timestamps.
Device identifiers: hardware model, unique device IDs, and mobile network information.
Usage data: features used, clicks, navigation paths, session duration, and error reports.
Cookies and similar technologies: session tokens, preference cookies, and analytics identifiers (see Section 7).

2.3 AI Agent and Conversation Data

When you interact with AI agents powered by the Service, conversation transcripts, inputs, outputs, voice recordings (if applicable), and associated metadata are collected and processed. This data is used to provide the Service, improve model accuracy, and generate analytics.

2.4 Third-Party Sources

We may receive information about you from third-party integrations you authorize (e.g., Google Calendar, CRM platforms), social login providers, and marketing partners, consistent with their privacy policies.

2.5 User-Generated Content

Content you create, upload, or share via the Service — including documents, images, scripts, prompts, and agent configurations — is stored and processed to provide the Service. You are solely responsible for the content you submit.

2.6 Facebook, Instagram, and Meta Ads Data

If you choose to connect a Meta account, we receive and store only the Platform Data needed for the features you authorize.

For Facebook Page and Instagram Professional publishing, this may include your Meta user identifier; authorized Page and Instagram account identifiers, names, usernames, profile images, Page tasks, granted permissions and token expiration; encrypted access tokens; and identifiers, outcomes and public links for posts published through Agility OS.

For the optional Meta Ads capability, this may include your authorized ad-account identifiers, names, status, currency and timezone; campaign identifiers, names, objectives, status and timestamps; and aggregate reporting metrics such as impressions, reach, clicks, spend, cost and action totals. Agility does not request private messages, contacts, personal-profile publishing, lead data, catalogs, or WhatsApp or Threads data for these features.

We use Meta Platform Data only to authenticate the connection, display authorized destinations and accounts, publish content you approve, provide the reporting you request, and perform the campaign operations you authorize. Human approval is required for campaign changes by default, and new campaigns begin paused. We do not sell Meta Platform Data, use it to build advertising profiles, or use it to train AI models.

4. How We Use Your Information

We use personal information to:

Provide, operate, maintain, and improve the Service.
Create and manage your account and process transactions.
Respond to inquiries, provide support, and send operational communications.
Personalize your experience and deliver AI-generated content relevant to your use case.
Send marketing communications (where you have opted in or where permitted by law).
Monitor for suspicious activity, enforce our Terms of Service, and prevent fraud.
Comply with legal obligations and respond to lawful requests from authorities.
Conduct analytics and research to understand how users interact with the Service.
Improve our own systems using de-identified or aggregated data. Meta Platform Data is excluded from model training, even if aggregated, unless Meta's terms expressly permit that use and you provide separate, informed consent.

5. How We Share Your Information

5.1 Service Providers

We use vetted service providers to operate the Service. A provider receives only the categories reasonably necessary for its function, and not every provider receives every category of data.

Anthropic – Claude AI inference. Meta-derived tool inputs or results are sent only when a user invokes a Claude-backed agent or connected Claude workflow that needs them.
OpenAI – GPT model inference and agent execution. Meta-derived tool inputs or results are sent only when a user invokes an OpenAI-backed agent that needs them. Agility's tool boundary does not send Meta access tokens or app secrets to the model.
Fly.io – Optional agent compute infrastructure. It may process Meta-derived tool inputs or results only when a workspace selects a Fly-hosted agent runtime.
Neon – PostgreSQL database hosting for workspace data, encrypted integration credentials, authorized account metadata, audit records and deletion receipts.
Vercel – Application hosting, serverless API execution, content delivery and operational logs for the Agility web service and Meta integration endpoints.
Sentry – Conditional error and performance monitoring when enabled in the production environment. Agility disables automatic user-PII collection, session replay and sensitive request-payload capture and filters credentials and sensitive query parameters before diagnostic events leave the application.
ElevenLabs – Voice synthesis and voice-agent services when selected.
Resend – Transactional email delivery.
Stripe – Payment processing.

For Meta Platform Data specifically, the ordinary path is Vercel for application/API processing and Neon for encrypted storage. OpenAI or Anthropic receives only the Meta-derived inputs and results required for an agent request; Fly.io receives them only for a selected Fly-hosted runtime; and Sentry receives only minimized diagnostics if monitoring is enabled. We do not send Meta access tokens, app secrets or refresh credentials to AI models, marketplace publishers or other workspaces.

Meta Platforms is the connected platform and source/destination for Facebook Page, Instagram Professional and Meta Ads API data, not an Agility subprocessor. Meta processes data under its own terms and privacy commitments. A user-directed external ChatGPT, Claude, or compatible MCP client may also receive the specific result the user requests. Such a client is a user-authorized recipient and may act as an independent controller under its own terms rather than as Agility's processor.

We require service providers acting on our behalf to protect data and use it only to provide their contracted services.

5.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

5.3 Legal Requirements

We may disclose information when required by applicable law, a valid court order, or a governmental authority with lawful jurisdiction, or when necessary to protect rights, prevent fraud, or address an emergency involving safety.

Before responding to a public-authority request, our designated Privacy Team verifies the requester's identity and authority, reviews the request's legal basis and scope, and obtains appropriate legal review when needed. We challenge or seek clarification of requests that appear unlawful, overbroad, vague, or outside the requesting authority's jurisdiction. We disclose only the minimum information legally required, use secure delivery methods, and document the request, the review performed, the decision, the information disclosed, and the people involved. We notify the affected customer before disclosure unless prohibited by law or where notice would create a documented risk of harm. Emergency disclosures receive retrospective review and documentation.

5.4 With Your Consent

We may share your information with third parties when you have given explicit consent to do so.

5.5 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Specifically:

Account data: Retained for the duration of your account and up to 90 days after account deletion.
Conversation and AI interaction data: Retained for up to 12 months unless you request earlier deletion.
Connected Meta credentials and account metadata: Retained while the connection is active. Disconnecting the integration, removing Agility OS from Meta, or submitting a valid Meta data-deletion request removes associated access tokens and connected-account records.
Meta publishing and advertising audit records: Post and campaign identifiers, destination names, requested actions, outcomes, aggregate reporting results, and public links may be retained with your workspace until account deletion so you can audit agent activity. These records do not contain your Meta password, app secret, private messages, or raw access tokens.
Meta deletion receipts: We retain a minimal receipt containing a random confirmation code, timestamp, request type, and deletion counts for compliance and status verification. The receipt uses a one-way keyed representation instead of retaining the requesting Meta user identifier and never contains an access token.
Billing records: Retained for 7 years to meet financial reporting obligations.
Log data: Retained for up to 12 months for security and debugging purposes.
Backup copies: May be retained for up to 30 additional days after deletion from production systems.

You may request deletion of your personal data at any time by contacting support@agilityautomations.com. We will action deletion requests within 30 days, subject to legal retention obligations.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

Strictly necessary: Session and authentication cookies required for the Service to function. These cannot be disabled.
Analytics: Aggregate usage analytics to understand feature adoption (e.g., internal analytics). These are set only with your consent where required by law.
Preferences: Remember your settings and configurations.

We do not use advertising or cross-site tracking cookies.

7.2 Managing Cookies

You may manage or disable cookies through your browser settings. Disabling strictly necessary cookies may impair your ability to use the Service. Where required by law, we obtain your consent before placing non-essential cookies.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

TLS 1.2+ encryption for all data in transit.
AES-256-GCM encryption for sensitive credentials and API keys at rest.
Role-based access controls limiting employee access to personal data.
Regular security assessments and vulnerability scanning.
Incident response procedures for data breach notification.

Despite our safeguards, no transmission over the internet or electronic storage is 100% secure. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

9. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the U.S., your information may be transferred to and processed in the U.S. or other countries where our service providers operate.

For transfers of personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. You may request a copy of applicable transfer safeguards by contacting us.

10. Your Rights and Choices

10.1 All Users

Regardless of your location, you may:

Access and update your account information through your account settings.
Opt out of marketing emails by clicking "unsubscribe" in any marketing email.
Request deletion of your account and associated data.

10.2 EEA, UK, and Swiss Residents (GDPR)

You have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten"), subject to legal exceptions.
Restrict or object to certain processing activities.
Data portability: receive your data in a structured, machine-readable format.
Withdraw consent at any time where processing is based on consent.
Lodge a complaint with your local data protection authority.

To exercise these rights, contact support@agilityautomations.com. We will respond within 30 days (or within any shorter period required by applicable law).

10.3 California Residents (CCPA / CPRA)

California residents have the right to:

Know what personal information we collect, use, disclose, and sell.
Delete personal information we have collected (subject to exceptions).
Opt out of the sale or sharing of personal information (we do not sell personal data).
Non-discrimination for exercising your privacy rights.
Correct inaccurate personal information.
Limit use and disclosure of sensitive personal information.

To submit a verifiable consumer request, contact support@agilityautomations.com or call us at the number listed on our Contact page. We will respond within 45 days.

10.4 Other State Residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with applicable privacy laws may have similar rights under their respective laws. Contact us at support@agilityautomations.com to exercise any applicable rights.

11. Children's Privacy

The Service is not directed to individuals under the age of 16 (or 18 in jurisdictions where the minimum age is 18). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information without parental consent, please contact us at support@agilityautomations.com. We will take steps to remove that information and terminate the child's account promptly.

12. Third-Party Links and Integrations

The Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

13. Automated Decision-Making

The Service uses automated processing to generate AI-driven recommendations and insights. These outputs are informational and are not used to make legally significant automated decisions about you without human involvement. If you believe an automated process has negatively affected you, please contact us to request a human review.

14. Data You Process About Others (Contacts, Leads, and Call Participants)

When you upload contact lists, enroll people in calling or email campaigns, or otherwise use the Service to process personal data about individuals who are not your account users ("End Individuals" — for example, your leads, customers, or the people your agents call), you act as the data controller (or equivalent) for that data and Agility OS acts as your processor / service provider, handling it only to provide the Service on your instructions.

You are responsible for having a lawful basis and any required notice or consent to collect, upload, and process End Individuals' data, including for calling, recording, and messaging them (see the Automated Outreach section of our Terms of Service).
Call recordings, transcripts, and outcomes generated through the Service are processed to provide the Service to you and are made available in your workspace. You are responsible for how you use them and for honoring any access, correction, deletion, or opt-out request an End Individual directs to you.
We will assist you, to the extent reasonably practicable, in responding to End Individuals' rights requests, and will delete or return this data on termination in accordance with Section 6.
We do not use End Individuals' personal data for our own independent purposes and do not sell it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated policy on this page with a revised "Last updated" date.
Sending an email notification to the address associated with your account.
Displaying a prominent notice within the Service.

Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised policy.

16. Contact Us

For privacy-related questions, requests, or complaints:

Agility Automations, Inc.

Attn: Privacy Team

Email: support@agilityautomations.com

Website: agilityos.co/contact

For EEA/UK users: If we do not resolve your complaint, you may lodge a complaint with your local supervisory authority (e.g., the UK ICO or relevant EU data protection authority).