Skip to content

PRIVACY, GDPR & GOOGLE USER DATA PROTECTION

Privacy Policy

Effective date: November 2, 2026

AgenAI (“we”, “us”, or “our”) provides an AI co-founder workspace at https://agenai.io. This Privacy Policy describes how we collect, use, store, share, and protect personal data and connected third-party account data in compliance with the EU General Data Protection Regulation (GDPR), Swedish data protection law (Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning), and the Google API Services User Data Policy.

1. Data Controller & Contact Information

AgenAI is operated by Matteo Tadiello (sole founder), based in Sweden, who acts as the data controller for personal data processed in connection with your AgenAI account and workspace.

2. Data We Collect

  • Account & authentication data: Your name, email address, password hash (if using email/password sign-in), or OAuth subject identifier and verified email address when you sign in with Google (`openid`, `email`, `profile`) or GitHub.
  • Company workspace data: Company profiles, documents, tasks, CRM records, financial ledger entries, uploaded workspace files, and chat conversations created by you or authorized members of your workspace.
  • Connected third-party service data & credentials: When a workspace owner or administrator explicitly connects an external integration in Settings → Connections (such as Gmail, Google Ads, Resend, Stripe, WordPress, GitHub, Linear, Slack, HubSpot, or PostHog), we store encrypted credentials (`Fernet` AES-128-CBC with HMAC-SHA256) and access only the specific data required to execute authorized tasks:
    • Gmail (`https://www.googleapis.com/auth/gmail.readonly`, `https://www.googleapis.com/auth/gmail.send`): Mailbox address, incoming email thread headers/bodies when inbox synchronization is requested, and outgoing email messages when an administrator or authorized workflow sends an approved email or draft.
    • Google Ads (`https://www.googleapis.com/auth/adwords`): Customer account ID, currency, timezone, and search campaign settings created or inspected within your approved spending limits.
  • Billing & technical metadata: Subscription status, AI token usage and cost accounting, IP address, and security audit logs required to protect your account against unauthorized access.
  • Optional website analytics: If you accept analytics cookies, Google Analytics measures visits and interactions on our public pages, such as scrolls, link clicks, and form starts and submissions, using a cookie identifier and technical information about your browser. Tracking is off until you accept. Our integration excludes signed-in pages and authentication recovery links, does not add typed form values to events, and disables Google signals and advertising personalization. Use Cookie settings in the public-page footer to change your choice or withdraw consent. We remember that choice for six months; withdrawal removes our Analytics cookies and stops tracking in the current page.

3. How We Use Your Data & Legal Bases (GDPR Art. 6)

  • Providing the AgenAI workspace (GDPR Art. 6(1)(b) — Performance of a contract): Authenticating your session, maintaining your company documents and records, running AI tasks you request, and enforcing your configured spending ceilings and operating mandate.
  • Executing connected third-party actions (GDPR Art. 6(1)(a) — Explicit consent & Art. 6(1)(b)): Reading or sending emails via Gmail, managing Google Ads campaigns, or syncing records with connected tools strictly when you connect those accounts and authorize those capabilities in Settings.
  • Security, abuse prevention & auditability (GDPR Art. 6(1)(f) — Legitimate interests): Recording immutable workspace audit logs of external actions, verifying OAuth state and PKCE challenges, and preventing cross-site or unauthorized requests.
  • Billing & legal compliance (GDPR Art. 6(1)(c) — Legal obligation): Processing payments via Stripe and retaining invoice records as required under Swedish accounting and tax regulations (Bokföringslagen).

4. Google API Services User Data Policy & Limited Use Compliance

AgenAI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Limited to user-facing features: Google user data (including Gmail messages, headers, and sender addresses) is used exclusively to provide and improve user-facing email synchronization, drafting, and sending features visible within your AgenAI company workspace.
  • No sale or advertising use: We never sell, rent, or trade Google user data to third parties, and we never use Google user data for targeted advertising, creditworthiness assessment, or data brokering.
  • No foundation AI model training: We never use data obtained from Google Workspace / Gmail APIs to train, fine-tune, or improve generalized or third-party foundation AI/ML models.
  • Strict human-access restrictions: No human at AgenAI reads your Gmail messages unless you explicitly request support for a specific message and provide affirmative consent, or where strictly necessary for security abuse investigation or legal compliance.

5. Data Sharing, Subprocessors & International Transfers

We do not sell your personal data. We share data only with essential infrastructure and service providers acting on our instructions (or connected directly by you):

  • Stripe: Payment processing and subscription billing.
  • Resend: Transactional account emails (such as email verification and password reset links).
  • Google Analytics: Optional public-website audience measurement, based on your consent (GDPR Art. 6(1)(a)).
  • E2B: Isolated ephemeral compute sandboxes when private agent computers are enabled in your workspace settings.
  • AI Model Providers (OpenAI, Anthropic, Google Gemini, xAI, OpenRouter, DeepSeek, Mistral, Cohere): Only the prompt context required for a task you initiate is sent to the model provider configured in your workspace mandate.

Where data is transferred outside the European Economic Area (EEA), transfers are safeguarded by European Commission Standard Contractual Clauses (SCCs) or adequacy decisions under GDPR Chapter V.

6. Data Storage, Encryption & Security Controls

  • Encryption in transit and at rest: All traffic is encrypted via HTTPS/TLS. All OAuth refresh tokens, app passwords, and API keys are encrypted at rest using `Fernet` symmetric encryption before database storage and are never returned to browser scripts.
  • Tenant isolation: Workspace records are isolated per company using PostgreSQL row-level security (`agenai.startup_id`) and role-based access control.
  • OAuth security: Google and GitHub OAuth flows enforce cryptographic `state` verification, `HttpOnly` signed cookies, and `S256` PKCE code challenges.

7. Data Retention, Revocation & Deletion

  • Disconnecting a third-party account: You can disconnect Gmail, Google Ads, or any other connected service at any time in Settings → Connections → Disconnect and erase credential. Disconnecting immediately erases the stored encrypted token from our database. You may also revoke AgenAI’s access directly in your Google Account at https://myaccount.google.com/permissions.
  • Deleting your AgenAI account: You can permanently delete your account and associated workspaces in Account & subscription (`/profile`), or by emailing info@agenai.io. Upon deletion, personal data and connected credentials are erased within 30 days, except where retention of billing records is required by Swedish law.

8. Your Rights Under GDPR (Sweden & EEA)

Under the GDPR, you have the right to:

  • Access (Art. 15) and receive a copy of the personal data we hold about you.
  • Rectification (Art. 16) of inaccurate or incomplete personal data.
  • Erasure / “Right to be forgotten” (Art. 17) of your personal data and connected credentials.
  • Restriction of processing (Art. 18) and Data portability (Art. 20) in a structured, machine-readable format.
  • Object (Art. 21) to processing based on legitimate interests, and withdraw consent (Art. 7(3)) at any time for optional integrations without affecting the lawfulness of prior processing.

To exercise any of these rights, email info@agenai.io. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten — IMY, https://www.imy.se) or your local EU/EEA data protection authority.