Privacy policy

1. Data controller

The controller of your personal data is:

• Owner: [LEGAL NAME]
• Tax ID: [TAX ID]
• Address: [FULL ADDRESS]
• Contact email: [PRIVACY EMAIL]
• Data Protection Officer: [DPO OR "not applicable"]

2. Data we process

We process the following categories of data, depending on how you use the service:

• Registration data: username, email address and password (always stored hashed, never in plain text).
• Profile data provided at registration: date of birth, gender, country and phone number. Providing them is optional and the service works without them.
• Content you create: agents, prompts, skills, knowledge, conversations, workflows and any files you upload.
• AI provider credentials you configure in your account, stored encrypted and used solely to run the requests you initiate.
• Technical data: IP address, request timestamps, browser type and error logs, generated automatically as you use the service.
• Billing data, if you subscribe to a paid plan: customer identifier, plan, amount and invoice history. Card details are handled directly by the payment provider; we neither receive nor store them.
• Your GitHub account identifier and username, if you choose to sign in with GitHub.

3. Purposes and legal bases

Each processing activity has a specific purpose and a legal basis:

• Providing the service, maintaining your account and running the agents you create. Basis: performance of the contract (Art. 6(1)(b) GDPR).
• Collecting payment for paid plans and issuing invoices. Basis: performance of the contract and compliance with tax obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Sending essential operational emails: account verification, password recovery, status and billing notices. Basis: performance of the contract.
• Keeping the service secure, preventing abuse and enforcing usage limits. Basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).
• Optional profile data (date of birth, gender, country and phone number) is processed on the basis of your consent, which you may withdraw at any time without affecting your use of the service.

4. Artificial intelligence models

iAgents Hub does not train its own models: it sends your requests to the AI providers you configure. This means the content of your conversations, prompts and attached documents is transmitted to the provider you chose so that it can generate a response.

Each provider applies its own privacy policy and its own retention periods, over which we have no control. Before sending confidential information through an agent, review the terms of the provider you are using. If you would rather no data left your infrastructure, you can use a local model or install iAgents Hub on your own server.

5. Recipients

We do not sell your data or share it with third parties for advertising. We rely on providers acting as processors that are necessary to deliver the service:

• Hosting and infrastructure provider: [HOSTING PROVIDER].
• Payment provider, for subscriptions and invoicing: [PAYMENT PROVIDER].
• Outbound email provider, for operational messages: [SMTP PROVIDER].
• The AI model providers you configure in your account.
• Public authorities and courts, where there is a legal obligation to disclose.

6. International transfers

Some of the providers above may process data outside the European Economic Area. In those cases the transfer relies on an adequacy decision of the European Commission or, failing that, on standard contractual clauses together with any supplementary measures required. You may request information about the safeguards in place by writing to [PRIVACY EMAIL].

7. Retention periods

We keep your data while your account is active. When you request account deletion, permanent erasure is scheduled and you have a window to cancel it before it runs.

• Account data and content: while the account is active and up to [PERIOD] after deletion.
• Technical and security logs: [PERIOD].
• Accounting and tax records: for the periods required by applicable commercial and tax law.

8. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection at any time, and withdraw any consent you have given.

• From your profile you can download a complete copy of your data and request account deletion without contacting us.
• You may also write to [PRIVACY EMAIL], stating which right you wish to exercise.
• If you believe your request was not handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

9. Security

We apply technical and organisational measures to protect your data: encrypted traffic in transit, hashed password storage, encrypted provider credentials, role-based access control, request limits to prevent abuse, and logging of relevant activity.

No system is completely secure. Should a breach occur that poses a risk to your rights, we will inform you and notify the supervisory authority within the deadlines the law requires.

10. Cookies

This site uses only strictly necessary technical cookies: the one that keeps you signed in and the one that remembers your active workspace. We use no analytics, advertising or profiling cookies, and we embed no third-party trackers.

Because they are strictly necessary, these cookies do not require your prior consent. You may delete them from your browser, though doing so will end your session.

11. Minors

The service is intended for people over [MINIMUM AGE]. We do not knowingly collect data from anyone below that age. If we identify an account that does not meet this requirement, we will delete it along with the associated data.

12. Changes to this policy

We may update this policy to reflect changes in the service or in applicable law. If a change is substantial we will notify you by email or through a visible notice in the service before it takes effect. The date of the last update appears at the top of this document.

13. Contact

For any question about this policy or about the processing of your personal data, write to [PRIVACY EMAIL].