Privacy Policy
What personal data we keep about you, why, for how long, who else receives it, and your rights. We keep as little as we can: no advertising, and nothing that follows you across the web.
Last updated 4 November 2026
Who we are
The controller of your personal data is VERTIXER LTD, a company registered in Bulgaria under number 208418587, with its registered office at 2 Bulgaria Str., 2850 Petrich, Bulgaria. Write to [email protected] about anything in this policy. We have not appointed a data protection officer, as the law does not require one of us.
This policy covers data about you as a visitor, a customer, or someone who writes to us. What you and your agents put into sandboxes is processed for you, and the Data Processing Addendum covers it.
What we collect
| Data | What it is | Where it comes from |
|---|---|---|
| Account | Email address, name, profile picture, account and organisation ids, and when the account was made. | You, or GitHub or Google if you sign in with them |
| Sign-in | Sessions, with the IP address and browser they were started from, and when each was last used. One-time codes, kept only as hashes. For older accounts, a password, kept only as a hash. If you turn on two-factor sign-in, its secret and backup codes, kept encrypted, and the browsers you chose to trust. For passkeys, their names, public keys and ids, a counter, and the make of device they are on. | Your browser |
| API keys | Each key's name, its first characters, and a hash. Never the key itself. | You |
| Billing | Plan, whether a card is saved and the free credit given, with the fingerprint Stripe gives that card so the credit is given once a card, subscription status, your customer id at Stripe, your auto-reload setting, payments and credit. Never your card details. | Stripe, and you |
| Usage | Sandboxes made, their sizes, running seconds, what they cost, email messages counted, and what happened to each sandbox. | agental |
| Where you came from | When you sign up: the address that sent you to agental.io, without its query, the utm_ words of the link you came by, and the first page you opened, as the page you sign up from had them. Later, in the console, your answer to "How did you hear about agental?" if you give one. | Your browser as you sign up, and you |
| Settings | Webhook addresses and their signing secrets, telemetry endpoints and headers, SSH public keys, and the email addresses of people you invite. Signing secrets and header values are kept encrypted. | You |
| Messages | What you write to us, and our answers. | You |
| Enterprise requests | What you send from the form on our Enterprise page: your name, work email, the cards you ticked and your message, with the IP address it came from and when. Cloudflare Turnstile checks it is sent by a person, from your IP address, browser and connection. | You, and your browser |
| Network | IP addresses and request details, seen by Cloudflare in front of agental.io, and by our mail server. | Your browser and programs |
Why we use it
- To provide agental: your account and sign-in, running your sandboxes, metering and billing, and notices about your account. Legal basis: our contract with you (Article 6(1)(b) GDPR).
- To keep agental secure and stop abuse: rate limits, such as how often one IP address may send our Enterprise form, looking into abuse reports, enforcing the Acceptable Use Policy, and protecting other customers. Legal basis: our legitimate interest in a secure and honest service (Article 6(1)(f)).
- To answer you, and to improve agental from what you tell us and from usage totals. Legal basis: our legitimate interests (Article 6(1)(f)).
- To answer a request from our Enterprise page and, if you go ahead, set Enterprise up with you. Legal basis: our legitimate interest in answering businesses that ask (Article 6(1)(f)), or steps you ask for before a contract (Article 6(1)(b)).
- To learn which places bring people to agental, and how many of those who sign up go on to make a sandbox, come back and pay, counted by where they came from. Legal basis: our legitimate interest in knowing where to tell people about agental (Article 6(1)(f)).
- To keep accounting and tax records, and to answer lawful requests from authorities. Legal basis: legal obligation (Article 6(1)(c)).
We do not sell personal data, show advertising, use third-party analytics or tracking tools, or send marketing email. We do not train AI models on your data or on what is in your sandboxes. Sandboxes stop by themselves when credit runs out, under the Terms; we make no other automated decisions about you.
Sign-in with GitHub or Google
If you sign in with GitHub or Google, it tells us your name, email address, profile picture and account id. It also gives us access tokens, which we do not keep: nothing in agental reads your account there. GitHub's and Google's own privacy policies cover what they do.
Who receives it
- Our subprocessors, listed on Subprocessors: Hetzner, which runs our API, the account databases and our mail server; Cloudflare, for the network in front of agental, for storage, and for Turnstile on the Enterprise form; Stripe, for payments; Resend, which sends sign-in codes, a welcome email and billing notices, and mails each Enterprise request to our inbox; and Spaceship, whose Spacemail holds that inbox. Sandboxes run on servers from Hetzner and the other server providers listed there.
- Stripe takes your payment for us and holds your card details, which never reach us. It handles them as a controller of its own, under its own privacy notice, for fraud prevention and the rules that bind it as a payment institution.
- Places you tell agental to send data, such as your webhooks and telemetry collectors.
- Authorities or courts, when the law requires it, and others when needed to protect rights or safety.
- Whoever takes over agental, who would be bound by this policy.
Transfers outside the EU
Your account and the API's databases are kept on our servers in the EU. Sandboxes run on servers from several providers in several countries, all listed on our Subprocessors page. Today they are all in our eu region. The eu region holds only servers in the European Economic Area or the United Kingdom, which the European Commission recognises as protecting personal data adequately. When we add servers in the us and apac regions, you will choose the region each sandbox runs in. A sandbox in the eu region stays there: we never place it, move it or keep its disk in another region, and when the eu region has no room, a new sandbox is refused rather than made elsewhere. What we keep with Cloudflare, archived sandboxes and received email, is stored in its EU jurisdiction. Cloudflare's network, which carries traffic to and from agental, Resend, which sends our email, and Spaceship, which holds our inbox, are run by companies in the United States and may process data there or elsewhere. Some of the server providers on our Subprocessors page are also run by, or belong to, companies in the United States. Those transfers rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Write to us for a copy of the safeguards.
How long we keep it
| Data | Kept |
|---|---|
| Account, settings and what is in sandboxes | While the account is open. Erased 30 days after you close it, or at once if you erase it from Settings. Sandboxes and snapshots are also deleted once an open account has had no plan, or has owed for what it used, for 30 days, after we email you. |
| Sessions, with IP address and browser | Until they expire, 30 days after you sign in, or you log out or end them in Settings. |
| Where you came from | With your account, until the account is erased. Sent with a sign-in that makes no account, it is not kept, or, for GitHub and Google, only for the 10 minutes the sign-in may take. |
| One-time sign-in codes | 5 minutes. |
| Two-factor sign-in and passkeys | Until you turn it off or remove them, or the account is erased. A setup left unfinished, until you start another or the account is erased. A trusted browser, 30 days. A sign-in waiting for its second step, 10 minutes. |
| Usage, payments and credit | While the account is open, then as long as accounting and tax law requires: up to 10 years in Bulgaria. |
| Command output, agent conversations, sandbox events and scheduled runs | 30 days, or what you choose in Settings › Your data: 1, 7 or 90 days, or until the sandbox is deleted. Each schedule keeps the record of its newest run and its newest 10 that ran, however old, while it exists. A deleted sandbox's history is deleted with it, its schedules too, its events a day later. |
| Webhook deliveries | 30 days, or 7 days for email events. |
| Email received by your sandboxes | 7 days. |
| Mail server logs | 14 days. |
| Sandbox metrics (processor, memory, disk, network) | 15 days. |
| Messages to us | Up to 2 years after the conversation ends. |
| Enterprise requests | 2 years after they are sent. The email each one becomes, and the conversation that follows, are kept as messages to us. |
| Anything needed for a dispute or an investigation | Until it is settled. |
Your rights
- See the personal data we hold about you, and get a copy in a format a machine can read. Settings in the console downloads it as one file.
- Have it corrected, or deleted. Closing your account from Settings erases it 30 days later, or at once if you choose.
- Have its use restricted, or object to a use based on our legitimate interests.
Write to [email protected] from your account's email address. We answer within one month. You may also complain to the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg), or to the authority where you live or work.
California residents
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the CCPA), gives you the rights below. This part of the policy uses the CCPA's own names for kinds of personal information. What we collect, where it comes from, why we use it and how long we keep it are set out above; the table maps them onto the CCPA's categories for the last 12 months.
| CCPA category | What we collect | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email address, account and organisation ids, your customer id at Stripe, IP addresses. | Hetzner, Cloudflare, Stripe, Resend, Spaceship |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, email address and billing address. Never your card details: Stripe holds those. | Hetzner, Stripe, Resend, Spaceship |
| Commercial information | Plan, subscription status, payments, credit, and sandbox usage and its cost. | Hetzner, Stripe |
| Internet or other electronic network activity | Sessions and the browser they were started from, request details, the address and link words you came to agental.io by, and what happened to each sandbox. | Hetzner, Cloudflare |
| Professional information | What you tell us about your work in an Enterprise request. | Hetzner, Resend, Spaceship |
| Sensitive personal information | Your sign-in: your email address with a one-time code, a password kept only as a hash, two-factor secrets kept encrypted, and passkeys. Used only to sign you in and keep your account secure. | Hetzner, Resend (one-time codes only) |
We do not collect precise geolocation, biometric information, audio or video recordings of you, education information, or characteristics of protected classes, and we draw no inferences or profiles about you. What you and your agents put into sandboxes is processed for you as a service provider, under the Data Processing Addendum.
We do not sell your personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share it, there is nothing to opt out of, and a browser's Global Privacy Control signal changes nothing on our side. We use sensitive personal information only for the purposes the CCPA allows without a right to limit: signing you in and keeping your account secure. We do not disclose personal information to third parties for their own direct marketing.
Under the CCPA, you have the right to:
- Know what personal information we have collected about you, where it came from, why we use it and to whom we disclosed it, and get a copy of the specific pieces, up to twice in 12 months. Settings in the console downloads your data as one file at any time.
- Have it deleted, subject to the exceptions in the law, such as records we must keep for tax. Closing your account from Settings erases it 30 days later, or at once if you choose.
- Have inaccurate personal information corrected.
- Not be treated differently for using any of these rights: we do not charge you more, give you a lesser service, or refuse you for it.
To make a request, write to [email protected] from your account's email address. If you have no account, or write from another address, we may ask for details only you would know to confirm it is you, and use them only for that. Someone you authorise may make a request for you, with your signed permission; we may still ask you to confirm your identity with us directly. We answer within 45 days, and if we need up to 45 more, we tell you why within the first 45. Requests are free.
Cookies
| Cookie | What it does | Kept |
|---|---|---|
agental.session | Keeps you signed in. | 30 days after you sign in |
agental.invite | Remembers a valid invite code while you sign up. | 30 minutes |
agental.state | Protects sign-in with GitHub or Google against forgery. | 5 minutes |
agental.two_factor | Holds a sign-in between its two steps, for an account with two-factor sign-in on. | 10 minutes |
agental.trust_device | Lets this browser skip the second step, only if you choose to trust it when you log in. | The time you choose, 30 days at most |
agental.better-auth-passkey | Holds the challenge while you sign in with or add a passkey. | 5 minutes |
All of them are needed for the service to work, or are set only when you ask, so they need no consent. We set no analytics, advertising or third-party cookies, nothing is stored in your browser to learn where you came from, and no tracking scripts run on our pages. Fonts are served from agental.io itself. Cloudflare may set a cookie of its own to tell people from bots. The Enterprise page loads Cloudflare Turnstile, which checks the form is sent by a person and asks you to tick a box only when it cannot tell. Cloudflare does that check for us, and uses what it sees only to tell people from bots.
Security
Traffic is encrypted, every sandbox is a virtual machine of its own, passwords, API keys and sign-in codes are kept only as hashes, and the secrets you store with us, and those of two-factor sign-in, are kept encrypted. The measures are listed in the Data Processing Addendum.
Children
agental is not for anyone under 18, and we do not knowingly collect their data.
Changes
We post changes to this policy here, with the date. If a change is significant, we also email account holders before it takes effect.