Privacy Policy

1. Data We Collect

• Account Information: Full name, email address, company name, profile photos, the date you agreed to our Terms, and OAuth authentication tokens from Google, Microsoft, LinkedIn or Canva.
• Workspace & Agent Data: Files, prompt definitions, agent memory vaults, notes, tasks, and conversation threads created within your workspace.
• Subscription & Usage Metrics:Seat allocations, billing cycles, and token consumption counters. Card details are entered on Stripe's payment page and are not stored by us.
• Support Reports: The title, description and contact email you send through the issue-report form.

2. How We Use Your Data

We process data solely to provide, operate, and maintain the Agent Engine service. We do not sell your data. We do not share your private workspace files or agent memories with third parties for marketing or advertising purposes.

3. Third-Party Processors

We send personal data to these providers only to run the service. Some of them process data outside Malaysia.

• Supabase: Database hosting, authentication, storage of uploaded files, and your agents' files and memory.
• Vercel: Web hosting and serverless infrastructure.
• Stripe: Card payments and subscription billing. Receives your email address, company name and the seats you buy.
• AI model providers: Our system chooses automatically which AI model handles each request, so it can use the best one for the task. Today these are Anthropic (Claude) and Google (Gemini). If we add another provider, we will list it here.
• Resend: Email delivery, for workspace invitations and the issue reports you send us.
• Google: Sign in with Google, and, only if you connect them: sending email from Gmail (each message approved by you first), Google Calendar, reading the Google Docs, Sheets and Slides you share with an agent, and Google Drive files the product itself creates.
• Microsoft: Sign in with Microsoft, and, only if you connect them, Outlook mail, Outlook calendar and OneDrive: reading your OneDrive files and the OneDrive links you paste, and saving the files you approve to the Agent Engine AI folder in your OneDrive.
• LinkedIn: Only if you connect it, to publish posts you approve.
• Canva: Only if you connect it, to read your brand templates and the designs you ask your agent to read, and to create new designs you approve (a filled brand template, or a deck your agent made).
• Xero: Only if a workspace owner or admin connects it, to read that organisation's invoices, bills, quotes, contacts and reports, and to save as drafts in Xero the invoices, quotes and bills you approve.
• QuickBooks (Intuit): Only if a workspace owner or admin connects it, to read that company's invoices, bills, estimates, customers, suppliers and reports, and to save in QuickBooks the estimates and supplier bills you approve.
• Meta (WhatsApp): Only where a workspace's WhatsApp Business number is set up with us, or a workspace owner or admin connects their own: to receive the messages people send that number, to send the replies a person in that workspace approves, and to create the message templates they ask for.
• Meta (Messenger): Only if a workspace owner or admin connects their Facebook Page: to receive the messages people send that Page on Messenger, and to send the replies a person in that workspace approves.
• Meta (Instagram): Only if a workspace owner or admin connects their Instagram business or creator account: to receive the direct messages people send that account, and to send the replies a person in that workspace approves.
• Sentry: Error reports when something fails, once switched on. They describe the failure and carry no conversation content.
• PostHog (EU): Product usage analytics: which features are used and how often. It never receives the content of your conversations, files or notes. Hosted in the European Union.

Our AI providers process your content only to answer your requests. Under their terms for business customers they do not use it to train their models; they may keep request data for a limited period to detect and prevent abuse.

4. Google user data (Limited Use)

• Our use of Google user data. Agent Engine AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• What we access. Only what you connect and use: your Google Calendar events; the Google Docs, Sheets and Slides you point an agent to; Google Drive files the product creates for you; and permission to send email that you have approved. We do not read your Gmail inbox and do not browse your Google Drive.
• What we do with it. We use Google user data only to carry out tasks you ask your agents to do in the product. We send it to our AI model providers only for that purpose, and not for them to train their models.
• What we do not do with it. We do not use it for advertising. We do not sell it. We do not use it to develop, improve or train generalised AI or machine-learning models.
• Human access. People do not read it except with your permission, for security purposes, to comply with the law, or where it has been aggregated and anonymised for internal operations.
• Disconnecting. You can disconnect at any time on the Integrations page, or in your Google Account settings; we then delete the stored access token.

5. Data Security & Isolation

• Each company is walled off.Every request is checked inside the database itself, so one company's data cannot be read from another company's account.
• Agents work with your permissions. An agent can only read what the person using it is allowed to read.
• Connection keys get extra protection. The keys that connect Google, Microsoft, LinkedIn and Canva are encrypted with AES-256-GCM before they are stored, on top of the encryption below.
• Encrypted in transit and at rest. Our infrastructure providers (Supabase and Vercel) encrypt data in transit (TLS) and at rest (AES-256).
• Nothing goes out without you. Agents draft emails, posts and calendar changes; they are sent only when you approve them. Tasks that run on a schedule never send anything on their own, except an email you wrote word for word and asked to be sent on that schedule.
• Outside content. Text an agent reads from the web or from documents is treated as information and not as instructions.
• Shared pages are sealed. A page you share by link cannot run scripts or connect to anything else on the internet.

6. Where Your Data Is Stored

Your workspace data (conversations, agent memory, notes, files and pages) is stored by Supabase in Singapore. The website also runs on Vercel servers in Singapore. When an agent works on a request, the content needed for that request is sent to our AI model providers, which may process it outside Malaysia, including in the United States.

7. Who Can See What in Your Workspace

Your conversations are yours. Nobody else in your workspace can read them. That includes admins, colleagues you share an agent with, and other agents.

Your agents are yours unless you share one. If you share an agent with a colleague, you both use it and it learns from both of you: its memory, notes and tasks are shared between you. Your conversations with it are not. You, or an admin, can stop sharing at any time. What the agent has already learned from a colleague stays with the agent.

The company profile is read by everyone in your workspace and by every agent. Anyone can suggest an addition; it takes effect only when an admin approves it. Keep personal details out of it.

The workspace libraryholds documents and notes that someone chose to share with the whole workspace. Any colleague's agent may read and cite them by title. The person who shared an item, or an admin, can remove it.

Your colleagues can see who you are. Everyone in your workspace can see the name, email address and photo on your account, so they know who they are working with.

8. How Long We Keep It

• A file you attach to a conversation is kept with that conversation and counts toward your storage allowance. If you have not opened or used it for 30 days, the original file is deleted; the text read from it stays in the conversation so the agent can refer back to it. Deleting a conversation deletes the files attached to it. Files you add to an agent's or your company's context are kept until you delete them.
• Pages, documents and images your agents make are kept until you delete them, or until your account is deleted. Each plan includes a storage allowance; when you reach it, delete older items to make room.
• A shared link works until you stop sharing it or delete the item.
• Your conversations and agent memory are kept while your account is open, until you delete them.
• Billing and usage records are kept as long as we need them to bill you and to meet our legal obligations.

9. Your Rights (Personal Data Protection Act 2010)

We process your personal data under Malaysia's Personal Data Protection Act 2010 for the purposes set out above: to provide the service, to bill for it, and to support you. We collect it from you and, if you connect them, from the services listed in section 3. Your name, email address and payment details are necessary to use the service; without them we cannot open an account for you.

You have the right to ask for access to the personal data we hold about you, to ask us to correct it, and to withdraw your consent or limit how we process it. To exercise any of these rights, or to make a complaint or enquiry about your personal data, write to support@agentengine-ai.com. We will respond within 21 days.

10. WhatsApp, Facebook and Instagram (Meta)

• What we keep when you connect your WhatsApp Business number. The number, its business name, the access key Meta gives us for it (encrypted with AES-256-GCM before it is stored), and the messages people send that number together with the replies you approve.
• What we keep when you connect your Facebook Page.The Page's name and id, the access key Meta gives us for that Page (encrypted with AES-256-GCM before it is stored), and the Messenger messages people send that Page together with the replies you approve. Meta tells us each person only as a number that is unique to your Page; it does not give us their name or profile.
• What we keep when you connect your Instagram account.The account's username and id, the access key Instagram gives us for it (encrypted with AES-256-GCM before it is stored, and renewed every 60 days while you use it), and the direct messages people send that account together with the replies you approve. Instagram tells us each person only as a number that is unique to your account; it does not give us their name or profile.
• What we do with it. Only what this policy describes: your agent drafts replies, and nothing is sent until a person in your workspace approves it. We do not use Meta data for advertising and we do not sell it.
• Deleting it. Press Disconnect on the Integrations page, or remove Agent Engine AI in your Facebook or Instagram settings and ask for your data to be deleted. Either way we delete the access key, the number's, Page's or account's settings, and the WhatsApp, Messenger or Instagram contacts and messages we kept for it, and Facebook gives you a confirmation code. The full steps are on our data deletion page.