Privacy Policy

1Who we are and what this covers

Agonic AI Inc. (“Agonic”, “we”, “us”, “our”) is a Delaware corporation doing business as Agonic AI, with its principal place of business at 2261 Market Street STE 97515, San Francisco, CA 94114, United States.

This Privacy Policy explains how we handle personal information across:

• our public website and any marketing pages, including the beta waitlist and access-code pages (together, the Site); and
• the Agonic application, workspaces, agent runtime, compute and node coordination, desktop and web clients, APIs, and related services (together, the Product).

We refer to the Site and Product together as the Service. Your use of the Service is also governed by our Terms of Service.

Supported beta territory

The Product beta is offered only to approved users in California, British Columbia, Alberta, and Ontario (the Supported Territory). The Site may remain viewable elsewhere, but the Product is not offered outside the Supported Territory unless Agonic signs a separate written agreement addressing that use.

Our role and your organization’s role

Agonic decides how to handle information used for the Site, beta invitations, accounts, security, support, AI usage billing, and the optional Improvement Data program in section 5.1. Where an organization provides an Agonic workspace, that organization decides why its workspace content is used, who may access it, and when it is retained or deleted. Agonic handles that content to provide, secure, support, and troubleshoot the Product and, only while a valid Improvement Authorization is in effect, to derive Improvement Data within the limits in section 5.1, under these documents and any separate written agreement with the organization.

If you want workspace content accessed, corrected, exported, or deleted, ask your workspace administrator first. If you cannot reach them, contact us and we will help route the request. A separate written agreement with your organization controls if it says something different.

Who this policy does not cover

This policy does not cover third-party services you connect to Agonic, third-party agent runtimes you choose to admit into your workspace, or the sites and tools those services link to. Their own privacy policies apply.

2Information we collect

2.1  Information you provide

• Waitlist and access requests. If you request beta access, we collect the email address you submit and the fact and time of the request.
• Account and profile information. Name, email address, password or third-party sign-in identifier, profile image, display name, job title, and organization. Authentication is handled by our identity provider (see section 7).
• Workspace content. Everything you and your collaborators put into Agonic: channels, threads, messages, comments, tasks, documents, uploaded and stored objects, source and code artifacts, taskgraph definitions, prompts and instructions you give to agents, and the outputs those agents produce.
• Agent execution traces. The prompts and instructions given to agents, the tools they invoked and with what parameters, intermediate steps, outputs returned, errors, retries, timings, and the resulting state changes. These records are how the Service is run, secured, supported, and debugged. A full trace embeds whatever content passed through it. A customer-visible trace saved in a workspace is workspace content, remains available until the customer deletes it or closes the workspace, and is governed by the workspace’s permissions. Section 5.1 defines the content-free record we may derive from authorized activity for generalized improvement.
• Meeting recordings and transcripts. Audio and, where applicable, video of meetings you choose to record, plus the transcripts, summaries, speaker labels, and edits derived from them. See section 3.
• Connected resources. Configuration and identifying details for compute, nodes, instruments, and third-party integrations you connect, including credentials you supply so Agonic can act on your behalf. Credentials are encrypted before storage (see section 10).
• AI usage and billing information. If your organization accepts charges for AI Use, we collect the accepted plan or rate, usage units, credits, billing contact and address, tax information where needed, invoices, and transaction status. A payment processor collects payment-card or bank details directly; Agonic receives a payment token and limited details such as card type, last four digits, and expiration date.
• Support and correspondence. Messages you send us, bug reports, feedback, and any attachments you include.

2.2  Information we collect automatically

• Device and connection data. IP address, approximate location inferred from it, browser and operating system, device and client identifiers, screen and window characteristics, language, and time zone.
• Log and usage data. Pages and features used, requests made, timestamps, referring pages and campaign parameters, session identifiers, interaction events, errors and crashes, and performance and latency measurements.
• Security and audit records. Sign-in events, permission and grant changes, agent admissions, compute placements, and node actions. These records exist so that you and we can reconstruct who or what did something, and they are deliberately hard to alter.

We may use product analytics to understand which features are used and where they fail. We do not use advertising networks, we do not track you across other companies’ sites, and we do not build advertising profiles.

2.3  Information from third parties

• Identity providers. If you sign in through Google, GitHub, or another provider, we receive your name, email address, and account identifier from that provider — not your password.
• Integrations you authorize. If you connect a third-party service, we receive the data that service exposes under the scopes you approve, limited to what is needed for the feature you enabled.
• Your organization. A workspace administrator may create your account or add you to a workspace, supplying your work email and role.

2.4  De-identified information

We may de-identify or aggregate information so that it can no longer reasonably be used to identify you or infer things about you, and we may use that de-identified information for any purpose. Where we hold information in de-identified form we will keep it that way, will not attempt to re-identify it, and will require the same of anyone we give it to — except where we need to test whether our de-identification actually works.

We are deliberately careful with this word. Free-text content, code, and transcripts are difficult to de-identify reliably, so where we describe a safeguard elsewhere in this policy we say what it actually is — access control, minimization, retention limits — rather than calling raw content de-identified when it is not.

3Meeting recordings and transcripts

Agonic can join a meeting, record it, transcribe it, and produce summaries and follow-up tasks. Because recordings are among the most sensitive information the Service handles, they get their own rules.

What we collect and how it flows

• The recording is captured and uploaded over an encrypted connection to storage we control. Uploads use short-lived, single-purpose credentials that expire automatically.
• Audio is sent to our transcription provider (see section 7) to produce a transcript. Temporary provider copies are subject to the provider configuration and retention limits described in section 9.
• The transcript, speaker labels, any edits your team makes, and derived summaries or tasks are stored in your workspace and inherit its permissions.

Limits we hold ourselves to

• Recordings, transcripts, and content derived from them are Protected Content. We do not place them in generalized training or evaluation datasets. We select and configure the transcription service for business-data processing rather than provider model training.
• We do not generate voiceprints, faceprints, or other biometric identifiers from recordings, and we do not use them to identify anyone outside the meeting they came from.
• Access follows workspace permissions. A recording is visible to the people your workspace grants access to, not to Agonic staff generally — see section 10 for the narrow exceptions.
• Deleting a recording deletes the associated transcript and derived artifacts on the schedule in section 9.

If you were recorded in a meeting but do not have an Agonic account, you may still contact us at support@agonicai.com. We will route your request to the organization that controls the recording and help it respond.

4Connected compute, hardware, and Nodes

Agonic coordinates work across cloud compute and machines you own. An Agonic Node is a computer or local process you run that exposes selected local capabilities to your workspace under explicit grants you control.

• What we receive. Node registration and identity, the capabilities you choose to expose, health and availability signals, job leases and placements, resource utilization, and the audit record of actions taken.
• What stays local. The node daemon enforces your local policy and keeps a local audit log. Files and devices on your machine are not accessible to Agonic except through a capability you explicitly granted, for a job you or your workspace authorized.
• Instrument and job data. Measurements, traces, results, and logs your agents produce — oscilloscope captures, GPU job output, analysis artifacts — are workspace content, stored and permissioned as described above.
• Revocation. You can revoke a grant or unpair a node at any time. Revocation stops future access; it does not retroactively delete results already produced and stored in your workspace, which you delete separately.

5Agents, automation, and AI processing

The Service runs software agents that read workspace context and act on your behalf. This means workspace content is processed by automated systems, including large language models, as an ordinary part of the Service working.

• What agents see. An agent is admitted to a workspace with a scoped set of permissions and can access the content those permissions cover — no more. Admissions, scopes, and tool invocations are recorded in the audit trail.
• Model providers. To generate responses and take actions, we send the context needed for the request to model providers. We use business offerings and settings intended to prevent provider training on that content. A provider may retain request data for a limited period for security or abuse monitoring under the terms that apply to the selected offering.
• Bring-your-own agents. If you admit an externally hosted agent or runtime — your own, or a third party’s — content within its granted scope leaves our control and is governed by that operator’s terms. Grant scopes deliberately narrowly.
• Protected Content is excluded from generalized training. We do not place customer-submitted code, documents, files, messages, prompts, instructions, recordings, transcripts, proprietary data, credentials, secrets, tool values or payloads, or content-bearing portions of outputs, errors, or traces into generalized training, evaluation, or regression datasets.
• Operating and improving the Service. We may process full traces as reasonably necessary to provide, secure, support, and troubleshoot the Product. We derive the content-sanitized Improvement Data described in section 5.1 for generalized training and evaluation only from activity covered by a valid Improvement Authorization. A full trace remains Protected Content while that derivation occurs.
• Automated decisions. We do not use automated processing to make decisions that produce legal or similarly significant effects about you. Agents act within your workspace on tasks you direct; they do not decide your eligibility for anything.

5.1  Protected Content and Improvement Data

Protected Content means content you or your collaborators submit, upload, connect, record, or otherwise supply to the Product, including code, documents, files, messages, prompts, instructions, recordings, transcripts, measurements, proprietary data, file paths, credentials, secrets, and tool input or result values. It also includes any portion of an agent output, trace, error message, or other record that reproduces or reveals that material. A raw or full agent trace is Protected Content because it may embed those materials.

Improvement Data is a content-sanitized record derived from use of the Product. It may include generic agent and tool categories and order, argument data types and counts rather than names or values, timing and token measurements, outcome and error categories rather than raw messages, retry patterns, routing choices, performance measurements, and non-content feedback labels.

Improvement Data excludes Protected Content, raw or full traces, direct account and customer identifiers, customer-defined agent and tool names, tool argument values and result payloads, model output text, raw error strings, recordings and transcripts, credentials, and secrets. Before generalized training or evaluation, we aggregate or de-identify Improvement Data so that it is no longer reasonably linkable to a person or customer, and we apply safeguards designed to prevent reconstruction of Protected Content. We do not use Improvement Data to reconstruct Protected Content or to identify a person or customer.

Improvement Authorization means a separate, affirmative opt-in made through a Product control, order form, or written agreement by a workspace administrator authorized to act for the organization. Accepting the Terms or merely using the Product is not an Improvement Authorization. The organization must provide any notices and obtain any consents it is responsible for obtaining from its users, and Agonic will obtain any additional direct consent applicable law requires. The authorization is optional and is not a condition of receiving the beta Service.

While a valid Improvement Authorization is in effect, we may process new full traces from the authorized workspace through automated filters and, where reasonably necessary, limited review by authorized personnel to create or validate Improvement Data. During that process the trace remains Protected Content and is subject to the confidentiality, access, and retention limits in this policy. Declining or withdrawing the authorization does not limit processing reasonably necessary to provide, secure, support, or troubleshoot the Product, but information processed only for those operational purposes is not used for generalized training or evaluation.

We may use properly created Improvement Data to measure usage and reliability, diagnose patterns, plan capacity, create evaluation and regression datasets, and evaluate, train, fine-tune, or improve prompts, tool definitions, routing, orchestration, models, and other Product components. Until Improvement Data has been aggregated or de-identified so that it is no longer reasonably linkable to a person or customer, we protect it as personal and confidential information.

6How we use information

We use personal information for the purposes below. We limit each use to what is reasonably necessary and appropriate for the beta and any separate written agreement with your organization.

7How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as described here.

7.1  Service providers

We use vendors to perform functions needed to run the beta. Depending on the provider, processing is governed by a contract or by the commercial terms and settings for the provider’s business offering. We select and configure providers with the aim of limiting their use of Protected Content to the requested service, security, and legal compliance. A provider may process properly created Improvement Data from an authorized workspace for evaluation or training where described below. The principal provider categories expected for the beta are below; a particular customer deployment or separate written agreement may use a different set.

For the current provider list applicable to your deployment, write to support@agonicai.com.

7.2  Within your workspace

Content you put in a workspace is visible to other members according to the permissions your workspace sets, and to agents admitted to it. Workspace administrators can access, export, retain, and delete workspace content, including content you created.

7.3  Integrations you authorize

When you connect a third-party service, data flows to it under the scopes you approved, and its own privacy policy and terms govern what it does with that data. A service or agent that you supply independently is not an Agonic service provider merely because you connect it to the Product.

7.4  Legal and safety

We may disclose information where we believe in good faith it is reasonably necessary to comply with a law, regulation, legal process, or enforceable governmental request; to enforce our Terms; or to protect the rights, property, or safety of Agonic, our users, or the public. Where legally permitted and reasonably practicable, we may notify the affected customer before disclosing workspace content.

7.5  Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. The information remains subject to this policy until an updated policy takes effect, and we will provide notice of material changes where required by law.

8Processing in the United States

Agonic is based in the United States, and the beta is operated primarily from the United States. If you use Agonic from British Columbia, Alberta, or Ontario, your personal information will be transferred to, stored in, and processed in the United States and may be processed in other locations where the service providers applicable to your deployment operate.

Those locations may have privacy laws that differ from Canadian law, and information stored in the United States may be accessible to US courts, law enforcement, or national security authorities under US law. Agonic remains responsible for its handling of Canadian personal information under applicable Canadian law and uses contractual, organizational, and technical measures appropriate to the provider and information involved.

For Alberta residents, this section is notice that service providers outside Canada may collect, use, disclose, or store personal information on our behalf. Our Privacy Officer in section 16 can answer questions about the countries in which a provider handles information and the purposes for which the provider is authorized to do so.

9How long we keep information

We keep personal information only while reasonably necessary for the purposes in section 6, for a separate written agreement, or for legal, security, or dispute-resolution needs. The criteria below govern each category. Deletion from active systems and expiration from routine backup rotation may occur at different times.

Deleting a customer-visible trace removes it from the workspace and starts the deletion period for residual operational copies and backup remnants described above. Deleting source content does not require us to delete properly created Improvement Data that no longer contains Protected Content, aggregate metrics, completed evaluation results, or model parameters produced from that data. We continue to protect any Improvement Data that remains reasonably linkable to a person or customer as personal and confidential information.

We may retain information longer where we are required to preserve it for a legal claim, investigation, or regulatory obligation. In that case we retain it only for that purpose and restrict access as appropriate.

10How we protect information

We maintain administrative, technical, and organizational safeguards designed for the nature and sensitivity of the information handled in the beta. Current safeguards include:

• Encryption. TLS for data transmitted to our hosted services and encryption at rest for hosted databases and object storage.
• Access control. Workspace permissions, scoped grants, and least-privilege access for people and agents.
• Internal access. Customer-content access limited to authorized personnel with an operational, support, security, troubleshooting, or Improvement Data validation reason permitted by section 5.1.
• Logging. Logging of security-relevant access and actions where supported by the applicable component.
• Credential handling. Controls intended to keep connected credentials and tokens out of ordinary logs and diagnostic output.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will investigate and provide notices to affected people, customers, and regulators where applicable law requires, including the relevant California or Canadian authority.

11Your choices and controls

• Account and profile. Update available fields in the Product or ask us to correct your account information.
• Workspace content. Use available Product controls, ask your workspace administrator, or contact us to request access, export, correction, or deletion.
• Connections and grants. Use available Product controls to revoke integrations, unpair nodes, and withdraw agent admissions.
• Recording. Recording never starts by itself. You choose whether to record a given meeting.
• Generalized improvement use. A workspace administrator may provide an Improvement Authorization through the separate control or written process we make available. The administrator may withdraw it at any time through that control or by writing to support@agonicai.com. A user who separately provided direct consent may withdraw that consent through the available control or the same email address, in which case we exclude that user’s new activity from the authorization. Withdrawal applies prospectively: we stop using newly excluded activity to create Improvement Data for generalized training and evaluation, and we delete or de-identify any previously created Improvement Data that remains reasonably linkable to the withdrawing person or customer within a reasonable implementation period. Withdrawal does not limit processing needed to provide, secure, support, or troubleshoot the Product, and it does not reverse properly created aggregate or de-identified results, completed evaluations, or model parameters already produced.
• Email. You can unsubscribe from commercial messages using the mechanism in the message. Messages necessary to process your beta request or concerning your account, security, or the Service are not marketing.
• Account deletion. Ask us at support@agonicai.com and we will delete your account and associated personal information on the schedule in section 9. If you are a member of an organization’s workspace, content you contributed there belongs to that workspace and its administrator controls its deletion.

12Your privacy rights

12.1  Making a request

If you are in the Supported Territory, you may ask us to confirm whether we hold personal information about you, provide access to it, correct inaccurate or incomplete information, delete it, or provide a portable copy where applicable law requires. Contact support@agonicai.com.

You may also opt out of commercial messages or withdraw consent where applicable law allows. We respond within the period required by applicable law and will explain any permitted extension. We do not retaliate or discriminate against you for exercising a privacy right. If applicable law permits a fee, we will tell you before incurring it.

We may need to verify your identity before acting, and will ask only for what that reasonably requires; for a request touching sensitive material we may need stronger proof. You may use an authorized agent, with written authorization or a power of attorney, and we may still ask to confirm the authorization with you directly. We limit what we collect in handling a request to what is needed to fulfil it.

We may decline a request where the law permits — for example where it would reveal another person’s information, interfere with security, or compromise a legal claim. If we decline, we will give the explanation and review information required by applicable law. If your request concerns an organization’s workspace, we may refer the request to its administrator.

12.2  California

Where the California Consumer Privacy Act as amended by the CPRA applies, California residents have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

We collect, or may collect, the following statutory categories, for the purposes in section 6, from the sources in section 2, and disclose them for business purposes to the recipients in section 7:

We use account credentials for authentication and security, and we handle communications and workspace content to provide, secure, support, and troubleshoot the beta and, only where a valid Improvement Authorization is in effect, to derive Improvement Data within the content-removal limits in section 5.1. We do not use sensitive personal information to infer characteristics about you or for purposes that currently require a “Limit the Use of My Sensitive Personal Information” mechanism.

You may use an authorized agent to submit a request, with written permission and identity verification. California residents may also request information under California’s “Shine the Light” law; we do not disclose personal information to third parties for their own direct marketing.

12.3  British Columbia, Alberta, and Ontario

We handle personal information of users in British Columbia, Alberta, and Ontario in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the private-sector privacy statutes of British Columbia and Alberta. We collect, use, and disclose personal information for purposes a reasonable person would consider appropriate in the circumstances and with consent where applicable law requires it.

You may request access to your personal information, ask us to correct it, ask how it has been used or disclosed, and withdraw consent subject to legal and contractual restrictions and reasonable notice. We respond within the period required by the law applicable to the request.

• Accountability. The individual accountable for our privacy compliance is named in section 16. If you are not satisfied with our response, you may challenge our compliance with that individual, and then with the appropriate commissioner below.
• British Columbia. Residents of BC have access and correction rights under BC’s Personal Information Protection Act, and may complain to the Office of the Information and Privacy Commissioner for British Columbia.
• Alberta. Residents of Alberta have access and correction rights under Alberta’s Personal Information Protection Act, and may complain to the Office of the Information and Privacy Commissioner of Alberta. Section 8 contains the notice Alberta law requires about our use of service providers outside Canada. We will notify the Commissioner without unreasonable delay of a breach presenting a real risk of significant harm and will notify affected individuals where the Commissioner or applicable law requires, or where we otherwise determine prompt notice is appropriate.
• Ontario. Ontario has no general private-sector privacy statute; PIPEDA governs our handling of Ontario residents’ personal information, and Ontario residents may complain to the Office of the Privacy Commissioner of Canada.

13Cookies and similar technologies

Our public Site does not currently use advertising or analytics cookies. The Product may use the following storage needed for the beta:

• Strictly necessary. Authentication and session cookies that keep you signed in, and security cookies that protect against cross-site request forgery and abuse.
• Functional. Local storage that remembers interface preferences such as layout and theme.

Server-side logs and Improvement Data used to measure feature usage, errors, and performance are described in sections 2 and 5; they are not advertising cookies. We do not use advertising cookies or tracking pixels, and we do not track you across other companies’ websites.

Because we do not collect personal information about your activities over time and across third-party websites or services for behavioral advertising, browser “Do Not Track” and Global Privacy Control signals do not change our current practices. We do not authorize service providers to collect that kind of cross-site activity through the Service for advertising. The Google Fonts request described below does disclose connection data to Google, whose independent handling is governed by its own terms. If our practices change, we will update this section and honor any browser-based signal applicable law requires.

If we introduce optional browser-based analytics during the beta, we will update this section and provide any choice required by applicable law before enabling it.

Our public pages load fonts from Google Fonts, which means Google receives your IP address and browser information when a page loads. You can block that request with a content blocker; the pages remain readable.

14Children’s privacy

The Product is a business tool intended for adults. It is not offered to anyone under 18, and we do not knowingly collect personal information from a minor through the Product. If you believe a minor has provided us personal information, contact support@agonicai.com so we can investigate and take appropriate action.

15Changes to this policy

We may update this policy as the Service and the law change. When we do, we will revise the “Last updated” date above. We will provide any additional notice or consent required by applicable law for a material change. We will not use personal information already collected for a materially new purpose until we have provided any required notice and obtained any required consent, and posting an updated policy or continued use of the Product alone does not create an Improvement Authorization.

16How to contact us

Agonic has designated an individual who is accountable for our compliance with this policy and with applicable privacy law. For any privacy question, request, or complaint — including exercising the rights in section 12 — you can reach them here:

• Privacy Officer: Robert Lupoiu
• Privacy requests: support@agonicai.com
• Legal notices: legal@agonicai.com
• Mail: Agonic AI Inc., Attn: Privacy, 2261 Market Street STE 97515, San Francisco, CA 94114, United States

If you are in British Columbia, Alberta, or Ontario and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or the provincial commissioner identified in section 12.3, as applicable.