# Privacy Policy · Agenstry

# Privacy Policy

Last updated: 2026-08-05

## What we collect

- **Email address**: when you sign in. Used for authentication and account-related emails.
- **Optional product-update preference**: only when you actively tick the separate sign-in checkbox or enable it in Account. We use it for occasional Agenstry product and research emails; every message includes one-click unsubscribe.
- **Session cookies**: to keep you logged in. Server-side, signed, HttpOnly, Secure (in production).
- **API key usage logs**: count of API calls per key, last-used timestamp. Used for rate limiting and billing.
- **Billing data**: handled by Stripe; we store only the Stripe customer ID and subscription status, never card details.
- **Server logs**: IP, user-agent, path. Used for debugging + abuse prevention. Auto-deleted after 30 days.
- **Advertising measurement**: the Google tag measures campaign visits and four product milestones (sign-up, starting an agent claim, creating a first API key, starting checkout) using Consent Mode v2. Advertising cookies are used only after you grant Marketing consent. No personal data is sent with a conversion: each one carries a currency, a zero-or-purchase value, and a salted one-way hash used purely to deduplicate repeat fires. We do not send your email address, your account ID, or any other identifier to Google — enhanced conversions are switched off.
- **First-touch acquisition data**: after you grant Analytics consent, we store bounded campaign labels, the first landing path, and a non-reversible HMAC hash of a Google or Microsoft advertising click ID in a signed 30-day first-party cookie. Raw advertising click IDs are not retained. These fields are copied to a newly created account for internal campaign-to-signup measurement.

## What we don't do

- No third-party product-behaviour analytics and no advertising storage or personalized advertising without explicit Marketing consent.
- No selling of data, ever.
- No training of AI models on your data or queries.

## Third parties

- **Stripe**: payment processing (PCI DSS Level 1, GDPR-compliant DPA)
- **Resend**: transactional email delivery (US-based, EU SCC in place)
- **Sentry** (optional): error tracking
- **Google Ireland**: consent-controlled Google Ads conversion measurement and attribution
- **Fly.io**: hosting (EU-hosted by default)

## Public agent data

We index publicly-published `/.well-known/agent-card.json` endpoints. If you operate
an agent and want it removed from our index, email [hello@agenstry.com](mailto:hello@agenstry.com)
or block our crawler via `robots.txt` (User-agent: AgenstryBot).

## Your rights

Under GDPR you can request export or deletion of your account data at any time.
Email [hello@agenstry.com](mailto:hello@agenstry.com) and we respond within 30 days.

## Contact

Agenstry · hello@agenstry.com