Privacy policy

Last updated: 2026-05-23. This is a working draft pending legal review.

What we store

• Identity: your principal id, display name, email (when invited).
• Memory: context packets you save or your AI tools capture on your behalf (URLs, page titles, conversation summaries, knowledge references).
• Audit: a record of every authenticated API call (principal, action, timestamp, status).
• Usage: token counts and bytes-stored per call, for cost metering.
• Auth: bearer tokens (sha256-hashed at rest) and their expiration.

What we don't store

• Passwords, payment card numbers, or any field marked type=password.
• Cookies for analytics, advertising, or third-party tracking.
• Page content from your browsing — only URLs + titles (Tier 2) unless you explicitly enable full content capture (Tier 3, enterprise only).

How long we keep it

Each memory packet has a per-org retention window (default 365 days). You can request earlier deletion at any time via DELETE /v1/me or by emailing privacy@agentiam.io. Audit events are retained for compliance per your org's policy.

Where we keep it

Currently us-east only (AWS / Railway). EU regional residency is on the roadmap.

Who else sees it

Your AI tools — Claude Desktop, ChatGPT, Cursor, Vaii agents — read your memory only when you authorize them via the Vaii Connector flow. We share data with sub-processors we use to run the service:

• OpenAI — for memory embeddings (text-embedding-3-small).
• Anthropic — for agent planning and reasoning (Claude).
• Railway / AWS — for hosting and Postgres.
• Brevo — for transactional email (invites, password resets).

Your rights

• Access / export: GET /v1/me/export returns everything we have on you as JSON.
• Deletion: DELETE /v1/me hard-deletes your personal data; audit records are retained per compliance requirements with PII scrubbed.
• Correction: edit memory packets directly via the admin UI.
• Portability: the export is machine-readable JSON.

Contact

Email privacy@agentiam.io.