Legal
Privacy Policy
Last updated: October 7, 2026
Ajentify is a platform for building and running AI agents. Agents only work if you trust us with the data that flows through them, so this page spells out what we collect, what we do with it, who else sees it, and how you get rid of it.
Overview
Ajentify is operated by Ajentify, Inc. ("Ajentify", "we", "us"). This policy covers the Ajentify platform at ajentify.com, the API at api.ajentify.com, and our SDKs and client libraries.
Three things hold throughout:
- Your data is yours. We store it to run your agents and bill you for usage. Nothing else.
- We do not train AI models.Not on your data, not on anyone's. We only route your agents to model providers whose terms prohibit training on API traffic.
- We do not sell data or share it with advertisers, data brokers, or analytics vendors.
We are the data controller for the account and billing information you give us directly, and a processor for the content your agents handle on your behalf. If you build a product on Ajentify for your own users, you are responsible for your own privacy disclosures to them.
What we collect
Account information
Your name and email address when you sign up. If you sign in with Google or Microsoft we receive your name, email address, and profile picture from that provider and nothing more. We never see your password for those accounts.
Content you create on the platform
Everything below is scoped to your organization:
- Agents: prompts, the model you picked, tool lists, voice settings.
- Tools, integrations, and MCP connections: tool definitions, any custom tool code you write, and the OAuth tokens needed to call services you connect.
- Contexts: the message history of each conversation, including tool calls and the results that come back from connected services.
- Documents, data windows, and structured outputs: memory and schemas you store for agents to read and write.
Usage and billing
Token counts, model used, timestamps, and your transaction history. Payments are handled by Stripe; we never see or store your card number.
Server logs
Request metadata (timestamps, endpoint, status, request IDs, error messages) for debugging, security, and abuse prevention. Logs are kept for 30 days. We run no third-party analytics or advertising trackers on the platform.
How we use it
We use the data above to:
- run your agents: send conversations to the model you selected, execute tools, and store the results so the agent has continuity;
- authenticate you and keep one organization's data separate from another's;
- meter usage and bill you;
- keep the service secure and fix things when they break;
- email you about your account (sign-in codes, invitations, billing, incidents).
We do not use your content for advertising, profiling, market research, or to build datasets. We do not read it, except with your permission for a specific support request, to investigate abuse, or where the law requires.
AI model providers
Ajentify does not run its own models. When an agent takes a turn, the system prompt, conversation, tool definitions, and tool results are sent over TLS to the provider hosting the model you selected, and the reply is streamed back. That is a real-time inference call; the provider does not keep the data to train on.
We only offer models from providers whose commercial API terms prohibit training on customer inputs and outputs. Today that is:
| Provider | Training on API data | Retention |
|---|---|---|
| OpenAI | Not used to train or improve models unless the customer opts in. We have not opted in. | Abuse-monitoring logs up to 30 days, then deleted. |
| Anthropic | Commercial Terms: “Anthropic may not train models on Customer Content from Services.” | Inputs and outputs deleted within 30 days. |
We call each provider's API directly from our servers using open-source client libraries. There is no aggregator, gateway, or model hub in between, and we do not use any hosted tracing or observability service, so prompts and completions go to the model provider and nowhere else. We have not opted in to any data-sharing or "improve the model" program with any provider.
If we add a provider in future, it will be held to the same standard: a contractual commitment not to train on API traffic. You choose which provider sees a given agent's data by choosing its model.
Connected services
Agents become useful when they can act on your behalf in the tools you already use. You can connect an agent to a service such as Google Workspace, Microsoft 365, Atlassian Jira, or any server that speaks the Model Context Protocol (MCP). Connecting always goes through that service's own sign-in and consent screen, which shows you exactly which permissions are being requested.
The same rules apply to every connected service:
- Nothing is accessed until you connect it, and afterwards only what the tools you enabled on an agent need.
- Data is fetched on demand when a tool runs. We do not sync, mirror, index, or cache your mailbox, calendar, files, or tickets.
- Tool results live in the conversation context and are sent to your selected model provider so the agent can decide what to do next. That is the full extent of where the data goes.
- OAuth tokens are stored encrypted, scoped to your organization, and deleted when you disconnect the service, delete your organization, or revoke access from the provider's side.
- Connected-service data is never used to train models, sold, or used for advertising, by us or by the model providers we route it to.
Each service is also governed by its provider's own terms and privacy policy.
Google services
Google asks apps that access Google user data to describe that access specifically, so this section does. Everything in Connected services applies here too.
What Google user data we access
Signing in with Google gives us your name, email address, and profile picture (the openid, email, and profile scopes). Beyond that, Google data is only accessed if you connect a Google Workspace service to an agent:
| Service | What an agent can access |
|---|---|
| Gmail | Messages and threads (headers, body, labels, read state), drafts, and labels. Tools can search and read mail, create and send drafts and messages, apply labels, archive, and trash. |
| Google Calendar | Your calendars, events (title, time, attendees, description, location), and free/busy availability. Tools can list, search, create, update, delete, and respond to events. |
| Google Drive, Docs, Sheets, Slides | Metadata and contents of files the agent searches for or you point it at. Tools can search, read, create, copy, and update files. |
| Google Chat | Spaces, memberships, messages, and read state. Tools can read conversations and send messages. |
| Google Contacts | Your contacts and your organization’s directory. |
The exact permissions for a connection are listed on Google's consent screen when you connect, and you can review or revoke them at any time from your Google Account permissions.
How we use it
Only to carry out the actions you, or the user of an agent you built, ask the agent to perform. When an agent calls a Google tool we fetch the result with the token you granted, add it to the conversation context, and send the conversation to the model you selected so it can produce the next reply. Google user data is not used for advertising, analytics, profiling, resale, credit decisions, or to build or improve any AI or machine-learning model, and we do not aggregate it across customers or derive datasets from it.
How we store and share it
Tokens and tool results are stored encrypted at rest in our database, scoped to your organization, and deleted as described in Retention and deletion. Google user data is shared with exactly one kind of third party: the AI model provider you selected, for real-time inference. Those providers are bound by terms that prohibit training on it. It is never transferred to anyone else, and never sold. Humans at Ajentify do not read it, except with your explicit permission for a support request, to investigate abuse, or where required by law.
Limited Use
Ajentify's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.
Retention and deletion
We keep data for as long as it takes to provide the service to you, and no longer.
| Data | Kept until |
|---|---|
| Conversation contexts, including tool results from connected services | You delete the context or its TTL expires. Contexts accept an optional ttl_days; contexts for public agents expire after 30 days by default. |
| Connected-service OAuth tokens | You disconnect the service, delete your organization, or revoke access at the provider. |
| Agents, tools, documents, data windows, structured outputs | You delete them or delete your organization. |
| Account and billing records | You delete your account, except transaction records we must keep for tax and accounting law. |
| Server logs | 30 days. |
| At model providers | OpenAI: up to 30 days of abuse-monitoring logs. Anthropic: deleted within 30 days. |
Deleting your organization or account removes everything above from our systems. Disconnecting a service stops access immediately and deletes its tokens; results already captured in conversation contexts remain until those contexts are deleted or expire, which you can do at any time.
Security
- All traffic uses TLS 1.2 or higher.
- All data at rest, including tokens and conversation contexts, is encrypted with AWS-managed encryption.
- Every resource belongs to an organization and every request is authorized against it. One customer cannot reach another's data.
- Sessions use short-lived signed tokens. API keys can be rotated or revoked from the dashboard at any time.
- Provider API keys live in AWS Secrets Manager. OAuth credentials and connected-service tokens stay server-side and are never sent to the browser.
- Infrastructure runs on AWS in the Asia-Pacific (Melbourne) region. Model providers process inference in their own regions.
- Production access is limited to the people who operate the service.
No system is perfectly secure. If we learn of a breach affecting your data we will tell you without undue delay.
Your controls and rights
Wherever you live, you can access, export, correct, and delete your data. Most of it is self-serve:
| To | Do this |
|---|---|
| Delete a conversation | DELETE /context/{context_id}, or delete it in the dashboard. |
| Auto-expire conversations | Set ttl_days when creating a context. |
| Delete an agent and everything it owns | DELETE /agent/{agent_id} |
| Disconnect a service | Delete the connection or integration in the dashboard, or revoke Ajentify from the provider’s account settings. |
| Choose which AI provider sees an agent’s data | Set the agent’s model. |
| Export your data | Every resource is readable as JSON through the API. |
| Delete your account or organization | From your account or organization page in the dashboard. |
If you are in the EEA, UK, or somewhere with similar law, you can also object to or restrict processing and complain to your local supervisory authority. Email us and we will help.
Children
Ajentify is a developer platform and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us data, contact us and we will delete it.
Changes
We will update this page as the product changes. The date at the top always reflects the current version. If we materially change how we handle personal data, we will email active customers before it takes effect.
Contact
Questions or requests about this policy or your data: email keanu@ajentify.com.
Looking for developer documentation? See the API docs.