1. Who We Are and What This Covers
AgentTrail, Inc. ("AgentTrail," "we") provides an observability and governance platform for AI coding agents. This policy explains how we handle personal information when you visit agenttrail.sh, contact us, create an account, or otherwise interact with us. For that information we are the "controller" (or "business").
This policy does not govern the agent session data our customers send to the Service. For that data we act as a processor on our customer's behalf; see Section 6.
2. Information We Collect
| Category | Examples | Source |
|---|---|---|
| Account and contact | Name, work email, organization name, your password (stored only as a one-way hash), and your account identifier if you sign in with Google or GitHub | You |
| Contact and demo requests | Email, team size, and the message you send through our contact or demo forms | You |
| Billing | Billing name and address, plan, invoices. Card details are collected and stored by our payment processor, Stripe, not by us | You and Stripe |
| Device and CLI | Device authorization records, CLI version, operating system, IP address | Automatically |
| Usage | Pages requested, features used, timestamps, error reports | Automatically |
| Business contact data | Work contact and company details for sales outreach | Public sources and data vendors |
We do not ask for sensitive personal information such as government IDs, health data, or precise geolocation.
3. How We Use Information
We use the information above to:
- create and operate your account and provide the Service;
- process payments;
- send service, security, and billing notices;
- respond to support requests and to messages you send us;
- send product updates and marketing, which you can opt out of at any time;
- secure the Service, prevent abuse, and debug problems;
- understand usage so we can improve the product; and
- comply with law.
We do not sell personal information. We do not use it for cross-context behavioral advertising. We do not use it to train machine learning models.
4. Legal Bases (EEA and UK)
Where GDPR or UK GDPR applies, we rely on the following legal bases:
- Contract: to provide the Service and process payments.
- Legitimate interests: for security, product improvement, and B2B marketing to work contacts.
- Consent: where the law requires it, and you may withdraw consent at any time.
- Legal obligation: for tax, accounting, and legal requests.
5. How We Share Information
We share personal information only with:
- Service providers that act on our instructions, such as hosting, email, payments, sign-in, error monitoring, and our CRM. They are bound by contract to protect the data. The providers that handle customer data, and exactly what each receives, are listed on our subprocessors page.
- Your organization, if your account is part of a team workspace. Workspace admins can see your account details and activity in that workspace.
- Professional advisers such as lawyers and accountants, under confidentiality obligations.
- Authorities, when required by law or to protect rights, safety, and security.
- A successor, in a merger, acquisition, or asset sale. We will give notice before information becomes subject to a different privacy policy.
6. Customer Data We Process for Customers
When a customer connects AI agents to AgentTrail, the Service receives session data such as prompts, tool calls, commands, file paths, code, and outputs. That data may contain personal information about the customer's employees or others.
We process that data only on the customer's instructions, under our Terms of Service and Data Processing Addendum. We never use it to train models. If your information appears in a customer's data, contact that customer directly. We will help them respond.
7. Cookies and Analytics
We use only cookies that are needed to run the site and Service: a sign-in cookie that keeps you logged in, a short-lived security cookie used while you connect an integration such as Slack, and a preference cookie that remembers whether the dashboard sidebar is open. Your browser's local storage keeps display preferences, such as light or dark mode. We do not currently use any third-party analytics tool on our website. If we add one, we will choose a cookieless option that does not track you across other sites, and we will update this policy.
Our website loads its fonts from Google Fonts, so Google receives your IP address and browser details when you visit. Our contact and demo forms send what you type into them to HubSpot, our CRM, directly from your browser.
We do not use advertising or cross-site tracking cookies. If that changes, we will update this policy and ask for consent where the law requires it. You can block cookies in your browser, but the Service may not work without essential cookies.
8. Retention
| Data | How long we keep it |
|---|---|
| Account data | For as long as your account is active. When you ask us to close your account, we delete it within 30 days of the request |
| Contact and demo requests | As long as needed to respond and follow up, or until you ask us to delete them |
| Billing records | As long as tax and accounting law requires (typically 7 years) |
| Security and access logs | Application logs for 30 days; web firewall logs for 90 days |
Copies in our automated database backups expire within 30 days after deletion. We may keep information longer where needed to resolve disputes or comply with law.
9. Security
We use administrative, technical, and physical safeguards appropriate to the data. These include TLS encryption for connections to our web application and API, encryption at rest for our databases and file storage, role-based access controls, and logging. No system is perfectly secure. If you believe your account has been compromised, contact security@agenttrail.sh. Our Security & Trust page describes these measures in more detail.
10. International Transfers and EEA/UK Rights
We are based in the United States, and we store data in the United States, in Amazon Web Services' US East (N. Virginia) region. When we transfer personal information from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, or on another lawful transfer mechanism.
If GDPR or UK GDPR applies to you, you have the right to:
- access, correct, or delete your personal information;
- restrict or object to its processing;
- receive a portable copy of it; and
- withdraw consent where we rely on it.
You may also complain to your local data protection authority.
11. U.S. State Privacy Rights
Depending on where you live, including California, Colorado, Connecticut, Virginia, and other states with comparable laws, you may have the right to:
- know what personal information we hold about you;
- access, correct, or delete it; and
- opt out of sale, sharing for targeted advertising, or profiling.
We do not sell or share personal information for targeted advertising, and we do not engage in such profiling. We will not discriminate against you for exercising your rights. You may use an authorized agent, and we may verify your identity and the agent's authority before acting on a request.
In the past 12 months we collected the categories of personal information listed in Section 2, for the purposes listed in Section 3. We disclosed them only to the recipients listed in Section 5.
12. Children
The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.
13. Changes to This Policy
We will post updates here and change the "Last updated" date. For material changes, we will notify account holders by email or in the Service before the changes take effect.
14. Contact
To exercise your rights or ask questions, email privacy@agenttrail.sh or write to AgentTrail, Inc., 420 Jackson Avenue, Dunellen, NJ 08812. We respond within the time limits the law sets, generally 30 to 45 days.