Privacy Policy

Who is responsible for what

Account data. For the data about you as a user (your account, billing and usage), Artificial Agent LLC is the controller.

Workspace content. Transcripts, notes, documents and files that a company stores in its brain belong to that company (the "Customer"). We process that content only on the Customer's behalf and instructions, as a processor ("encargado del tratamiento"). Questions about personal data inside a company's content should go to that company first; we will help them answer. A data processing agreement is available on request.

Privacy questions and requests: support@agentui.ai. We answer in English or Spanish.

Data we collect

Account data. Email address, first and last name if provided, and a password stored only as a one-way hash.

Workspace data. The company name, its members and their roles (owner, admin, member), and pending invitations (the invited email address and who sent it).

Workspace content. Text and files members or their connected AI assistants add: call and meeting transcripts, notes, emails, documents, spreadsheets and presentations, with metadata such as title, type, date, people involved, tags and who added it. Transcripts and documents often contain personal data about third parties (for example customers on a call); the Customer is responsible for having a lawful basis to store it.

Search index. To make content searchable we extract its text and split it into indexed passages stored with the workspace.

Billing data. Plan, number of seats, subscription status and Stripe customer and subscription identifiers. Card details are entered on Stripe's pages and never reach our servers.

Usage and technical data. Storage and download counters per workspace, IP address, browser information and request logs used for security, debugging and abuse prevention.

We do not run advertising or analytics trackers in Company Brain.

How we use data and our legal bases

Providing the Service (contract). Creating accounts and workspaces, storing and indexing content, letting members and their assistants search and read it, invitations, plan limits and support.

Billing (contract; legal obligation). Per-seat subscriptions through Stripe, and the records tax law requires.

Security (legitimate interests). Protecting workspaces, preventing abuse and enforcing our Terms.

Service emails (contract). Invitations, password resets and essential notices.

We never use workspace content to train AI models, never sell personal data, and only access a workspace's content when its owner or admin asks us to for support or the law requires it.

Who can see workspace content

Each company's brain is isolated: only its members can read it, and only through their own account. Admins and owners manage members and can delete content; members can delete what they added.

When a member connects an AI assistant (such as Claude, ChatGPT, Cursor or VS Code) and signs in, that assistant can search and read the workspace on the member's behalf. Content the assistant retrieves is sent to that assistant's provider at the member's direction, and the provider's own terms and privacy policy apply to their copy.

People outside the team can upload a file through a one-time upload link a member shares; they cannot see anything else.

Service providers

We share data only with providers that process it for us under contracts requiring them to protect it:

• AgentUI platform — hosting, database, authentication, file storage, serverless functions and email delivery.
• Amazon Web Services (United States) — encrypted file storage, infrastructure and text extraction from scanned documents.
• Stripe — payments and subscriptions.

We may disclose data when required by law, to protect rights and safety, or in a merger or acquisition, in which case this policy keeps applying.

How long we keep data

• Workspace content: until a member deletes it, an admin removes it, or the workspace is closed; then removed from active systems within 30 days, and from backups in the normal backup cycle.
• Accounts: while active; deleted within 30 days of a deletion request, unless the law requires us to keep something.
• Invitations and upload links: they expire (7 days and up to 7 days respectively); their records stay with the workspace history.
• Billing records: as long as tax and accounting laws require.
• Logs: for a limited security and debugging period.

Security

Data is encrypted in transit (HTTPS) and at rest. Workspaces are isolated by per-workspace access rules; roles are enforced on our servers; passwords are hashed; invitation and upload links are single-use, expiring secrets. No system is perfectly secure; if a breach affects personal data we will notify affected customers and authorities as the law requires.

International transfers

The Service runs in the United States. Transfers from the EU, UK and Switzerland rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or other lawful mechanisms. Users in Latin America consent to this transfer by using the Service, which applies the same safeguards.

Your rights

Depending on where you live you may access, correct, export or delete your data, object to or restrict processing, withdraw consent, and complain to a data protection authority. Rights over workspace content are handled together with the Customer that controls it.

European Union and United Kingdom. GDPR and UK GDPR rights, including complaining to your supervisory authority (in the UK, the ICO).

California and other U.S. states. We collect the categories listed above for the purposes listed above; we do not sell or share personal information and do not knowingly collect data from consumers under 16.

Colombia. Under Ley 1581 de 2012 you may know, update, rectify and delete your data, request proof of authorization, revoke it, and complain to the Superintendencia de Industria y Comercio after contacting us.

Brazil and Mexico. LGPD article 18 rights and ARCO rights (access, rectification, cancellation, opposition).

To exercise a right, email support@agentui.ai from your account's address. We answer within the legal deadline (generally 30 days).

Children

Company Brain is a business tool for people 16 and older. We do not knowingly collect children's data.

Changes

We will update the date above and, for material changes, notify workspace owners by email before they take effect.

Contact

Artificial Agent LLC — support@agentui.ai