Privacy policy.

This Privacy Policy describes how Agenthub ("Agenthub", "we", "us" or "our") collects, uses and shares personal information when you visit www.agenthb.ai, contact us, or use the Agenthub platform.

1. When this policy does not apply — customer data

When your employer or organisation uses the Agenthub platform, the content your organisation and its agents process ("Customer Data") is controlled by that organisation. We process Customer Data as a processor on their behalf, under a data-processing agreement — not under this policy. Questions about Customer Data belong with your organisation's administrator.

One exception, so nothing is left unsaid: data we obtain from an account you connect yourself — including Google user data — is described in section 4, and that section applies whether we act as a controller or as a processor for your organisation.

2. Personal information we collect

We collect:

• Contact information you give us — for example when you email us or book a demo: name, email address, company, and the content of your message.
• Account information when your organisation sets you up on the platform: name, work email, role, and sign-in identifiers from your identity provider.
• Usage and log data from the platform: actions taken, timestamps, device and browser information, and IP addresses — the same audit trail the product shows your organisation.
• Connected-account data from services you link to the platform yourself — Google Workspace, Microsoft 365, Slack, GitHub and others — accessed only with your authorisation and only for the features you enable. Google user data is described in full in section 4.
• Website data: our marketing website sets no cookies and runs no third-party analytics. Standard server logs (IP address, requested page, user agent) are retained briefly for security and operations.

3. How and why we use personal information

• To provide and operate the platform, including authentication, audit logging and support (performance of contract).
• To respond when you contact us, and to arrange demos (legitimate interests).
• To secure our services: abuse prevention, incident investigation, access logging (legitimate interests / legal obligation).
• To improve our services using aggregate, de-identified usage information (legitimate interests).
• To meet legal obligations, such as accounting and tax record-keeping (legal obligation).

We do not sell personal information, and we do not use it for third-party advertising.

4. Google user data

Agenthub lets you connect your own Google account so that agents you or your organisation configure can do work in it on your instruction. Access is granted through Google OAuth, one Google product at a time, one user at a time. We access nothing until you complete Google's consent screen, and you can withdraw that consent at any time (see 4.6).

4.1 What Google user data we access

We request only the scopes needed for the tools each integration ships. When you connect a product, the data below becomes accessible to Agenthub:

If you enable a trigger — for example "when a message arrives in this Gmail label" or "when this Drive file changes" — Agenthub polls the relevant Google API on a schedule while the trigger is switched on, using the same scopes, so it can detect the event and start the agent run you configured.

4.2 How we use Google user data

We use Google user data only to provide and improve the user-facing features you have enabled: executing the tool calls an agent makes, evaluating the triggers you switch on, and showing you what the agent did in run history and the audit log. We do not use Google user data for advertising or marketing, to build profiles, for credit-worthiness or lending purposes, and we do not sell it.

4.3 How we store and protect Google user data

OAuth access and refresh tokens are encrypted at rest and are scoped to the individual user, organisation and connection they belong to. Google user data an agent reads or writes during a run is stored in your organisation's run history and audit log so that its work stays inspectable and reversible. All of it is hosted in the European Union, encrypted in transit with TLS 1.2+ and at rest with AES-256. Further detail is on our security page.

4.4 How we share Google user data

We never sell Google user data. We transfer it only:

• to the infrastructure providers in Annex A, under contract, strictly to operate the features you use;
• to the AI model provider your organisation has enabled for that agent, for inference only — so the model can produce the agent's next step. Providers are contractually barred from training on it or retaining it for their own purposes;
• to a destination you direct, when an agent you configured acts — for example sending an email you asked it to send;
• where necessary for security purposes, or to comply with applicable law or enforceable governmental requests.

We do not transfer Google user data to third parties for any other purpose.

4.5 Limited Use, and no training of AI/ML models

Agenthub's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use data obtained through Google Workspace APIs to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models, and we do not transfer it to others for that purpose. Google user data reaches a model only as part of the specific agent run you requested, to produce that run's output for you.

People at Agenthub do not read your Google user data, except: with your explicit consent (for example when you share a run with us for support); where necessary for security purposes, such as investigating abuse or a suspected incident; to comply with applicable law; or where the data has been aggregated and de-identified for internal operations. Support access to a workspace requires your approval and is logged.

4.6 Retention, deletion and withdrawing access

• Disconnect at any time — in Agenthub, open Integrations and disconnect the account. We revoke and remove the stored tokens and the connection, so we can no longer reach your Google data. We also ask Google to revoke the authorisation itself, so access ends on Google's side and Agenthub leaves your account's connected-apps list — except where another connection is still using that authorisation. Connecting Gmail and Drive from one Google account shares a single authorisation, and revoking it would disconnect both, so we leave it standing until the last of them is disconnected. That check is a good-faith one, not a guarantee: it can miss a case, and Google may be unreachable at that moment. If you want certainty that access has ended, use the Google control below — it is authoritative and takes effect immediately.
• Revoke at Google — you can withdraw access from your Google account directly at any time, at myaccount.google.com/permissions. This works whether or not you disconnect in Agenthub, and it stops all access immediately.
• Data already in your workspace — Google user data an agent read or wrote is kept in your organisation's run history and audit log under the retention rules in section 7, and is deleted with the rest of your organisation's data on request or at the end of your agreement.
• Deletion on request — write to hello@agenthb.ai and we will delete the Google user data we hold about you, subject only to what the law requires us to keep.

If we ever want to access a type of Google user data we have not disclosed here, we will update this policy and ask for your consent before doing so.

5. How we share personal information

We share personal information only with the service providers that run our infrastructure (listed in Annex A), with professional advisers where necessary, and with authorities where the law requires it. Providers act under contracts that restrict their use of the data to providing their service to us.

6. International transfers

We are based in the European Union and host customer data in the EU. Where a service provider processes limited data outside the EU/EEA, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

7. Retention

We keep personal information only as long as needed for the purposes above: contact enquiries for up to 24 months after our last exchange; account and audit information for the life of your organisation's agreement plus a documented deletion schedule; server logs for a short, fixed window.

8. Your rights

Under the GDPR you can ask us for access, correction, deletion, restriction, portability, and to object to processing based on legitimate interests. Write to hello@agenthb.ai and we will respond within a month. You may also lodge a complaint with your local supervisory authority.

9. Cookies

The marketing website (www.agenthb.ai) sets no cookies. The platform (hub.agenthb.ai) sets strictly necessary cookies for sign-in and session security only.

10. Security

How we protect data — encryption, access control, EU residency, testing — is documented on our security page.

11. Children

Our services are for businesses and are not directed to children under 16.

12. Changes to this policy

When we change this policy we update the date at the top; for material changes affecting platform users we notify your organisation's administrators.

13. Controller and contact

Agenthub is the controller for the processing described in this policy. Contact: hello@agenthb.ai.

Annex A — subprocessors