AgendAI Privacy Policy
AgendAI lets you build AI assistants (“agents”), connect tools to them, and run them manually or on a schedule. This policy explains what data we handle, why, who we share it with, and how you can remove it.
Data controller: Gabriel da Silva Assunção
Contact / Data Protection Officer: contato@getagendai.com
Governing law: the controller is based in Brazil and this service is operated under Brazilian law, specifically the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018). This English version is a translation provided for convenience; the Portuguese version is the authoritative text.
1. Data we collect
Account data
| Data | Source | Why |
|---|---|---|
| Email and name | Sign-up or Google sign-in | To identify your account and let you log in |
| Password | Sign-up | Stored only as a hash (Argon2). We never store the plain password and cannot recover it |
Google identifier (google_sub) | Google sign-in | To link your account to Google sign-in. We do not access your email, contacts or files |
| Time zone | You | To run your schedules at the right time |
Content you create
| Data | Why |
|---|---|
| Agents: name, description, instructions (system prompt), model and parameters | To run the agent the way you configured it |
| Triggers and automations: schedule expressions and text templates | To fire runs at the time you set |
| MCP servers you connect: URL, name and authorization tokens | To let your agents use those tools |
| Runs: input text, agent response, intermediate steps, errors, token counts and cost | To show your history, allow auditing and calculate credit usage |
Third-party API keys (“bring your own key” mode)
If you add your own AI provider key, it is encrypted with Fernet (AES-128 in CBC mode with HMAC authentication) before being stored and is only decrypted in memory, at the moment an agent runs. It is never returned by our API, never appears in logs, and is not viewable in the interface after you save it. We also store a SHA-256 hash of the key solely to detect duplicate entries.
Notifications
If you allow notifications, we store your device's push token and platform (Android or iOS). We use this only to tell you that a scheduled run finished or that your balance ran out.
Purchases and credits
We store your credit balance, usage statement, subscription status and your RevenueCat account identifier. We never receive or store your card details — payment happens entirely inside Google Play.
What we do not collect
We do not collect location, contacts, calendar, photos, microphone, camera or advertising identifiers. AgendAI shows no ads and does no cross-app tracking.
2. How we use the data
- To authenticate you and keep your session.
- To run your agents and schedules.
- To calculate and charge credits, and to process purchases.
- To send the operational notifications you allowed.
- To investigate errors, abuse and security issues.
We do not use the content of your agents or runs to train AI models, and we do not sell data to third parties.
3. Who we share it with
We share only what the service needs to work:
| Who | What they receive |
|---|---|
| AI model providers (DeepSeek, and depending on your configuration OpenAI, Anthropic or another provider you choose) | The agent's instructions, the input text and tool results — this is what allows the agent to answer. |
| MCP servers you connect | Whatever the agent sends them during a run. You choose these servers and third parties operate them: read each one's privacy policy before connecting. |
| Expo (push service) | The device token and the notification text. |
| RevenueCat | Your account identifier, to validate purchases with the store. |
| Google Play | Processes the payment. We receive only the purchase confirmation. |
| Google Sign-In | Used only to verify your identity at login, if you choose that option. |
| Oracle Cloud and Cloudflare | Hosting and network traffic for our API. |
We may also disclose data where required by law or by order of a competent authority.
4. International transfers
Our AI and infrastructure providers operate servers outside Brazil. When you use AgendAI, your run data may be processed in those countries, under the contractual safeguards of each provider.
5. How long we keep it
- Account and content (agents, automations, keys): for as long as your account exists.
- Run history: for as long as your account exists, so you can review it.
- Purchase records and credit statement: kept even after account deletion, de-identified where possible, for the period required by tax law.
- Notification tokens: until you turn off notifications or uninstall the app.
6. Your rights
Under the LGPD (Law 13.709/2018) you have the right to confirm that processing takes place, access your data, correct incomplete or outdated data, request anonymization or deletion, request portability, withdraw consent, and object to processing based on legitimate interest.
To exercise any of these, write to contato@getagendai.com. We respond within 15 days.
7. Deleting your account
You can request deletion of your account and all associated data at any time. Instructions are at getagendai.com/en/delete-account.
8. Security
- All traffic between the app and the API uses HTTPS.
- Passwords are stored only as Argon2 hashes.
- Third-party API keys and OAuth tokens are encrypted at rest.
- Production secrets live in a managed vault, outside the code and the application images.
No system is fully immune. If we identify an incident that could pose a relevant risk to you, we will notify you and the Brazilian data protection authority (ANPD) as required by law.
9. Children
AgendAI is not intended for children under 13 and we do not knowingly collect their data. If we learn of such an account, it will be removed.
10. Changes
We may update this policy. Material changes will be announced in the app or by email before they take effect, and the date at the top of this page always reflects the current version.