Privacy Policy

1. Data controller

The data controller (responsable de traitement) is Hurter Design Studio, publisher of agorch.io, identified in our Legal notice.

Privacy contact: [email protected].

2. Categories of personal data

Depending on how you use the Service, we may process:

• Account data — name, email address, profile picture, and email verification status received from Google when you sign in with Google; OAuth provider identifiers linked to your account; role
• Billing data — wallet balance, credit ledger entries, Stripe customer and payment method identifiers, invoice details and payment status (card details are processed by Stripe and are not stored on our servers)
• Service content — chat messages, agent configurations, MCP connection settings and tokens you provide, tool run inputs/outputs stored in your workspace
• Technical data — IP address, browser/device information, security and application logs
• Communication data — emails or support requests you send us
• Analytics data — pseudonymous usage metrics via Google Analytics 4 when you have opted in (see cookies section)

We do not intentionally collect special categories of data (Art. 9 GDPR). Please avoid submitting sensitive personal data in chats unless necessary for your use case.

3. Purposes and legal bases

• Authenticate you via Google Sign-In and create or manage your account — Art. 6(1)(b) GDPR (contract)
• Create and manage your account, and provide orchestration, chat, and agent features — Art. 6(1)(b) GDPR (contract)
• Operate, secure, and debug the Service (logs, abuse prevention, availability) — Art. 6(1)(f) GDPR (legitimate interests)
• Comply with legal obligations (accounting, responding to lawful requests) — Art. 6(1)(c) GDPR
• Non-essential cookies / optional analytics (Google Analytics 4) — Art. 6(1)(a) GDPR (consent), where required

4. Recipients and subprocessors

Data may be accessed by authorized staff of the controller and by technical subprocessors strictly necessary to run the Service, for example:

• Hosting and edge delivery (e.g. Vercel)
• Database and storage providers
• Authentication (Google LLC — Google Sign-In / OAuth) when you choose to sign in with Google
• Email delivery providers
• AI model / inference providers used to generate responses
• Payment processing (Stripe) for credit purchases and auto-refill
• Audience measurement: Google LLC (Google Analytics 4), only when you have given analytics consent

We do not sell personal data.

When you connect a third-party agent or MCP server, content you send may be transmitted to that provider under your instructions. Those providers act according to their own terms and privacy policies; we are not responsible for their independent processing.

5. Google Sign-In

If you sign in with Google, we receive from Google the profile information needed to authenticate you and operate your account (typically your name, email address, profile picture, and whether your email is verified). We use this data only to identify you, secure your account, and provide the Service. We do not receive your Google password. We do not sell Google user data. Google processes your data under its own terms; see Google's Privacy Policy.

6. International transfers

Some subprocessors may process data outside the European Economic Area (EEA), including the United States (for example Vercel, Google Sign-In, and, when analytics consent is granted, Google Analytics). Where such transfers occur, we rely on appropriate safeguards under Chapter V of the GDPR, including the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, additional measures.

7. Retention

• Account data — for the life of the account, then a limited period for security, dispute, or legal requirements
• Chats and workspace content — until you delete them or close your account, unless longer retention is required by law
• Security / technical logs — for a limited period proportionate to security and operational needs
• Billing records — for the statutory retention periods under French commercial and tax law (when applicable)
• Cookie consent choice — about 6 months, after which we ask again
• Analytics cookies — at most 13 months when consent is granted

8. Your rights

Under the GDPR, you may request:

• Access to your personal data
• Rectification of inaccurate data
• Erasure (“right to be forgotten”), where applicable
• Restriction of processing
• Objection to processing based on legitimate interests
• Data portability, where applicable
• Withdrawal of consent at any time (without affecting prior lawful processing)

To exercise these rights, email [email protected]. We respond within the GDPR time limits (generally one month). You may also request account deletion; we will delete or anonymize personal data that is no longer required by law.

You may lodge a complaint with the CNIL: www.cnil.fr.

9. Security

We implement appropriate technical and organizational measures under Article 32 GDPR (access controls, encryption in transit where applicable, least-privilege access, and operational monitoring). No system is perfectly secure; you remain responsible for the security of your Google account and the sensitivity of data you submit.

10. Cookies and similar technologies

We use strictly necessary cookies or similar storage (for example Auth.js session and CSRF cookies, and storage of your cookie preferences) that do not require prior consent under French and EU ePrivacy rules (Article 82 of the French Data Protection Act).

Non-essential cookies are used only with your prior consent (Art. 6(1)(a) GDPR), collected via our cookie banner (Accept all / Reject all / Customize). Continuing to browse without a choice is treated as a refusal of non-essential cookies.

• Necessary — authentication, security, and remembering your cookie choices (retained about 6 months before we ask again).
• Analytics — optional Google Analytics 4 (Google LLC). Measurement cookies (_ga, _ga_*) last at most 13 months and are set only after you opt in. Google signals and ad personalization signals are disabled in our configuration.

When analytics consent is granted, limited usage data may be processed by Google LLC in the United States under appropriate GDPR Chapter V safeguards (including Standard Contractual Clauses). See Google’s Privacy Policy.

You may withdraw or change your consent at any time via the floating cookie icon on public pages, via Cookie preferences in your account menu when signed in, or by clearing site data in your browser. Refusing or withdrawing analytics consent deletes analytics cookies we can control on your device. Full category and cookie details are listed in the cookie preference panel.

11. Minors

The Service is not directed at children under 15 (or the higher age of digital consent applicable in your EU Member State). If you believe a minor has provided us personal data, contact [email protected] so we can take appropriate action.

12. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest revision. Material changes may be communicated via the Service or by email when appropriate.

13. Related documents

Legal notice · Terms and Conditions