Privacy Policy

1. Information We Collect

We may collect the following categories of information:

• Account & Identity Data: Name, email address, company name, and role when you register or contact us.
• Usage & Interaction Data: Prompts, queries, agent actions, session logs, and outputs generated through the platform.
• Technical Data: IP address, browser type, device identifiers, operating system, referral URLs, and access timestamps collected automatically via logs and cookies.
• Integration Credentials: OAuth tokens or API keys you provide to connect third-party services (stored encrypted; never read in plaintext by our staff).
• Communications: Emails, support tickets, and feedback you send to us.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Service and its agentic capabilities.
• Authenticate users and secure access to accounts.
• Process and execute agent workflows on your behalf.
• Monitor platform performance, detect abuse, and ensure security.
• Communicate with you about updates, incidents, or support requests.
• Comply with applicable legal obligations.

We do not sell your personal data to third parties, and we do not use your data to train AI models without your explicit written consent.

3. Google User Data

If you choose to connect your Google account, Agentic requests only the permissions needed to run the tasks you configure. You grant each permission explicitly during the Google consent screen, and you can revoke them at any time from your Google Account permissions page.

• Gmail: to read and classify incoming email, apply labels, and draft replies for your review. Agentic never sends email without your explicit approval.
• Google Calendar: to read availability and create, update or cancel events when you ask an agent to schedule a meeting.
• Google Drive: to read the documents and folders you choose yourself in Google's own file picker, and to write back the summaries and extracted data your agents produce. Agentic cannot browse or list your Drive: it has no access to any file until you pick it.
• Google Sheets: to read and update only the spreadsheets you choose yourself in Google's own file picker. Agentic cannot browse or list your Drive: it has no access to any file until you pick it, and no way to learn that the rest exist.
• Connections made before this change: if you connected Google Drive or Google Sheets earlier, that broader permission stays in place until you reconnect. It is used only to list your files and their metadata so you can choose one, and to follow the folders you asked an agent to watch.

Agentic's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide and improve the features you have explicitly requested; we do not transfer it to third parties except as needed to provide those features, for security purposes, or to comply with applicable law; we do not use it for advertising; we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymized; and we do not use it to train generalized AI models. Google user data is deleted when you disconnect the integration or delete your account, following the terms in Section 7 (Data Retention).

4. AI Assistant Connectors (MCP)

You can connect Agentic to an AI assistant such as Claude (by Anthropic) or ChatGPT (by OpenAI) through our connector. You authorize it once on our sign-in and consent screen, where you choose which account to connect and what the assistant may do. The assistant never receives your password.

• What the connector can access: only the account you connected, within the permissions you granted — your agents and their configuration, squads, workflows and channels, inbox conversations and the contact details shown in them, quality and governance data, and usage and cost metrics. Deleting data through the connector is off unless you explicitly allow it on the consent screen.
• How we use it: only to carry out the requests you make through the assistant. For each request we record which action ran, when, from which assistant and whether it succeeded, together with a fingerprint (hash) of its parameters — never the content of messages or results.
• Who receives it: the results of each request are sent to the assistant you connected, which processes them under its own privacy policy (Anthropic or OpenAI). The connector adds no other recipients; it runs on the same infrastructure providers described in Section 6.
• No sale, no training: we do not sell data accessed through the connector, and we do not use it to train AI models.
• Access credentials: access tokens expire after 30 minutes. Refresh tokens are stored only as a hash and expire after 30 days or as soon as access is revoked.
• Revoking access: revoke it from Settings → Security → Connected apps in Agentic, remove the connector in your assistant's settings, or write to [email protected] and we will revoke its credentials on our side. If you are removed from the connected account, the connector stops working there immediately.
• Sensitive data: the connector is not designed for health information, payment card data, government identification numbers, or passwords and other credentials. If your account handles that kind of data — for example, patient conversations — do not use the connector to read those conversations.

5. Legal Bases for Processing (GDPR / Colombian Law 1581)

Where applicable, we process your personal data under the following legal bases:

• Performance of a contract: Processing necessary to deliver the Service you have requested.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement.
• Consent: For optional features such as analytics or marketing communications, where we request your explicit consent.
• Legal obligation: Where we are required to process data by law.

6. Sharing of Information

We may share your information with:

• Service providers: Cloud hosting, database, and infrastructure vendors operating under strict data processing agreements (e.g., AWS, Google Cloud).
• AI model providers: Third-party AI APIs (such as Anthropic) that process inputs on behalf of the Service. These providers operate under their own privacy policies and do not retain your data for model training without consent.
• Legal authorities: When required by valid legal process, court order, or to protect the rights and safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction with appropriate notice.

We do not share personal data with advertisers or data brokers.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Interaction logs and agent session data are retained for a maximum of 12 months unless a shorter period is requested by you or required by law. After account deletion or a verified data deletion request, your personal data is permanently removed within 30 days, except where retention is required by applicable law.

8. Cookies & Tracking Technologies

We use essential cookies required for authentication and session management. We may use analytics cookies (with your consent) to understand how users interact with the Service. You can manage cookie preferences through your browser settings or our in-platform consent banner.

9. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, access controls, and regular security reviews. No system is completely secure; we encourage you to use strong, unique passwords and to report any suspected security issues to [email protected].

10. International Data Transfers

Asisteme AI operates across Colombia and the United States. Your data may be transferred to and processed in servers located in either jurisdiction. For users in the European Economic Area, such transfers are subject to appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms).

11. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (see our Data Deletion page).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

12. Children's Privacy

The Service is intended for business users and is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-platform notice at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.