legal · privacy
Privacy Policy
Version 2026-10-21, last updated 21 October 2026. Plain language where we can, exact where it matters.
Draft. This document is not in force yet: 14 placeholders are still to be filled in (highlighted). It stays out of search engines until they are.
The short version: we keep your account details and your requests so the team can work for you; your store credentials are encrypted; we do not ask for your shoppers’ data or orders; your requests are sent to an AI provider to run the agents; we use no advertising or tracking cookies; and you can ask us to access or delete your data at any time.
1. Who is responsible for your data
[Company legal name] , of [Registered address] , decides why and how your personal data is used and is the controller of it (in Turkish law the “data controller”, veri sorumlusu). Contact us about anything in this policy at [contact email] .
2. What we collect
| Data | What it is | Where it comes from |
|---|---|---|
| Account | Name, email address, a hash of your password (never the password itself), workspace name, your role, and your notification preference | You, when you sign up or are invited |
| Your requests | The messages you write, files and images you attach, the briefs, designs, code and content the agents produce, review results, approvals, and the case files you export | You, and the agents working for you |
| Store connection | The address of your store, the permissions granted, and the credentials of the private app you create (stored encrypted); the GitHub installation and repository you choose | You |
| Store information the agents read | Theme files; the store’s plan, currency, markets and languages; counts, titles, handles and status of products and collections; or the files of a repository you connect. We do not request access to customers or orders | Your store or repository, through the access you grant |
| Plan and usage | Your plan, its status and renewal date, and how much model usage you have consumed. We receive your email and a customer and subscription reference from the payment provider; we do not receive your card number | You and the payment provider |
| Technical | IP address and browser details in server logs; counters that limit abuse (for example password-reset requests from one address); the sign-in session | Your device, automatically |
We do not knowingly collect special categories of personal data and ask you not to put them in requests or files. If you put your own customers’ personal data in a request, you are responsible for having the right to do so.
3. Why we use it, and on what basis
- To provide the Service you asked for: running your account, receiving your requests, running the agents, delivering work to your store, and keeping your history (performance of a contract).
- To take payment and keep records, including tax and accounting records (contract and legal obligation).
- To keep the Service secure: preventing abuse, fraud and unauthorised access, and fixing faults (our legitimate interests).
- To email you what you need to use the Service: invitations, password resets and notices that a request needs you. You can turn the “needs you” emails off in Settings → Account. We do not send marketing email without your consent.
We do not sell your personal data, and we do not use your content to train AI models ourselves.
4. The AI providers
To run the agents we send the content of your requests, the files you attach, and the store information the agents read to our AI model provider (listed below), which processes it for us and returns the agents’ output. That is the core of the Service and cannot be switched off while you use it. How the provider handles that data is set out in its own terms and privacy policy, which we review when we choose and renew our providers.
5. Who else receives data
We use these providers to run the Service. They act on our instructions, except the payment provider, which handles payment data under its own responsibility.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Anthropic | AI model provider: runs the agents | The text and images of your requests, the store context the agents read, and the files they write | [region] |
| Vercel | Hosting | Everything that passes through the app, including server logs (IP address, browser) | [region] |
| Upstash (Redis) | Database | Accounts, workspaces, requests, attachments and encrypted store credentials | [region] |
| Resend | Transactional email | Your name and email address and the text of the emails we send you (invitations, password resets, "a request needs you") | [region] |
| Lemon Squeezy | Payments (merchant of record) | Your name, email and billing details, which you give to it directly; we receive your plan and subscription status | [region] |
| GitHub | Pull requests, only if you connect a repository | The files of a build, and the repository contents the agents read | United States |
| Shopify | Your store, only if you connect one | Your theme files, catalogue content and store settings, read and written through the private app you create | As set by Shopify |
We may also disclose data where the law requires it, or to professional advisers and in a sale of the business under the same protections.
Where a provider is outside your country, we rely on the safeguards the law recognises for such transfers (such as standard contractual clauses or an adequacy decision), as applicable.
6. How long we keep it
- While your account is open we keep your account, requests and history so you can come back to them. You can delete individual requests in the dashboard.
- When you close your account or ask us to delete your data, we delete it within [30] days, apart from what we must keep by law (for example billing records) and short-lived backups, which are overwritten on their normal cycle.
- Revoking the Shopify app or the GitHub App ends our access immediately; we delete the stored credentials when you disconnect a store or delete it from your workspace.
7. Security
The Service is served over HTTPS. Passwords are stored only as salted hashes. Store credentials are encrypted at rest. Sessions use a signed, HTTP-only cookie. Access to the data is limited to what operating the Service needs. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
8. Cookies and similar technologies
The dashboard sets one strictly necessary cookie to keep you signed in (agentify_session), and a short-lived cookie while you connect a Shopify store, to protect that connection. Your browser also remembers a few interface settings (for example whether the sidebar is collapsed and an unsent draft) in local storage on your device. We use no advertising or analytics cookies and no tracking pixels. The marketing site loads its fonts from Google Fonts, which means your browser requests them from Google and your IP address is visible to it.
9. Your rights
You can ask us to give you access to your data, correct it, delete it, restrict or object to how we use it, and give you a copy in a portable form; where we rely on your consent you can withdraw it. These are your rights under data-protection law, including the EU/UK GDPR where it applies and, in Turkey, Article 11 of the Personal Data Protection Law (KVKK, Law No. 6698). Write to [contact email] ; we will answer within the time the law sets. Any request can already be downloaded as a case file from the dashboard.
If you think we have handled your data wrongly, please tell us first. You may also complain to the authority: [data-protection authority, e.g. the Turkish Personal Data Protection Authority (KVKK) or your EU supervisory authority] .
10. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
11. Changes to this policy
We will update this policy as the Service or the law changes, and tell you about material changes at least [30] days in advance by email or in the dashboard. The date at the top shows the latest version.
12. Contact
[Company legal name] · [Registered address] · [contact email]