Privacy policy

This draft explains how agencymemory.ai handles information for the Agency Memory website and service. Contact support@agencymemory.ai about privacy, access, or deletion. The service stores client and brand context and makes it available to the agents you connect through MCP.

1. Information involved in the service

• Account and access information: account email, workspace membership and role, and MCP key holder names, optional holder emails, labels, status, and last-use information.
• Workspace content: client and brand details, Brand Knowledge, Playbooks, contacts, platform account and asset identifiers, relationships, source references, and files where storage is enabled.
• History and audit information: earlier record versions and information about changes, actors, channels, and outcomes.
• Support communications: information you choose to send to support, including your contact details and the content of your request.
• Service-operation information: technical information generated while hosting, authenticating, operating, and securing the website and application. The live providers’ logging configuration must be reflected in the final policy.

Only provide client and personal information you are entitled to share. Keep passwords, provider API secrets, and unnecessary sensitive personal information out of Brand Knowledge and support messages.

2. Why information is used

Information is used to authenticate users and MCP connections, organize workspaces, store and retrieve context, apply permissions, preserve change history, respond to support requests, and operate and protect the service. Personal data must be associated with an appropriate lawful basis for each purpose. The final policy will identify the applicable bases and any additional processing purposes.

3. Workspace members and connected agents

Owners and admins can manage the workspace through the app. Every active MCP key can read all clients, brands, and records in its workspace. Solo and Agency controls determine whether a key can also write; they do not restrict read access to a particular brand.

When you connect an agent and it retrieves information, that information is made available to the agent and its provider. Their terms and privacy settings govern their handling of that information. Review those settings before sharing client information. Agency Memory’s connection does not automatically connect advertising or analytics providers.

4. Service providers and data processing

The application uses managed infrastructure for hosting, authentication, databases, and optional file storage. The code is configured for Supabase authentication and storage, with deployment documentation describing Google Cloud Run and Cloudflare Pages. The final provider list, purposes, and processing locations must be checked against the live deployment before this draft becomes effective.

Where agencymemory.ai processes personal data on a customer’s instructions, the applicable processing agreement must define those responsibilities. An agency remains responsible for its authority to provide client data and for the agents and external services it chooses to connect.

5. Retention, archiving, and deletion

The service preserves version history and audit records. Archiving a client, brand, or platform resource changes its active status while retaining its history; it is not permanent deletion.

Contact support to request access, correction, export, or deletion. Requests may require identity or workspace-authority checks. Retention periods or criteria for accounts, workspace content, versions, audit records, support messages, service logs, and backups must be confirmed in the final policy, including what remains after account closure and for how long.

6. Processing locations and international transfers

The final policy must identify the relevant processing locations and any international transfers, together with their applicable legal arrangements. This draft does not represent that a particular data region or transfer safeguard has been verified.

7. Access and security

The application authenticates MCP requests, stores a hash of each MCP key rather than a recoverable secret, checks write permissions server-side, and uses temporary signed links for brand files where storage is enabled. These controls do not replace careful access decisions or guarantee absolute security. See data and agent access for the product’s access model.

8. Browser storage and website services

The app uses browser local storage to persist authentication sessions and refresh them. Signing out ends the current app session. The marketing site currently includes no analytics or advertising trackers in its source; its stylesheet loads Inter through Google Fonts, which causes the browser to contact Google’s font services. Hosting services may also receive technical request information.

Any future analytics, marketing tools, or optional cookies must be reflected in this policy, with the appropriate choices and consent controls where required.

9. Your rights and requests

Depending on applicable law, you may have rights to access, correct, erase, receive a copy of, restrict, or object to processing of your personal data, and to withdraw consent where processing relies on it. You may also have the right to complain to a competent supervisory authority. Contact support@agencymemory.ai to make a request.

10. Updates

The final policy will state its effective date and how material changes will be communicated. This version is a review draft and must be completed against the actual service operation before publication as an effective policy.