Privacy and data controls

Operator and contact

Operator: Operator identity pending confirmation. Privacy contact: privacy@agentify.ad.

Data we process

• Submitted and canonical target URL, target host/hash, segment, and scan status.
• Structured check outcomes, score, coverage, and rubric version.
• When passive browser observation is enabled: sanitized finding codes and aggregate counts/timings. Raw page content, screenshots, cookies, console messages, accessibility trees, and provider run IDs are not retained in reports.
• Hashed network rate keys; raw IP addresses are not stored.
• Email, international phone, role, and registration choices only when the contact form is submitted. Email and phone are encrypted with separate lookup HMAC domains; phone is contact data and is not treated as verified.
• Signing in creates an account and session record. Google sign-in also retains Google's issuer and stable account identifier, linked to your account email. Google profile names and pictures are not retained, and Google access, refresh and ID tokens are not stored in our database or cookies.
• Your privacy choices. Visit and funnel events, such as a page view, a scan or a registration, and the campaign tags of the link you arrived by, only if you allow product analytics or ads measurement. Two reports do not depend on these choices: telling the ad tracker that a click on one of our ads led to a registration, and later that the store set up from that registration published its first product; the next item and the section on processors describe them. Nor does the seller dashboard's product analytics, which the item after it describes.
• If you arrive at sign-in from one of our ads, the identifier the ad tracker gave that click: with the sign-in link you then ask for, or with the Google sign-in you then start, and, if that is the first time you sign in with your address, with your account until the report of the registration has been made or given up, and a second copy, for the report of your store's first product, for at most 30 days.
• Product analytics from the seller dashboard, where a deployment is set to send them: the dashboard's server records events about what happens in the dashboard and to its merchants' orders, and sends each one to Nuanu Analytics. An event says what happened: a dashboard screen shown, a sign-in and how it ended, a merchant created, a setup step and its outcome, a product card published, sales paused or resumed, a problem that stopped an action, an order created, the result of its payment, and the outcome of the order. It names the account, the merchant, a card, an order, a payment attempt or an operation only by a reference, a keyed one-way hash from which the identifier cannot be read back, and marks an account as the one that acted only where its person did. It never carries a name, an email address, a wallet, a key, a shop or delivery address, the content of a card or an order, or the text of an error. An amount goes only with a payment observed as paid: the amount paid and its currency, which is US dollars or USDC. The events leave from our server, not from your browser: the dashboard runs no analytics script for them and sets no cookie for them.

Purpose and choices

Essential processing is used to perform the requested scan, prevent abuse, and keep the private result available. Product analytics, ads measurement, dataset reuse, and marketing email are independent choices. Declining an optional category does not turn it into essential processing. If you allow neither product analytics nor ads measurement, no visit or funnel events and no campaign tags are recorded for you; the reports to the ad tracker of a registration from our ad and of its store's first product, described under processors, are apart from these choices. So is the seller dashboard's product analytics: it does not follow the choices made in the privacy banner, and is stopped for each account by the product analytics switch in the dashboard's Settings. Once it is turned off, no event that names that account or the merchant it belongs to is sent, whoever acted, a buyer's agent included, and the events naming them still waiting to be sent are dropped, apart from one already on its way at that moment. A sign-in page shown to somebody not signed in, and a sign-in that did not succeed, name no account, so the switch does not reach them.

Private and public results

Progress and teaser require the scan capability. A full report requires verified authorization. A public share does not exist until explicit publish, and its immutable snapshot contains only domain, score, level, scale, and date. It can be revoked.

Processors and optional services

The architecture supports private Postgres storage and in-process Better Auth with Resend for passwordless confirmation, optional Google sign-in, PostHog for the product analytics the privacy banner offers, Nuanu Analytics, an analytics service run by Nuanu, for the seller dashboard's product analytics described above, Meta Pixel/CAPI for consented ads measurement, and Cloudflare Turnstile for abuse challenges. Choosing Google takes your browser to Google to authenticate; we do not request access to your mailbox, Drive or other Google services. When you arrive at sign-in from one of our ads, AI Samurai, the ad tracker our ads run through, is told that this click led to a registration, by the click's identifier alone. Nothing else about you leaves: not your email address, nor anything else about your account. It does not depend on your privacy choices, and it happens only once: when the sign-in you start from the ad is the first time you sign in with your address, whether by an emailed link or with Google. If the store you then set up publishes its first product within 30 days of that sign-in, AI Samurai is told that too, once, by the same identifier alone; nothing about you or the store goes with it, and it does not depend on your privacy choices either. AI Samurai passes both reports on to Meta, where our ads run, with what it recorded itself when the ad was clicked; we send it nothing but the identifier. Each copy of the identifier is then erased, as the retention section says. Apify acts as the isolated processor for optional passive public-page rendering; the API token is worker-only, the Actor is private and build-pinned, and output storage is deleted after validated ingestion. Provider adapters and destinations are disabled until configured; local success is not evidence of production delivery.

Retention

• Operational logs: 14 days, without email, raw IP, secrets, or full URL query.
• Expired or used registration intents: the executable retention cleanup removes them 7 days after they were used or expired.
• Unverified email: the same idempotent cleanup irreversibly anonymizes it after 30 days by default.
• Ad click identifier from sign-up: kept with the sign-in link, which works for an hour, until the link is used, or, if it never is, cleared from 7 days after the link expired; kept with a Google sign-in, which may take ten minutes, until your return from Google uses it up, or, if that never happens, cleared from 7 days after those ten minutes. If that is the first time you sign in with your address, it is kept with your account until the tracker accepts or refuses the report of the registration or a day of attempts has passed, and is then erased. A second copy, for the report of your store's first product, is kept with your account for at most 30 days from that sign-in: it is erased once that report is accepted or refused or a day of attempts has passed, or once the report can no longer be made, and when the 30 days end at the latest. What stays with your account, until the account is deleted, is a record of whether each report went through and when. Otherwise nothing about the click is kept once you sign in.
• Raw analytics events: 13 months.
• Seller dashboard analytics events in our database: an event not sent within 7 days is dropped unsent, as is every event recorded where a deployment is not set to send them, and every event is deleted 30 days after it was sent, dropped or refused. How long Nuanu Analytics keeps the events it receives is not stated here.
• Structured scan and check dataset: 24 months, then review or anonymization.

Access, deletion, and correction

Use the data-request route for access, correction, unsubscribe, or verified deletion. Deletion closes report access, revokes public shares, and removes or irreversibly anonymizes lead, waitlist, analytics-delivery, and owned-scan identifiers. The sign-in for your address is removed with them unless it holds a seller dashboard. Deidentified score, coverage, check status, and coarse technical metrics may remain under the stated scan-dataset retention, but the original URL, host, access capability, share snapshot, and session join are removed from the retained scan record.