Privacy Policy
Last updated: October 15, 2026
At myAgents, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use, and share your information as described in this Privacy Policy.
Your use of myAgents's Services is at all times subject to our Terms of Service, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms.
Key points:
- We do not allow our AI model providers (including Anthropic, OpenAI, and Google) to use your Personal Data to train their AI models.
- We may use De-Identified Data derived from your usage to improve our own Services. You may opt out at any time by emailing privacy@myagents.ca.
- We store your Personal Data on Neon (PostgreSQL) servers. All Personal Data is encrypted at rest (AES-256) and in transit (TLS). We implement VPC isolation, least-privilege access controls, and signed webhooks to protect your Personal Data.
As we continually improve our Services, we may need to change this Privacy Policy from time to time. We will alert you of material changes by placing a notice on the myAgents website and/or by sending you an email. If you use the Services after any changes have been posted, that means you agree to all of the changes.
What this Privacy Policy Covers
This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules, or regulations. This Privacy Policy does not cover the practices of companies we do not own or control or people we do not manage.
Personal Data
Categories of Personal Data We Collect
This chart details the categories of Personal Data that we collect and may have collected over the past 12 months.
| Category | Examples of Personal Data We Collect | Third Parties With Whom We Share This Data |
|---|---|---|
| Profile or Contact Data |
|
|
| Payment Data |
|
|
| Device / IP Data |
|
|
| Web Analytics |
|
|
| Organization & Team Data |
|
|
| Agent & Workspace Content |
|
|
| Usage & Billing Data |
|
|
| Third-Party Integration Data |
|
|
| AI-Derived Data |
|
|
| Other Identifying Information You Voluntarily Provide |
|
|
Categories of Sources of Personal Data
You: when you provide information directly:
- When you create an account or use our interactive tools and Services.
- When you configure agents, create work items, or send messages to agents through the Services.
- When you connect third-party services (Google Calendar, WhatsApp Business, GitHub).
- When you send us an email or otherwise contact us.
You: when information is collected automatically:
- Through cookies and similar technologies (defined in the "Cookies" section below).
- Through Vercel Analytics when you interact with the Services.
- Through Sentry error reporting (configured without PII, request bodies, headers, IPs, and cookies are excluded).
- When your agents execute tasks, usage, duration, and cost are logged automatically to support billing and your in-app analytics.
Third Parties:
- Authentication provider (Stack Auth): When you sign up or log in, your email address and authentication identifier are transmitted to us.
- Connected services: When you authorize a Google Calendar, WhatsApp Business, or GitHub connection, data from those services is transmitted to myAgents to fulfill agent tasks on your behalf.
Our Commercial or Business Purposes for Collecting or Disclosing Personal Data
Providing, Customizing and Improving the Services
- Creating and managing your account and organization profile.
- Processing payments and managing your subscription and credit balance.
- Running your agents and fulfilling the tasks and workflows you configure.
- Powering agent memory via semantic embeddings over your workspace content.
- Providing support and assistance for the Services.
- Improving the Services, including testing, research, internal analytics, and product development. We do not allow our AI model providers (Anthropic, OpenAI, Google) to use your Personal Data to train their AI models.
- Fraud protection, security monitoring, and debugging.
Marketing the Services
- Marketing and selling the Services.
Corresponding with You
- Responding to correspondence we receive from you and contacting you when necessary.
- Sending transactional emails such as low-balance alerts, team invitations, and authentication messages.
Other Permitted Purposes for Processing Personal Data
Each category of Personal Data above may also be collected, used, and disclosed to meet legal requirements and enforce legal terms, including: fulfilling our obligations under applicable law, regulation, or court order; preventing or investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property, or safety of you, myAgents, or another party; enforcing agreements with you; and resolving disputes.
De-Identified Data
We may create de-identified, anonymized data ("De-Identified Data") from the Personal Data we collect so that it does not identify you. We may use such De-Identified Data for our lawful business purposes, including to analyze, build, and improve the Services and to promote our business. We do not sell De-Identified Data to advertising networks or use it to target you with third-party advertising. To opt out, email us at privacy@myagents.ca.
We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Google User Data
When you connect a Google account (Gmail, Calendar, Drive, Tasks, or Business Profile), you authorize myAgents to access specific data in that account. You choose the permission level, you can see it on the connections page at any time, and you can lower it or disconnect the account whenever you want.
Gmail permission levels
Gmail connections start read-only. You can raise the level from the connections page, and each level is requested from Google separately so you always see exactly what you are approving:
- Read only (
gmail.readonly): agents search and read messages so they can find bills, deadlines, receipts, and renewals. They cannot send, change, or delete anything. - Read and send (adds
gmail.send): agents can additionally send email from your account. They still cannot change or delete anything already in your mailbox. - Full mailbox (
gmail.modify): agents can additionally save drafts to your Drafts folder and move messages to Trash. Messages moved to Trash stay recoverable in Gmail for 30 days.
We never request the https://mail.google.com/ scope, so myAgents cannot permanently delete your email. Nothing an agent does to your mailbox is irreversible except sending, which only happens when you have asked for or approved the message.
Limited Use
myAgents' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we do not:
- transfer or sell Google user data to third parties, other than the AI model providers listed below that process it solely to carry out the task your agent is running, and service providers (hosting, error monitoring) acting on our instructions;
- use Google user data for advertising, or to build advertising profiles;
- use Google user data to train generalized or general-purpose AI or machine learning models. As stated above, we do not allow our AI model providers to use your Personal Data to train their models;
- allow humans to read Google user data, except with your explicit consent for a specific issue you raise with support, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and de-identified.
Retention and deletion
Message content read by an agent is used to complete the task at hand and to produce the work item, delivery, or reply that the task generates. Disconnecting a Google account deletes the stored OAuth tokens for that connection and immediately ends our access to the account. You can also revoke access directly from your Google account's security settings.
Connected AI Assistants
You can connect an AI assistant you already use, such as Claude, ChatGPT, Gemini, or Meta Muse, to your myAgents account through our connector (an MCP server). The assistant then acts as you, with your permissions, inside the teams you belong to. This section explains what that connection can see and do, what we receive, how long we keep it, and who is responsible for what.
What a connected assistant can see and do
You choose the scope when you connect. A read connection can see everything you can see in the teams you belong to: your teams and agents, each agent's skill instructions, your work board and schedules, deliveries and run traces, conversations and messages, the records in your team's collections, ideas, feedback, and usage and spend. It can also answer product questions and propose a team for you to approve in the app. A read and act connection can additionally do what a member can do: create and assign work, comment on work, change a work item's status, abort or retry a run, message agents and post to conversations, attach files to a task, log or manage ideas, start and continue Studio design chats, add a fact to your team's shared context, and file product feedback. The exact tool list is published to the assistant the moment it connects, so you can ask it to show you what it can do. Every call is checked against your role on the named team, so a connected assistant can never do more than you could do yourself in the app. No connection can create a delivery: a delivery is produced only by an agent run that generated real output.
What we receive and how we use it
When a connected assistant calls the connector, we receive the content of that call: the request, any text or files it attaches to a task, and the identity of the token it used. We use this only to carry out the request in your account, to secure the connector (rate limits, abuse prevention), and to keep a record of actions that changed something. That record is written on a best-effort basis after the action completes: a logging failure never blocks or undoes your request, so an occasional action may be missing from it. The work items, comments, and status changes themselves are always attributed in your account. We do not use connector data for advertising, and we do not allow our AI model providers to train on it. Content an assistant creates in your account (a work item, a comment, an attachment) is treated exactly like content you create in the app and is covered by the rest of this policy.
What we send back to the assistant (for example, a delivery it reads on your behalf) is then held by that assistant's provider under the provider's own privacy policy. Connect the assistants you trust, and use a read-only connection where you only want a window into your team.
Retention and revocation
Connector tokens are stored as one-way hashes; we never store the token itself. You can revoke any token at any time from your team settings, and a revoked token stops working immediately. We keep a record of each revoked token (its hash, which cannot be used, its label, and when it was last used) so you and we can see what was connected; that record is deleted with your account. Revoking a token ends the assistant's access but does not delete the work it created in your account, because that work is yours: delete individual items, teams, or your whole account whenever you choose, and the usual deletion rules in this policy apply. Audit records of connector actions (which tool was called, by which account, and when) are retained while your account is active; when you delete your account they are detached from you and your email address is removed from them, leaving an anonymous count of activity.
Who is responsible for what
For data processed through a connected assistant, myAgents and the assistant's provider each act as an independent controller of the data they hold. We are responsible for what happens inside your myAgents account; the provider is responsible for what happens inside the assistant. If we become aware of a security incident affecting data received through a connector, we will notify you as described under Security, and we will also notify the assistant's provider where its platform terms require it.
AI Model Providers
myAgents uses the following third-party AI providers to power agent inference, content generation, and memory. When your agents run, the relevant inputs (your prompts, conversation history, workspace context, and any connected service data your agent accesses) are sent to these providers as necessary to fulfill the task.
- Anthropic (Claude models): Primary provider for all conversational agent inference. Anthropic's API terms prohibit them from training their models on API customer data by default.
- OpenAI (image generation, text-to-speech, embeddings): Used to generate images on your agents' behalf (gpt-image-1), synthesize audio (text-to-speech), and produce semantic embeddings for agent memory (text-embedding-3-small). OpenAI's API terms prohibit them from training on API customer data by default.
- Google (Gemini models): Used as an alternative provider for AI-powered image generation (gemini-2.5-flash). Google's API terms apply to data processed through their APIs.
We do not instruct any AI provider to use your Personal Data to train their models. We recommend reviewing each provider's privacy policy and data processing terms for further details.
How We May Disclose Your Personal Data
Service Providers: these parties help us provide the Services or perform business functions on our behalf:
- Neon: database hosting (PostgreSQL; AES-256 encryption at rest; TLS in transit; U.S.-based servers)
- Vercel: application hosting, serverless functions, edge delivery, and analytics
- Stack Auth: user authentication and account management
- Stripe, Inc.: payment processing. Full card details are handled entirely by Stripe; we store only a customer reference identifier and the card last-4 and brand for display.
- Resend: transactional email delivery
- Sentry: error monitoring (configured without PII)
- Upstash: ephemeral rate-limiting cache
- Anthropic, OpenAI, Google: AI model inference and content generation
Parties You Authorize, Access or Authenticate:
- Organizations through which you access our Services (such as your employer).
- Third-party services you connect to myAgents (Google Calendar, WhatsApp Business, GitHub).
- AI assistants you connect to your account through our connector (such as Claude, ChatGPT, Gemini, or Meta Muse), which receive the results of the requests you make through them. See Connected AI Assistants above.
- Other members of your myAgents organization.
Organizational Email Notice: If you create a personal account using an email address provisioned by an employer or organization, that organization may request disclosure of the email address associated with your account. myAgents will not transfer your other account information or content without your consent.
Legal Obligations: We may share Personal Data with government authorities or other parties to meet legal requirements as described above.
Business Transfers: All Personal Data we collect may be transferred to a third party in the event of a merger, acquisition, bankruptcy, or other transaction in which that third party assumes control of our business. We will make reasonable efforts to notify you before your information becomes subject to different privacy and security practices.
Cookies
The Services use cookies and similar technologies (collectively, "Cookies") to enable our servers to recognize your browser, tell us how and when you visit and use our Services, analyze trends, and operate and improve our Services.
- Essential Cookies: required for features or services you have requested, such as logging into secure areas. Disabling these may make certain features unavailable.
- Functional Cookies: used to record your settings and preferences and recognize you when you return.
- Performance / Analytical Cookies: allow us to understand how visitors use our Services (pages viewed, session duration, feature engagement) to improve the product.
Analytics and advertising cookies. We use Google Analytics and Google Ads cookies to understand which pages and ads bring people to the Services. We also keep a campaign cookie that remembers which ad, campaign or website brought you, so we can count sign-ups by channel. If you visit from the European Economic Area, the United Kingdom, Switzerland or Quebec, these cookies and the campaign cookie stay off until you accept them in our cookie banner. Until then Google's tag still loads but sets no cookies; it sends Google only cookieless signals, which Google uses to estimate results in aggregate. Elsewhere analytics and advertising cookies are on by default.
Meta ads. We do not put Meta's pixel or any other Meta script on our pages, so Meta does not see which pages you visit or anything you type. When you arrive from an ad on Facebook or Instagram, Meta adds a click id to the link. Under the same cookie choice as above, we keep that click id in a cookie of our own for up to 90 days. If you then create an account, our servers tell Meta (Meta Platforms, Inc.) that the click led to a sign-up, with the click id, your IP address, your browser's user agent and a one-way code derived from your account (so a repeated report is not counted twice; it does not reveal who you are), so Meta can match it to the ad and measure and improve our campaigns. Meta may also use it to decide who sees our ads. We do not send your name, email, or anything about how you use the Services. If you did not come from a Meta ad, no sign-up is reported to Meta.
Anyone can change their choice at any time with "Cookie settings" at the bottom of our public pages or here: . Choosing Reject removes the Google cookies already set in your browser, our campaign cookie and the Meta click id cookie (so no sign-up is reported to Meta), and stops us sending your account's activity to Google Analytics from our servers (right away if you are signed in, otherwise the next time you sign in on that browser). We keep a Reject for about 13 months and an Accept for 6 months.
Referral links. When you open a friend's referral link, we set a separate referral cookie holding their referral code, so they get credit if you sign up. It is set only because you followed that link, and it is not covered by the choice above.
You can manage or disable Cookies through your browser settings. For more information, visit allaboutcookies.org.
Data Storage and Security
We store your Personal Data on Neon (PostgreSQL) servers. All Personal Data is encrypted at rest (AES-256) and in transit (TLS). Third-party integration tokens are additionally encrypted at the application level. We implement additional security measures including VPC isolation, least-privilege access controls, audited support access to customer accounts, HMAC-signed OAuth state tokens, and signed Stripe webhooks.
Our infrastructure and AI providers process and store data in the United States. Where Canadian privacy law applies to you, your data may be processed outside Canada and may be subject to the laws of the jurisdictions where it is processed. We protect it through the contractual and technical safeguards described in this policy wherever it is processed.
If we become aware of a breach of our security safeguards affecting your Personal Data, we will notify affected customers without unreasonable delay. Where the affected data belongs to a health care customer's workspace, we will notify that customer at the first reasonable opportunity so they can meet their own notification duties.
Although we work to protect the security of your data, please be aware that no method of transmitting or storing data is completely secure.
Data Retention
We retain Personal Data for as long as necessary to provide our Services or perform our commercial purposes for collecting it.
- Profile and account data: retained for as long as you have an active account.
- Team and workspace content: retained while your account is active. When a team is deleted, all associated content is immediately and irrecoverably removed.
- Payment and financial ledger data: retained for billing, audit, and tax compliance.
- Usage records (token consumption, cost logs): retained to support billing and in-app analytics.
- Device / IP and web analytics data: retained as long as needed to ensure the Services function properly.
- Third-party integration tokens: retained until you disconnect the integration or delete your account.
- Connector tokens and audit records (for connected AI assistants): active and revoked token records are retained until you delete your account; audit records of connector actions are retained while your account is active and anonymized (detached from you, email removed) when you delete it.
Personal Data of Children
We do not knowingly collect or solicit Personal Data from children under 16 years of age. If we learn we have collected Personal Data from a child under 16, we will delete it as quickly as possible. Please contact us at privacy@myagents.ca if you believe a child under 16 may have provided us with Personal Data.
State Law Privacy Rights
California Resident Rights
Under California Civil Code Sections 1798.83–1798.84, California residents may contact us to prevent disclosure of Personal Data to third parties for direct marketing purposes. We do not knowingly make any such disclosures.
Nevada Resident Rights
If you are a Nevada resident, you have the right to opt out of the sale of certain Personal Data to third parties. We do not currently sell your Personal Data as defined by Nevada Revised Statutes Chapter 603A.
Canadian Privacy Rights
PIPEDA
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws give you the right to access the Personal Data we hold about you, to challenge its accuracy, and to have it corrected. You can exercise these rights by contacting us at privacy@myagents.ca. You also have the right to complain to the Office of the Privacy Commissioner of Canada.
Health Information (PHIPA and similar laws)
Some of our customers are health care practitioners or clinics. In Ontario, those customers are health information custodians under the Personal Health Information Protection Act, 2004 (PHIPA).myAgents is not a custodian. When a custodian uses myAgents in their practice, we act as their electronic service provider.
In that role, we use personal health information only as necessary to provide the Services to that customer. We do not use it for our own purposes, we do not sell it, and we do not permit our employees or contractors to access it except as needed to operate and support the Services, and support access to customer workspaces is audited. If we become aware that personal health information in a custodian's workspace was accessed, used, or disclosed without authority, we will notify that customer at the first reasonable opportunity so they can meet their own duties.
If you are a patient or client of one of our customers, your health care provider remains responsible for your health information. Please direct requests to access or correct that information to your provider.
European Union, United Kingdom, and Swiss Data Subject Rights
If you are a resident of the EU, UK, Liechtenstein, Norway, or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation ("GDPR").
myAgents will be the controller of your Personal Data processed in connection with the Services.
Lawful bases for processing:
- Contractual Necessity: Profile / Contact Data, Payment Data, Organization & Team Data, Agent & Workspace Content, Third-Party Integration Data, Usage & Billing Data, necessary to provide the Services.
- Legitimate Interest: Device / IP Data, Web Analytics, AI-Derived Data, error monitoring, to operate, secure, improve, and market the Services.
- Consent: Where expressly indicated at the point of collection (e.g. connecting a third-party integration).
- Legal Obligation: Where required by applicable law or regulation.
Data Subject Rights: to submit a request, email privacy@myagents.ca with subject "GDPR Request: [nature of request]":
- Access: request a copy of the Personal Data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: delete your account via Settings → Account → Delete Account; delete individual teams from team settings; for other requests email privacy@myagents.ca.
- Portability: export workspace data (agents, work items, conversations) in JSON via Settings → Export / Import.
- Objection: object to further use or disclosure of your Personal Data for certain purposes.
- Restriction of Processing: request that we restrict further processing.
- Withdrawal of Consent: withdraw consent at any time; this may limit certain features.
- Right to File Complaint: lodge a complaint with your supervisory authority at edpb.europa.eu.
Transfers of Personal Data: Our Services are hosted in the U.S. By using our Services, you acknowledge that your Personal Data will be transferred to and processed in the U.S. In some circumstances, transfers may be made pursuant to a data processing agreement incorporating standard data protection clauses.
Contact Information
If you have any questions or comments about this Privacy Policy, please contact us at:
myOS Inc.
privacy@myagents.ca