Privacy Policy

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules, or regulations. This Privacy Policy does not cover the practices of companies we do not own or control or people we do not manage.

We may create de-identified, anonymized data ("De-Identified Data") from the Personal Data we collect so that it does not identify you. We may use such De-Identified Data for our lawful business purposes, including to analyze, build, and improve the Services and to promote our business. We do not sell De-Identified Data to advertising networks or use it to target you with third-party advertising. To opt out, email us at privacy@myagents.ca.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated, or incompatible purposes without providing you notice.

myAgents uses the following third-party AI providers to power agent inference, content generation, and memory. When your agents run, the relevant inputs — your prompts, conversation history, workspace context, and any connected service data your agent accesses — are sent to these providers as necessary to fulfill the task.

• Anthropic (Claude models)— Primary provider for all conversational agent inference. Anthropic's API terms prohibit them from training their models on API customer data by default.
• OpenAI (image generation, text-to-speech, embeddings) — Used to generate images on your agents' behalf (gpt-image-1), synthesize audio (text-to-speech), and produce semantic embeddings for agent memory (text-embedding-3-small). OpenAI's API terms prohibit them from training on API customer data by default.
• Google (Gemini models)— Used as an alternative provider for AI-powered image generation (gemini-2.5-flash). Google's API terms apply to data processed through their APIs.

We do not instruct any AI provider to use your Personal Data to train their models. We recommend reviewing each provider's privacy policy and data processing terms for further details.

Service Providers — these parties help us provide the Services or perform business functions on our behalf:

• Neon — database hosting (PostgreSQL; AES-256 encryption at rest; TLS in transit; U.S.-based servers)
• Vercel — application hosting, serverless functions, edge delivery, and analytics
• Stack Auth — user authentication and account management
• Stripe, Inc. — payment processing. Full card details are handled entirely by Stripe; we store only a customer reference identifier and the card last-4 and brand for display.
• Resend — transactional email delivery
• Sentry — error monitoring (configured without PII)
• Upstash — ephemeral rate-limiting cache
• Anthropic, OpenAI, Google — AI model inference and content generation

Parties You Authorize, Access or Authenticate:

• Organizations through which you access our Services (such as your employer).
• Third-party services you connect to myAgents (Google Calendar, WhatsApp Business, GitHub).
• Other members of your myAgents organization.

Organizational Email Notice: If you create a personal account using an email address provisioned by an employer or organization, that organization may request disclosure of the email address associated with your account. myAgents will not transfer your other account information or content without your consent.

Legal Obligations: We may share Personal Data with government authorities or other parties to meet legal requirements as described above.

Business Transfers: All Personal Data we collect may be transferred to a third party in the event of a merger, acquisition, bankruptcy, or other transaction in which that third party assumes control of our business. We will make reasonable efforts to notify you before your information becomes subject to different privacy and security practices.

The Services use cookies and similar technologies (collectively, "Cookies") to enable our servers to recognize your browser, tell us how and when you visit and use our Services, analyze trends, and operate and improve our Services.

• Essential Cookies — required for features or services you have requested, such as logging into secure areas. Disabling these may make certain features unavailable.
• Functional Cookies — used to record your settings and preferences and recognize you when you return.
• Performance / Analytical Cookies — allow us to understand how visitors use our Services (pages viewed, session duration, feature engagement) to improve the product.

You can manage or disable Cookies through your browser settings. For more information, visit allaboutcookies.org.

We store your Personal Data on Neon (PostgreSQL) servers. All Personal Data is encrypted at rest (AES-256) and in transit (TLS). We implement additional security measures including VPC isolation, least-privilege access controls, HMAC-signed OAuth state tokens, and signed Stripe webhooks.

Although we work to protect the security of your data, please be aware that no method of transmitting or storing data is completely secure.

We retain Personal Data for as long as necessary to provide our Services or perform our commercial purposes for collecting it.

• Profile and account data — retained for as long as you have an active account.
• Team and workspace content — retained while your account is active. When a team is deleted, all associated content is immediately and irrecoverably removed.
• Payment and financial ledger data — retained for billing, audit, and tax compliance.
• Usage records (token consumption, cost logs) — retained to support billing and in-app analytics.
• Device / IP and web analytics data — retained as long as needed to ensure the Services function properly.
• Third-party integration tokens — retained until you disconnect the integration or delete your account.

We do not knowingly collect or solicit Personal Data from children under 16 years of age. If we learn we have collected Personal Data from a child under 16, we will delete it as quickly as possible. Please contact us at privacy@myagents.ca if you believe a child under 16 may have provided us with Personal Data.

If you are a resident of the EU, UK, Liechtenstein, Norway, or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation ("GDPR").

myAgents will be the controller of your Personal Data processed in connection with the Services.

Lawful bases for processing:

• Contractual Necessity:Profile / Contact Data, Payment Data, Organization & Team Data, Agent & Workspace Content, Third-Party Integration Data, Usage & Billing Data — necessary to provide the Services.
• Legitimate Interest: Device / IP Data, Web Analytics, AI-Derived Data, error monitoring — to operate, secure, improve, and market the Services.
• Consent: Where expressly indicated at the point of collection (e.g. connecting a third-party integration).
• Legal Obligation: Where required by applicable law or regulation.

Data Subject Rights — to submit a request, email privacy@myagents.ca with subject "GDPR Request: [nature of request]":

• Access — request a copy of the Personal Data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — delete your account via Settings → Account → Delete Account; delete individual teams from team settings; for other requests email privacy@myagents.ca.
• Portability — export workspace data (agents, work items, conversations) in JSON via Settings → Export / Import.
• Objection — object to further use or disclosure of your Personal Data for certain purposes.
• Restriction of Processing — request that we restrict further processing.
• Withdrawal of Consent — withdraw consent at any time; this may limit certain features.
• Right to File Complaint — lodge a complaint with your supervisory authority at edpb.europa.eu.

Transfers of Personal Data: Our Services are hosted in the U.S. By using our Services, you acknowledge that your Personal Data will be transferred to and processed in the U.S. In some circumstances, transfers may be made pursuant to a data processing agreement incorporating standard data protection clauses.

If you have any questions or comments about this Privacy Policy, please contact us at:

myOS Inc.
privacy@myagents.ca