Privacy Policy
Effective August 23, 2026
1. Overview
AgentKey ("we", "us") provides authorization and security infrastructure for AI agents. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service, you consent to the practices described here.
2. Information we collect
Account information: name, email address, and authentication details you provide when you sign up or are invited to a workspace.
Configuration data: agent names and descriptions, API key names and prefixes (never the full key), permission policies, and approval workflow settings you create.
Authorization metadata: the action, resource, and metadata you send to the authorize endpoint for evaluation, and the resulting decision and reason. We do not require and do not recommend sending sensitive personal data in these payloads.
Usage and technical data: billing and plan usage, device/IP information, and service logs used for security, reliability, and abuse prevention.
3. How we use information
- Operate, secure, and improve the Service and enforce plan limits;
- Record append-only evidence logs of authorization decisions for your account;
- Process payments and communicate about your account;
- Detect, prevent, and respond to abuse and security incidents;
- Comply with legal obligations.
4. API keys and credentials
API keys are hashed (SHA-256) before storage; we store only a non-secret prefix for identification. We never display full keys after creation. Keep your keys private anyone with a key can make authorization requests against your account.
5. Data sharing
We do not sell your data. We share data only with service providers who help us operate (e.g. hosting, email, and payment processing) under contracts that require confidentiality and limiting use to our instructions, and when required by law. In connection with a merger, acquisition, or asset sale, information may be transferred subject to confidentiality.
6. International transfers
Your data may be processed in countries other than your own. Where applicable, we rely on appropriate safeguards to ensure a lawful transfer.
7. Data retention
We retain account and audit-log data for as long as your account is active and for a reasonable period afterward for legal, security, and accounting needs. Authorization logs are retained to support your audit and compliance obligations. You may request deletion of your account and associated data, subject to legal retention requirements.
8. Your rights
Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact hello@agentkey.com. We will respond within the time required by applicable law.
9. Security
We apply industry-standard measures including encryption in transit, hashed credentials, row-level access controls, and server-side enforcement of authorization decisions. No service is perfectly secure, and we encourage you to apply least privilege when configuring agents and permissions.
10. Children
The Service is not directed to children under 16, and we do not knowingly collect their data.
11. Changes to this policy
We may update this Privacy Policy from time to time and will indicate the effective date above. Material changes will be communicated through the Service or by email.
12. Contact
Privacy questions can be sent to hello@agentkey.com.