Privacy notice
Personal data deserves a narrow purpose.
Effective August 24, 2026. This notice describes the intended production behavior of Privacy Agent. A public launch must name the operating legal entity and final support contact before accepting real accounts.
What we collect
We collect a verified email address, identifiers you choose to place in the encrypted identity vault, jurisdiction information, authorizations, source observations, removal-case events, and security logs needed to operate and protect the service. We do not ask for identity documents unless a specific source requires them, and those steps remain visible user checkpoints.
Why we use it
We use account and identity information only to discover likely public matches, prepare or send privacy requests you authorize, monitor outcomes, produce private reports, prevent abuse, and meet legal obligations. We do not sell personal data, build advertising profiles, or use private case data to train general-purpose models.
How automation works
Routine source checks and requests can proceed under a recorded standing authorization. The system pauses for ambiguous identity matches, CAPTCHAs, residency proof, identity documents, and attestations. California DROP and the FTC Do Not Call Registry use official government handoffs when direct consumer action is required.
Storage and retention
Account identifiers are encrypted at rest; searchable values use keyed hashes. Session tokens and magic links are stored as hashes. Evidence is retained only as long as needed for active cases, verification, disputes, or applicable recordkeeping. The production retention schedule and account-deletion response time will be published before general availability.
Your controls
You can review or revoke standing authorization, change report cadence, export case history, correct identity-vault information, and request account deletion. Revocation stops new agent actions but cannot recall a request already delivered to a third party.
Vendors and government systems
Infrastructure providers process data on our behalf under contract. When you open an official government flow or a source rights page, that organization’s own privacy practices apply. We do not transfer identity data to DROP or the FTC outside their authorized flow.
Contact
Before public account creation, this section will provide a monitored privacy address, mailing address, and applicable state appeal instructions. Until then, the hosted build is a controlled product preview and should not receive sensitive identity information.