Privacy Policy

Last updated: May 28, 2026

1. Overview

Agentomy respects your privacy. This policy describes what data we collect, how we use it, and your rights regarding that data.

2. What We Collect

Website (agentomy.com):

  • No third-party analytics or tracking scripts (no Google Analytics, Plausible, Fathom, or similar)
  • No cookies for tracking purposes
  • No personal data collected through website browsing
  • Standard Azure server access logs are produced for operational diagnostics only (see Section 4)

Agentomy Agent (open source):

  • The open source framework does not collect telemetry
  • No usage data is sent to Agentomy servers
  • All governance data stays on your infrastructure
  • Audit trail data is stored locally, never transmitted externally

GovernanceBench:

  • When run locally: no data leaves your environment
  • When run against agentomy.com/governancebench/api: only the test payloads and scores are processed; no user-specific data is collected

Contact forms and email:

  • If you contact governance@agentomy.com, we retain your email and message content to respond to your inquiry
  • We do not sell or share contact information with third parties

3. BYOK (Bring Your Own Key) Data Handling

If you use Agentomy with your own API key (Tier 2):

  • You provide your API key as an environment variable on your own self-hosted instance. It is never transmitted to Agentomy, never stored on Agentomy systems, and never leaves your infrastructure.
  • Your API key never appears in audit trail events, governance reports, or logs.
  • Because the key resides only in your own environment, you control its rotation and removal directly; Agentomy holds no copy to retain or delete.

4. Analytics

agentomy.com does not run third-party analytics or tracking scripts (no Google Analytics, Plausible, Fathom, or similar). No cookies are set. No personal data is collected through browsing. The Azure infrastructure produces standard server access logs (request path, timestamp, response code, user-agent, IP address) as a normal operational artifact; these logs are retained per Azure defaults and used only for operational diagnostics, not for user-level tracking.

5. Third-Party Services

The Agentomy website is hosted on Microsoft Azure (Microsoft Corporation). Microsoft's privacy statement applies to the hosting infrastructure.

The Agentomy API, when self-hosted and configured with optional third-party AI providers under the Bring Your Own Key model, may transmit your queries to those providers. The Bring Your Own Key model is provider-agnostic -- the customer chooses which AI provider, model gateway, or search service to configure via environment variable. The privacy policies of any third-party provider the customer configures apply to data sent to those services. The agentomy.com website itself does not call these services; they are only invoked when you, the operator, configure them on your own infrastructure.

5a. Sub-processor change notification

If Agentomy adds, removes, or replaces any sub-processor listed in Section 5 in a way that affects deployed customer instances under a commercial agreement, we will provide commercial-license customers with at least 30 days' written notice via the email address on file. Customers may object to the change within 15 days; unresolved objections may trigger termination per the commercial agreement. Pre-revenue, this policy applies prospectively from the date a commercial agreement is in force.

6. Data Retention

Website analytics data is retained in aggregate form. Contact email correspondence is retained for the purpose of responding to inquiries. No personal data is retained beyond what is necessary for the stated purpose.

7. Your Rights

Under Quebec Law 25 (Act respecting the protection of personal information in the private sector), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the European General Data Protection Regulation (GDPR), and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), as applicable to your jurisdiction:

  • You have the right to access any personal data we hold about you
  • You have the right to request correction or deletion of your data
  • You have the right to withdraw consent for data processing
  • Contact: governance@agentomy.com

8. Data Location

Agentomy is based in Montreal, Quebec, Canada. Website hosting infrastructure is provided by Microsoft Azure across its global edge network; data centers serving European users are typically located within the European Economic Area, and data centers serving North American users are typically located in North America. Enterprise deployments requiring specific data-residency commitments may contact governance@agentomy.com for region-pinned configurations.

9. Children

Agentomy is not directed at individuals under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this policy. Changes will be noted with an updated date at the top of this page. Continued use of the service constitutes acceptance of the revised policy.

11. Contact

Privacy inquiries: governance@agentomy.com

Agentomy, Montreal, Quebec, Canada