Privacy Policy
This page explains what data agenola collects, why, who we share it with and how long we keep it. There are two distinct relationships and they should not be confused: businesses that sign up to agenola, and visitors who talk to that business's avatar.
Two different roles
For the BUSINESSES that sign up we are the data controller: we process your account and billing data for our own purposes.
For the VISITORS who talk to an avatar, the controller is the business that built it; we only process on that business's behalf. Informing the visitor and obtaining any required consent is that business's responsibility.
What we collect from businesses
Account: name, email and a hash of your password. The password itself is never stored.
Usage: how many conversations took place in a month, how many LLM tokens and how many seconds of speech synthesis and recognition were used. This is for billing and quota.
Payment: subscription status and Stripe's customer and subscription identifiers. CARD DETAILS NEVER REACH US; payment is taken on Stripe's own page.
What is collected from visitors
Answers to the questions the flow asks, the text transcript of the conversation, the IP address and the country resolved from it, and where the visit came from (utm tags, ad click identifier, referring domain).
If the flow includes a document step, the fields read from the uploaded document; if it includes a test step, the test score and its justification.
AUDIO IS NOT STORED. The visitor's voice is sent to a speech recognition service to be turned into text and is not retained; what is kept is the transcript. The audio generated for the avatar's own speech is cached on our server so the same sentence is not synthesised twice — that is our voice, not the visitor's.
Cookies and analytics
Session cookie: required in order to sign in; it is signed.
Language cookie: remembers the language you chose.
Google Analytics and Microsoft Clarity: measure how the site is used. CLARITY RECORDS SESSIONS — your clicks and mouse movements on the page can be replayed. These tools are NOT loaded on the embedded avatar page.
Who we share with
To provide the service we use: a language model provider (produces the assistant's reply), a speech synthesis service, a speech recognition service, a document verification service (only for flows with a document step), Stripe (payments) and our hosting provider.
These suppliers receive only what they need to do the job and are not permitted to use it for their own purposes. We do not sell, rent or share your data for advertising.
Where a legal obligation arises, data may be shared with the competent authorities.
Retention
TO BE CLEAR: there is currently NO automatic deletion mechanism. Flow records, transcripts and requests remain until you delete them or ask us to.
If you want your data deleted, write to [email protected]; we act on the request within a reasonable time. Billing records are kept for the period the law requires.
Your rights
You may ask to access the data we hold about you, to have it corrected or deleted, or to receive a portable copy. Send the request to [email protected].
If you are a visitor who talked to an avatar, please direct your request to the business that built it first; we process on their behalf and act on their instruction.
Security
Connections are encrypted with TLS, passwords are hashed irreversibly, and secret server keys are not stored in plain text.
No system is completely secure. If we become aware of a breach affecting your data we will inform you.
Contact
Data controller: [COMPANY LEGAL NAME], [ADDRESS]. Questions: [email protected].
FIELDS IN SQUARE BRACKETS MUST BE COMPLETED. This text is a draft and not legal advice; have a lawyer review it before relying on it.