Privacy Policy
Last updated: April 1, 2026
1. Introduction
Agen.co ("Agen," "we," "us," or "our") provides infrastructure that enables organizations to securely connect AI agents to applications via enterprise MCP (Model Context Protocol). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our website (agen.co), use our platform, or interact with us. By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.
2. Information We Collect
Information You Provide
- Account registration data (name, email, organization) processed via our authentication provider, Frontegg
- Contact form submissions and sales inquiries through HubSpot
- Billing and payment information for paid plans
- Communications you send to us, including support requests
Information Collected Automatically
- Device and browser information (IP address, browser type, operating system)
- Usage data and interaction logs from our platform
- Analytics data collected via Google Analytics, Google Tag Manager, and Mixpanel
- Cookie identifiers and tracking technologies (see Section 5)
Information from Third Parties
- Data from identity providers when you authenticate via SSO
- Publicly available business contact information for sales outreach
3. How We Use Your Information
- Provide, maintain, and improve our platform and services
- Authenticate users and manage access control
- Process transactions and send related communications
- Analyze usage patterns to improve performance and user experience
- Send marketing communications (with your consent where required)
- Detect, prevent, and address security incidents and fraud
- Comply with legal obligations and enforce our terms of service
- Provide customer support and respond to inquiries
4. Legal Basis for Processing (EEA/UK)
If you are located in the European Economic Area or the United Kingdom, we process your personal data based on the following legal grounds:
- Contract performance — to provide you with our services and fulfill our obligations
- Legitimate interests — to improve our services, ensure security, and conduct marketing to existing customers
- Consent — for analytics cookies, marketing emails, and other processing where we have obtained your explicit consent
- Legal obligation — to comply with applicable laws, regulations, and legal processes
6. Data Sharing & Third Parties
We do not sell your personal information. We share data only in the following circumstances:
Service Providers (Sub-processors)
We use trusted third-party providers to operate our services, including Frontegg (authentication), Google (analytics), Mixpanel (product analytics), and HubSpot (marketing and CRM). These providers process data on our behalf under contractual obligations.
Legal Requirements
We may disclose information when required by law, regulation, legal process, or governmental request.
Business Transfers
In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction. We will notify affected users before their data is subject to a different privacy policy.
With Your Consent
We may share information for other purposes with your explicit consent.
7. Customer Data & Platform Data
When you use the Agen.co platform, data may flow through our infrastructure as part of agent-to-application connections. For this data, Agen.co acts as a data processor on behalf of our customers (the data controllers). This includes agent identity records, access control configurations, audit trail logs, and data passing through MCP connections. We process this data solely according to our customers' instructions and applicable data processing agreements (DPAs). Enterprise customers may request a dedicated Data Processing Agreement. Please contact us at privacy@agen.co for details.
8. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Account data is retained for the duration of your active account and for a reasonable period after termination to comply with legal obligations and resolve disputes. Platform audit logs are retained according to the retention period specified in your service agreement. Analytics data is retained in aggregated, anonymized form. You may request deletion of your personal data at any time by contacting us (see Section 13).
9. Data Security
We implement appropriate technical and organizational measures to protect your personal information, including:
- Encryption of data in transit (TLS) and at rest
- Role-based access controls and least-privilege principles
- Continuous monitoring and anomaly detection
- Regular security assessments and penetration testing
- Comprehensive audit trails for all platform operations
While we strive to protect your data, no method of transmission or storage is completely secure. In the event of a data breach, we will notify affected users and relevant authorities as required by applicable law.
10. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. When we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.
11. Your Rights (EEA/UK — GDPR)
If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate or incomplete data
- Erasure — request deletion of your personal data
- Restriction — request that we limit processing of your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests or direct marketing
- Withdraw consent — withdraw consent at any time where processing is based on consent
To exercise any of these rights, contact us at privacy@agen.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.
12. Your Rights (California — CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:
- Right to Know — request disclosure of the categories and specific pieces of personal information we have collected
- Right to Delete — request deletion of personal information we have collected
- Right to Correct — request correction of inaccurate personal information
- Right to Opt-Out — we do not sell or share personal information for cross-context behavioral advertising
- Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights
To submit a request, contact us at privacy@agen.co. We will verify your identity before processing your request and respond within 45 days.
13. Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page and revise the "Last Updated" date. For material changes, we will provide notice through our website or by email to registered users.
15. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: Email: privacy@agen.co Website: agen.co/contact For data protection inquiries specific to the EEA or UK, you may also contact our Data Protection Officer at dpo@agen.co.