Privacy Policy

1. Introduction

Agen.co ("Agen," "we," "us," or "our") provides infrastructure that enables organizations to securely connect AI agents to applications via enterprise MCP (Model Context Protocol). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our website (agen.co), use our platform, or interact with us. By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

2. Information We Collect

3. How We Use Your Information

• Provide, maintain, and improve our platform and services
• Authenticate users and manage access control
• Process transactions and send related communications
• Analyze usage patterns to improve performance and user experience
• Send marketing communications (with your consent where required)
• Detect, prevent, and address security incidents and fraud
• Comply with legal obligations and enforce our terms of service
• Provide customer support and respond to inquiries

4. Legal Basis for Processing (EEA/UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal data based on the following legal grounds:

• Contract performance — to provide you with our services and fulfill our obligations
• Legitimate interests — to improve our services, ensure security, and conduct marketing to existing customers
• Consent — for analytics cookies, marketing emails, and other processing where we have obtained your explicit consent
• Legal obligation — to comply with applicable laws, regulations, and legal processes

5. Cookies & Tracking Technologies

We use cookies and similar technologies to operate our website, analyze traffic, and personalize your experience. The categories of cookies we use include:

You can manage your cookie preferences at any time through the Cookie Settings link in our website footer. Most browsers also allow you to block or delete cookies through their settings.

6. Data Sharing & Third Parties

We do not sell your personal information. We share data only in the following circumstances:

7. Customer Data & Platform Data

When you use the Agen.co platform, data may flow through our infrastructure as part of agent-to-application connections. For this data, Agen.co acts as a data processor on behalf of our customers (the data controllers). This includes agent identity records, access control configurations, audit trail logs, and data passing through MCP connections. We process this data solely according to our customers' instructions and applicable data processing agreements (DPAs). Enterprise customers may request a dedicated Data Processing Agreement. Please contact us at privacy@agen.co for details.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Account data is retained for the duration of your active account and for a reasonable period after termination to comply with legal obligations and resolve disputes. Platform audit logs are retained according to the retention period specified in your service agreement. Analytics data is retained in aggregated, anonymized form. You may request deletion of your personal data at any time by contacting us (see Section 13).

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls and least-privilege principles
• Continuous monitoring and anomaly detection
• Regular security assessments and penetration testing
• Comprehensive audit trails for all platform operations

While we strive to protect your data, no method of transmission or storage is completely secure. In the event of a data breach, we will notify affected users and relevant authorities as required by applicable law.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.

11. Your Rights (EEA/UK — GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Restriction — request that we limit processing of your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@agen.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

12. Your Rights (California — CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete — request deletion of personal information we have collected
• Right to Correct — request correction of inaccurate personal information
• Right to Opt-Out — we do not sell or share personal information for cross-context behavioral advertising
• Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights

To submit a request, contact us at privacy@agen.co. We will verify your identity before processing your request and respond within 45 days.

13. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page and revise the "Last Updated" date. For material changes, we will provide notice through our website or by email to registered users.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: Email: privacy@agen.co Website: agen.co/contact For data protection inquiries specific to the EEA or UK, you may also contact our Data Protection Officer at dpo@agen.co.