Privacy Policy

How AgentVeil handles website, local product, hosted product, payment, and support data.

Last updated: October 20, 2026

1. Who We Are

AgentVeil is operated by Oleg Boiko PR Informacione usluzne delatnosti Novi Sad, an individual entrepreneur (preduzetnik) registered in the Republic of Serbia, PIB 114089208, with registered office at Svetozara Miletica 43, Novi Sad, Serbia.

AgentVeil acts as a controller for personal data it processes for its own website, accounts, licensing, security, support, and business administration purposes. Where AgentVeil processes personal data on behalf of an organizational customer under the customer's instructions, the respective controller and processor roles are determined by the applicable contractual arrangements and processing activities.

For privacy questions or requests, contact ob@agentveil.dev.

2. What This Policy Covers

This Privacy Policy explains how we handle data when you use the AgentVeil website, public documentation, public software, local product features, the AgentVeil Console and its sign-in, hosted or paid features where configured, support, billing, and payment-related communications.

Third-party services, agents, IDEs, model providers, MCP servers, payment providers, and external websites have their own privacy practices.

3. Public Website Data

When you visit the website, our hosting infrastructure receives standard technical request data, such as your IP address, browser user agent, the page requested, the referring page, and timestamps. This data may be recorded in server and security logs. Website analytics are described in Section 4.

We use this data to operate the website, understand aggregate usage, improve the site, prevent abuse, and maintain security.

4. Cookies, Local Storage, and Analytics

Website analytics. We use GoatCounter, a privacy-focused web analytics service, to count visits to the homepage and the Safe Mode page. When one of these pages loads, your browser sends GoatCounter the page address and title, the referring page and any campaign parameters in the link, your screen size, and a flag that helps filter automated traffic. Like any web request, it also carries your IP address and browser user agent. GoatCounter uses them to record browser and operating system names, country and region, and to recognize repeat views from the same visitor for up to 8 hours so that unique visitors can be counted. The GoatCounter script does not set cookies on our website, and we have not enabled storage of individual pageviews. We use these statistics only in aggregate, to understand how the website is used.

Local storage. Website pages remember your light or dark theme choice in your browser's local storage. This preference stays on your device and is not sent to us.

Console cookies. If you sign in to the AgentVeil Console, we set first-party cookies that are strictly necessary for sign-in, session security, protection against cross-site request forgery, and connecting the command-line tools to your account. They are not used for advertising or cross-site tracking.

Third-party website resources. Website fonts are served from our own servers. The Safe Mode page loads an icon library from the unpkg content delivery network; when your browser fetches it, unpkg receives your IP address and browser information under its own privacy policy.

Analytics and local storage are not used to collect source code, prompts, MCP payloads, secrets, customer evidence, or private agent logs.

5. Contact and Support Data

If you contact us, request access, ask for support, or communicate by email, we may process your name, email address, organization, message content, billing context, and related communications.

Do not send raw secrets, private keys, production credentials, sensitive source code, regulated personal data, or private evidence artifacts through public website forms, ordinary email, or support messages unless we have agreed on a secure channel.

6. Local Product Data

AgentVeil public or local software may generate or store local configuration, approval records, logs, evidence, receipts, hashes, or proof artifacts on your machine or within your configured environment.

Local-only data is not automatically sent to AgentVeil unless you configure a hosted feature, share it with us, or use a feature that requires transmission.

You are responsible for securing your local machine, local evidence, local configuration, credentials, and backups.

7. Hosted or Paid Product Data

Hosted or paid AgentVeil features may process bounded metadata needed to provide the service, such as account or license identifiers, workspace or project identifiers, connector or integration type, action type and family, risk family or policy identifier, decision state, timestamps, resource or payload hashes, idempotency-key hashes, usage and billing counters, error codes, and operational telemetry.

Depending on their context and linkability, account identifiers, operational metadata, and hashes may constitute personal data or pseudonymized personal data and are handled under this Privacy Policy where applicable.

We aim to avoid collecting raw prompts, raw source code, full shell commands, secret values, private keys, full MCP payloads, file contents, full local paths, or signed URLs unless a specific feature or support process requires it and you choose to provide it.

Actions outside configured AgentVeil routes may not be logged, approved, blocked, redirected, or included in AgentVeil evidence.

Console accounts. If you sign in to the AgentVeil Console with GitHub or Google, we receive and store the name of the sign-in provider, a keyed hash of your account identifier at that provider, and, where the provider shares them, your email address, display name, and profile image link. Sign-in sessions are stored as hashed tokens and expire automatically.

8. Payment and Billing Data

For paid access, we may process billing contact details, invoice details, payment status, plan, license or account identifiers, payment references, and communications about billing or access.

Payments may be processed by third-party payment providers, including Payoneer or other providers. We do not control their privacy practices.

Do not send card numbers, bank passwords, private payment credentials, or unnecessary financial information directly to us by email.

Payments Through Authorized Resellers

Certain future paid purchases may be processed by authorized third-party resellers acting as Merchant of Record.

For these purchases, the reseller may independently process customer identity, billing, payment, tax, fraud-prevention, and transaction data in accordance with its own privacy policy.

AgentVeil may receive limited customer, product, order, subscription, payment-status, and billing-reference information required to provide purchased access, administer the commercial relationship, and handle product support.

AgentVeil does not require customers to send complete payment card details directly to AgentVeil for purchases processed by a Merchant of Record.

The identity and applicable privacy policy of the relevant payment provider or reseller will be disclosed where required in connection with the purchase.

9. How We Use Data

• to provide, operate, secure, and improve AgentVeil;
• to process access requests, payments, and invoices;
• to provide support;
• to maintain local or hosted evidence features where configured;
• to detect abuse, security issues, and operational failures;
• to communicate with you about the service;
• to comply with legal, accounting, tax, and security obligations.

Legal Bases for Processing

Where data protection law requires a legal basis for processing, we rely on the following:

• Performance of a contract: to create and manage accounts, provide access to AgentVeil products, and administer trials and subscriptions.
• Legal obligation: to keep the accounting and tax records that the law requires.
• Legitimate interests: to keep AgentVeil and our systems secure, prevent abuse, and carry out limited operational analytics, such as the aggregate website statistics described in Section 4, where this basis applies.
• Consent: for optional marketing communications, where consent is required and we ask for it.

Where we rely on legitimate interests, you can object as described in Section 15.

10. No Model Training

We do not use customer source code, private prompts, private logs, secrets, or private evidence artifacts submitted to AgentVeil support or hosted services to train general-purpose AI models.

If this changes for any optional feature, it must be disclosed separately and require an appropriate opt-in or agreement.

11. Processors and Recipients

We may share data with service providers that help us operate AgentVeil, such as cloud hosting and infrastructure providers, the website analytics provider described in Section 4, providers that serve website files, the sign-in provider you choose for the Console (GitHub or Google), email providers, payment providers, security providers, and professional advisors.

Payment providers, such as Payoneer for direct invoices, and any authorized reseller acting as Merchant of Record for a purchase may process transaction data as independent controllers under their own privacy policies.

We may also disclose data if required by law, to protect rights and security, or as part of a business transfer, subject to appropriate safeguards.

12. International Transfers

We operate from Serbia. AgentVeil uses cloud infrastructure provided by Amazon Web Services (AWS), including infrastructure located in the United States. AWS provides contractual data protection terms, including its Data Processing Addendum and applicable international data transfer safeguards. Where required by applicable law, international transfers are subject to appropriate legal safeguards.

Some of the other service providers described in Section 11 may also process data in other countries, so your data may be processed outside the country where you are located, including outside the European Economic Area. You can ask us at ob@agentveil.dev for information about the safeguards that apply.

13. Retention

We keep personal data only as long as reasonably needed for the purposes described in this policy, including providing the service, maintaining records, resolving disputes, meeting legal or accounting obligations, and protecting security. The criteria by category are:

• Website analytics: kept as aggregate statistics in our GoatCounter account and deleted automatically after 31 days.
• Contact and support correspondence: kept while we handle your request and for as long as we need a record of our communication with you.
• Console account records: kept while your account exists, and afterwards only as long as needed for security, record-keeping, and resolving disputes. Sign-in sessions expire automatically.
• Trial and subscription records: kept for the duration of the trial or subscription and afterwards as long as needed for licensing records and legal obligations.
• Payment references and accounting records: kept for the periods required by applicable accounting and tax laws.
• Operational and security logs: kept for a limited period needed for security, abuse prevention, and troubleshooting.
• Hosted evidence and metadata: kept according to the retention settings of the hosted feature and for as long as needed to provide it. Console decision summaries are deleted automatically from the Console database once they are older than 30 days.
• Local-only evidence: stays under your local configuration and is not held by us.

14. Security

We use reasonable technical and organizational measures designed to protect data. No system is completely secure, and we cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur.

You are responsible for securing your own devices, credentials, agent environments, local evidence, backups, and third-party integrations.

15. Your Rights

Depending on the applicable data protection laws and your circumstances, you may have rights to access, correct, delete, restrict, object to certain processing of, or request portability of your personal data. You may also have the right to withdraw consent where processing is based on consent and to lodge a complaint with a competent supervisory authority.

To make a request, contact ob@agentveil.dev. We may need to verify your identity before responding.

To use the AgentVeil Console and hosted features, you need to sign in with a supported provider, which gives us the account information described in Section 7. If you do not want to provide it, you can still use the public software in local-only mode, but you cannot use the Console or hosted features.

16. Children

AgentVeil is not intended for children or for consumer household use. Do not use AgentVeil if you are under the age required to enter into a binding agreement in your jurisdiction.

17. Changes

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify users, such as posting the updated policy on the website or contacting paid users where appropriate.

18. Contact