Privacy Policy

This privacy policy explains how personal data is processed when you visit our website, contact us about our IT and AI consulting, or where records from former agent services still require processing. The current website does not offer bots, Managed Agent Instances or AgentPulse. References to accounts, credits and agent instances concern former services and apply only to any remaining processing obligations; they do not describe a current service offering.

1. Data Controller

Responsible for data processing on this website:
AgentYard UG (haftungsbeschränkt)
represented by Steve Aust (Managing Director)
Lausener Bogen 26
04207 Leipzig

Germany
Email: hello@agentyard.eu

1a. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Performance of contract (Art. 6(1)(b) GDPR) – registration, wallet creation, credit purchase, agent usage
• Consent (Art. 6(1)(a) GDPR) – social login (Google, Apple, Facebook)
• Legitimate interests (Art. 6(1)(f) GDPR) – server logs, fraud prevention, platform security
• Legal obligation (Art. 6(1)(c) GDPR) – tax-related retention of invoice data

If you have given consent, you can withdraw it at any time with effect for the future.Contact us at hello@agentyard.eu. The lawfulness of the processing carried out before the withdrawal remains unaffected.

2. Authentication (Supabase Auth)

For authentication we use Supabase Auth (Supabase Inc., USA (database servers in Frankfurt, EU)). Supabase Auth enables authentication via:

• Social Login (Google, Apple) – name, email and profile picture are transmitted from the respective provider
• Email/Password – classic login with email address
• Magic Link – passwordless login via email link
• Passkey – biometric authentication (WebAuthn)

Supabase Auth stores a unique user ID (UUID) and optional profile information (email, name, avatar). For users from the legacy wallet-based login, a blockchain address may additionally be stored as a legacy identifier.

Supabase Privacy: supabase.com/privacy Transfers to third countries (USA) are based on Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

3. Database (Supabase)

We store user data in a database at Supabase Inc. (USA (database servers in Frankfurt, EU)). The following data is stored:

• User ID (UUID) and email address
• Name and profile picture (if provided via social login)
• Profile picture URL
• Credit balance
• Usage history (agent calls, timestamps)
• Created agents (for creators)

Supabase Privacy: supabase.com/privacy Transfers to third countries (USA) are based on Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

4. Payment Processing (Stripe)

Payments are processed through Stripe Inc. (USA). When making a purchase, the following data is transmitted to Stripe:

• Payment information (credit card, SEPA, etc.)
• Email address
• Billing address (if required)
• Purchase amount and product

We do not store credit card data. Stripe is PCI-DSS certified. Stripe Privacy: stripe.com/privacy Transfers to third countries (USA) are based on Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

5. AI Services (Requesty)

For executing AI Agents we use Requesty as an API gateway (EU Frankfurt, GDPR-compliant). Requesty routes requests to various AI providers:

• OpenAI (GPT-4, GPT-4o)
• Anthropic (Claude)
• Google (Gemini)
• Other providers

Important: The contents of your conversations with AI Agents are transmitted to these third-party providers. They may process the data according to their own privacy policies. We recommend not sharing sensitive personal data in agent conversations.

Requesty Privacy: requesty.ai/privacy

6. Hosting (Vercel)

This website is hosted by Vercel Inc. (USA). Vercel collects technical information such as IP address, browser type, and access time in server logs when you visit the website.

Vercel Privacy: vercel.com/legal/privacy-policy Transfers to third countries (USA) are based on Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

6a. Agent Instance Hosting (Fly.io)

Managed Agent Instances (MAI) are operated on servers by Fly.io Inc. (Chicago, USA) in the Frankfurt (EU) region. The following data is processed on Fly.io servers:

• Configuration data of your agent instance
• Conversation data and agent memory
• Technical logs (IP address, timestamps, access data)

Processing is based on Art. 6(1)(b) GDPR (performance of a contract). Fly.io servers in Frankfurt are subject to EU data protection standards.

Fly.io Privacy: fly.io/legal/privacy-policy

6b. Affiliate Program (Refgrow)

For our referral program we use Refgrow (refgrow.com). Refgrow sets a tracking cookie with a duration of 90 days to correctly attribute referrals. The cookie is only set after your consent via our cookie banner.

Data collected: referrer ID, click timestamp, attributed conversion. No personal data such as name or email is transmitted to Refgrow.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with §25 TDDDG.

Refgrow Privacy: refgrow.com/privacy

6c. Contact by Email and Contact Form

If you contact us by email, we process your email address, the contact details you provide and the contents of your message to handle your inquiry, including inquiries about our IT and AI consulting. Processing for pre-contractual inquiries or contract performance is based on Article 6(1)(b) GDPR; other inquiries are handled on the basis of our legitimate interest in responding under Article 6(1)(f) GDPR.

When you contact us via the contact form, your name, email address, and message are transmitted to us via email. The data is used solely to process your inquiry and is not stored in a database. We retain the email for the duration of the communication, but no longer than 6 months after completing the inquiry, unless legal retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

6d. Newsletter

When you subscribe to our newsletter, we collect your email address. Registration uses a double opt-in process: after entering your email, you receive a confirmation email with a link. You are only added to the mailing list after clicking this link.

Your email address is stored at Supabase (database) and Brevo (email delivery). You can unsubscribe from the newsletter at any time via the unsubscribe link in each email.

Legal basis: Art. 6(1)(a) GDPR (consent).

7. Cookies & Local Storage

We use:

• Technically necessary cookies – for website functionality
• LocalStorage – to store session data

Tracking cookies (PostHog, Refgrow) are only activated after your explicit consent via our cookie banner (§25 TDDDG).

7a. Web Analytics (Vercel Analytics)

We use Vercel Analytics to analyze website usage. Vercel Analytics is cookieless — no cookies are set and no individual user profiles are created. Only aggregated, anonymized data is collected (page views, referrers, device types). Processing is based on Art. 6(1)(f) GDPR (legitimate interest in improving our service).

Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. vercel.com/legal/privacy-policy

7b. Error Monitoring (Sentry)

We use Sentry for error detection and resolution. In case of errors, technical information is transmitted: IP address (anonymized), browser type, operating system, error message and stack trace.No personal user data or chat content is transmitted. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in platform stability and security).

Provider: Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. sentry.io/privacy

7c. AI Services (LLM Providers)

When you use an agent, your input is forwarded to an AI provider (e.g. OpenAI, Anthropic, Google) to generate a response. Forwarding is done via Requesty.ai as router. Your inputs are not used for training AI models. Processing is based on Art. 6(1)(b) GDPR (contract performance).

8. Data Transfer to Third Countries

The above-mentioned services (Supabase, Stripe, Requesty, Vercel) are based in the USA or EU. Data transfer is based on:

• EU-US Data Privacy Framework (for certified companies)
• Standard Contractual Clauses (SCCs)

9. File Uploads

When you upload files (PDF, images, CSV, text files) for use with Agents, they are stored in protected storage (Supabase Storage) and automatically deleted after 24 hours. Files are used solely for processing by the selected Agent and are not shared with third parties. Processing is based on Art. 6(1)(b) GDPR (performance of a contract). Processing results (text output) are stored as part of usage history; original files are not retained.

10. Data Retention

We store your data as long as your account is active. After account deletion, personal data will be deleted within 30 days, unless legal retention requirements apply (e.g., for invoices: 10 years). Uploaded files are automatically deleted after 24 hours regardless of account status.

11. Your Rights

You have the right to:

• Access – what data we store about you
• Rectification – correction of inaccurate data
• Erasure– deletion of your data ("right to be forgotten")
• Restriction – restriction of processing
• Data Portability – export of your data
• Object – to certain processing
• Complaint – to a data protection supervisory authority.

To exercise your rights, contact us at: hello@agentyard.eu

12. Changes

We reserve the right to update this privacy policy. Significant changes will be communicated to you via email, if we have your email address.

Last updated: April 2026