Privacy policy
Version 0.1 (draft). Last updated [DATE].
In short
- For your account, AgentPage is the controller. For the leads and chats of the visitors to your website, you are the controller and AgentPage is your processor.
- We keep your account email, your chat’s settings, and the visitor conversations and lead details your chat collects.
- We do not sell personal data, show advertising, or use customer or visitor data to train AI models. We do not read your ChatGPT or Claude conversations.
- The chat runs on Landbot (Hello Umi, S.L.). Our other providers are listed in section 7.
- Leads and transcripts are deleted after 90 days by default. You can ask for earlier deletion at [PRIVACY EMAIL].
1. Who we are and our two roles
AgentPage is operated by [OPERATOR NAME], [LEGAL FORM AND REGISTRATION NUMBER], [ADDRESS] (“AgentPage”, “we”, “us”). Privacy contact: [PRIVACY EMAIL]. [EU/UK REPRESENTATIVE AND DATA PROTECTION OFFICER, IF REQUIRED]
AgentPage is a service that adds a lead-catching chat to a website. You set it up from ChatGPT or Claude. We play two different roles with personal data:
| Data | Whose data | Role of AgentPage | Who decides what happens to it |
|---|---|---|---|
| Account and service data | You, the customer, and people you name as contacts | Controller | AgentPage, as described in this policy |
| Lead and chat data from website visitors | People who use the chat on your website | Processor (service provider) acting for you | You, the customer, as controller. We follow your instructions as set out in our terms and data processing terms. |
Where this policy talks about visitor data, our statements describe what we do as your processor. You remain responsible for telling your visitors about the chat and for having a lawful basis to collect their data.
Draft note: AgentPage uses Landbot’s platform. Decide, with a lawyer, whether and how the public text should describe the relationship between the operator and Landbot (the operator’s founder is also Landbot’s founder and CEO). See open question 1 in phase3-design/open-questions-for-jiaqi-v2.md. The current wording only says Landbot is a sub-processor.
2. The data we handle
| Category | What it includes | From | Our role |
|---|---|---|---|
| Account data | Your email address; the notification email address you choose; records of sign-in (time, the AI app that asked for access, the permissions you granted); support messages. | You | Controller |
| Setup data | Your business name and description, website address, language, goal, greeting, questions and colours, and the text we copy from your public web pages so the chat can answer questions. | You, via your AI assistant; your public website | Controller for the account and service; processor for any personal data inside your site text |
| Visitor chat data | What a visitor types in the chat, and the replies; the email address the chat asks for, and any name, phone number or other details the visitor chooses to give; the answers to your qualifying questions; the page address where the chat took place; the date and time. | Visitors to your website | Processor |
| Lead emails and reports | The lead emails and morning reports we send you, which repeat visitor chat data, and a record that they were sent. | Generated by AgentPage | Processor for the visitor details; controller for the sending records |
| Technical and security data | IP addresses and request details (such as browser type) seen by our network and hosting providers when you or a visitor connects; logs of tool calls (time, tool name, account, result); abuse-prevention counters. The chat itself is loaded from Landbot’s servers, so a visitor’s browser connects to Landbot to load and run it. AgentPage does not store visitors’ IP addresses, country or browser details with their leads. | Your device; visitors’ browsers | Controller (security and abuse prevention) |
We do not intentionally collect sensitive data (such as health information, government identifiers or payment card numbers) and our terms forbid configuring a chat to ask for it. A visitor might still type something sensitive into the free-text box. The chat is not designed for that, and we process it only as part of the conversation on your behalf.
We do not receive passwords, API keys or other credentials for any of your accounts.
Draft note: the lead fields above were checked against app/src/hooks/landbot.ts on 2026-10-18 (name, email, phone, first message, answers, page, times; nothing else from the visitor record is kept). Still to confirm before launch: which browser storage the chat widget sets on the customer’s website, because the customer needs it for their cookie notice.
3. What your AI assistant sends and receives
We do not see your conversations with ChatGPT or Claude. We only receive what your assistant sends when it calls an AgentPage tool on your instruction, and we only return what each tool needs. Once data is returned into a ChatGPT or Claude conversation, OpenAI or Anthropic handles it under your agreement with them, not ours.
| Tool | Your assistant sends | AgentPage returns |
|---|---|---|
create_lead_agent | Website address; business name; optionally a short description, language, greeting, up to three questions, a colour and the email address for leads | The chat’s ID and status; the website address, business name, greeting, questions and colour; the notification email address; the preview link. No visitor data. |
get_install_snippet | The chat’s ID | The embed code and where to paste it. No personal data. |
check_install | The chat’s ID; optionally a page address on the same website | The page checked, whether the snippet was found, the page’s HTTP status and the time of the check. No visitor data. |
update_lead_agent | The chat’s ID; any of the business name, greeting, questions, colour or notification email address | The saved settings, including the notification email address, and which fields changed. |
list_leads | Optionally a chat’s ID, a start date, a page size, a cursor, and whether to include conversations without contact details | For each lead: the lead and chat IDs; the visitor’s name, email address and phone number if given; their first message; their answers to your questions; the page where the chat took place; when they started and last wrote. Visitor data. |
get_report | A period (yesterday, the last 24 hours or the last seven days); optionally a chat’s ID | The number of new leads and conversations in the period, and the same lead details as list_leads. Visitor data. |
delete_lead_agent | The chat’s ID and an explicit confirmation | Whether the chat was deleted and how many leads were deleted. No visitor data. |
Tools do not return IP addresses, browser details or device identifiers. They do return the IDs of chats and leads, which your assistant needs in order to refer to them. This table was checked against the tool definitions in app/src/mcp/server.ts on 2026-10-18; keep it identical to what the tools return.
Our tool descriptions ask your assistant to send only what each tool needs. If you paste personal data about other people into your assistant, that is handled under your agreement with the assistant’s provider.
4. Why we use data, and on what basis
Where we are the controller (account and service data)
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Sign you in, set up and run your chat, send you lead emails and reports, give support | Performing our contract with you (Art. 6(1)(b)) |
| Keep the service secure, prevent abuse and spam, diagnose faults, keep short-lived logs | Our legitimate interests in running a safe and reliable service (Art. 6(1)(f)) |
| Send you important service notices, such as changes to this policy or to the service | Contract and legitimate interests |
| Send optional product news | Your consent (Art. 6(1)(a)), only if you opt in, and you can withdraw it at any time |
| Comply with law and answer lawful requests | Legal obligation (Art. 6(1)(c)) |
Where we are the processor (visitor data)
We process visitor data only to provide the service to you: to run the chat, answer the visitor, pass the lead to you, store it for the period you can see in section 9 and send you reports. You, as controller, decide the lawful basis for collecting it. Most customers rely on their legitimate interest in answering enquiries, or on steps taken at the visitor’s request before a contract. We do not use visitor data for our own purposes, other than the security and abuse-prevention logging described above.
5. What we do not do
- We do not sell personal data, and we do not share it for advertising or cross-context behavioural advertising.
- We do not show advertising and we do not profile people for advertising.
- We do not read, request or store your ChatGPT or Claude conversation history, memory or files. We only receive tool inputs, as set out in section 3.
- We do not use customer or visitor data to train AI models, and we do not send it to any AI provider other than the ones that run the chat for you (see the next point and section 7).
- The chat’s AI is run through Landbot’s platform. Landbot’s published terms say that some of its own AI assistants use end-user data in an anonymised form to improve those services. [CONFIRM which Landbot AI features AgentPage chats use and whether that clause applies. If it does, say so here in plain words and tell customers.]
- We do not contact your leads on your behalf. The only emails we send about a lead go to you.
- We do not make decisions about people that have legal or similarly significant effects. The chat answers questions and collects details; a person at your business decides what happens next.
We keep only the data needed to run the service and do not collect data “just in case”.
6. The chat is automated (AI disclosure)
The chat uses artificial intelligence to answer visitors. Its opening message tells every visitor that it is an automated assistant and not a person. Customers may change the rest of the greeting but may not remove or hide this notice (see the terms). The chat can make mistakes, which is why every lead goes to a person at the customer’s business who decides what happens next.
7. Who else handles data (sub-processors)
We use the providers below to run AgentPage. For visitor data, you give us general authorisation to use them in our data processing terms. We tell customers before we add or replace one (see that page).
| Provider | What it does | Personal data involved | Location |
|---|---|---|---|
| Hello Umi, S.L. (“Landbot”) | Runs the chat conversations on its platform, including the chat’s AI agent, and stores conversations while they are active. It uses its own sub-processors (Landbot’s list), including OpenAI (below). | Visitor chat data; technical data needed to deliver the chat | Spain (EEA); see its list for others |
| OpenAI, L.L.C. (via Landbot) | Provides the AI model behind the chat’s AI agent (currently a GPT model). Landbot sends it what visitors type so the agent can answer. | Visitor chat messages and the website knowledge the agent uses | United States [CONFIRM TRANSFER MECHANISM WITH LANDBOT’S DPA] |
| Cloudflare, Inc. | Hosting for our server and database, queues, scheduled jobs, DNS, content delivery and attack protection | All data we store; IP addresses and request details in transit | Global network; database in [REGION: CONFIRM] |
| Resend, Inc. | Sends sign-in links, lead emails and morning reports | Recipient email addresses; email content, which includes lead details | United States (sending region us-east-1) |
Apart from OpenAI’s role inside the chat (above), the AI assistant you use to work with AgentPage — ChatGPT (OpenAI) or Claude (Anthropic) — is not our sub-processor. It is a service you choose, and it receives AgentPage data only when you ask it to bring that data into a conversation.
We may also disclose data to professional advisers, and to authorities where the law requires it. We do not disclose it for any other purpose.
8. International transfers
Some of our providers process data outside the European Economic Area or the United Kingdom, including in the United States. Where that happens, we rely on an adequacy decision, on the provider’s certification under the EU-US Data Privacy Framework and its UK extension where it applies, or on the standard contractual clauses approved by the European Commission with the UK addendum. [CONFIRM the mechanism for each provider in section 7 and for the operator’s own location.] You can ask us for a copy of the safeguards at [PRIVACY EMAIL].
9. How long we keep data
These are our default periods. They are proposed and to be confirmed before launch.
| Data | Kept for |
|---|---|
| Account data and setup data | While your account is open, then deleted within [30 days] of closure. Backups that still hold it expire within a further [30 days]. |
| Leads, chat transcripts and lead emails | 90 days from the conversation, then deleted automatically by a nightly job. You can delete a chat and all of its leads earlier by asking your assistant (delete_lead_agent), or by emailing us. |
| Morning reports | We do not keep the text of a report. We keep a record that it was sent (date, counts and status) for [90 days]. |
| Text copied from your public pages for the chat | Held by the chat’s AI agent on Landbot’s platform. It is public page content only, with no visitor data. Deleting a chat removes the chat but does not currently remove this copy. [FIX BEFORE LAUNCH OR KEEP THIS SENTENCE] |
| Sign-in links and sessions | A sign-in link works once and expires after 15 minutes. Sessions and permissions last until you revoke them or they expire after [30 days] of inactivity. |
| Security, delivery and tool-call logs | [30 days] |
| Support correspondence | [24 months] after the last message |
| Copies at Landbot | When we delete a visitor’s conversation from AgentPage (at 90 days, or when you delete a chat) we also ask Landbot to delete it. If Landbot cannot be reached at that moment, the copy may stay at Landbot until Landbot deletes it under its own terms: up to 12 months in active storage and up to a further 12 months in archive. |
| Records at the email provider | [PERIOD: depends on the provider] |
We may keep data for longer where the law requires it or where we need it to establish or defend a legal claim. When your account closes, you can ask for an export of your leads first (see the terms).
10. Your rights and how to use them
Under data protection law you may have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, withdraw consent, and complain to a supervisory authority. If you live in California or another US state with a privacy law, you may have similar rights. For visitor data we act as a service provider and do not sell or share personal information as those laws define the terms.
- Account holders. Email [PRIVACY EMAIL] from the address on your account. We reply within one month. We may ask you to confirm who you are.
- Delete a chat and all its leads. Ask your assistant to delete it (
delete_lead_agent). Delete a single lead or close your account: email the address above and say what you want deleted. - Visitors. See section 11.
11. If you chatted on a website that uses AgentPage
The business that runs the website decided to use the chat and is the controller of what you shared. Please contact that business to ask about your data, to correct it or to have it deleted. If you write to us, we will pass your request to the business without undue delay and help them answer it. We cannot decide on the business’s behalf, and we may not be able to tell you which business holds your data without their agreement.
The chat is automated. It is not a person. Anything you type is passed to the business so that they can reply. The chat is run on the business’s behalf by AgentPage using the providers in section 7. If you do not want to use the chat, you can contact the business another way.
12. Security
- Data is encrypted in transit with HTTPS, and encrypted at rest by our hosting provider. [CONFIRM]
- You sign in with a one-time link sent to your email. We do not store passwords. AI apps connect through OAuth, with your permission shown on a consent screen, and you can revoke access.
- Every request is checked against your account. Data is separated by customer, and a tool only returns your own data.
- Secrets and provider keys are kept in the hosting provider’s secret store, not in code.
- Website text copied into the chat is treated as data and never as instructions. Visitor messages cannot give the chat access to other customers’ data.
- Rate limits and caps on chats per account and previews per day limit abuse.
- Access to production data is limited to people who need it to run the service.
If a personal data breach affects data you control, we will tell you without undue delay and within [24 hours] of becoming aware of it, with the information you need to meet your own duties. No system is perfectly secure, and we cannot promise that nothing will ever go wrong.
Draft note: check every statement in this section against the implementation in app/ before launch and remove any that is not true.
13. Children
AgentPage is for businesses and is not for use by anyone under 18. We do not knowingly collect personal data from children for our own purposes. Websites that use the chat are not meant to target children under 13, and customers must not configure the chat to do so.
15. Changes to this policy
We will update the date at the top when we change this policy. For a material change, we will email account holders at least [30 days] before it takes effect, unless the law or a security need requires faster action.
16. Contact and complaints
Privacy requests and questions: [PRIVACY EMAIL]. Postal address: [ADDRESS]. General help: Support.
You can complain to your local data protection authority. [LEAD SUPERVISORY AUTHORITY, ONCE THE OPERATOR’S ESTABLISHMENT IS KNOWN]