Privacy Policy

1. Who we are

OpenAgent ("we", "us" or "our") is a customer-engagement platform operated from Bengaluru, India. Our registered correspondence address is:

For any privacy question or data-rights request, write to [email protected]. General queries: [email protected].

2. What we collect

• Enquiry form data: name, email, phone, message, IP address and timestamp.
• Account data: work email, full name, workspace name, role, hashed password.
• Conversation data: chat messages, file attachments, the URL of the page where the chat happened, IP address and user-agent of the visitor.
• LLM provider keys: the API key you choose to connect (Gemini, OpenAI, Claude, OpenRouter or a self-hosted endpoint). Stored encrypted at rest, decrypted only in memory at request time and never written to logs.
• Knowledge base content: any document, URL or text you upload for the AI to reference.

3. How we use it

We use this data only to deliver the OpenAgent service you signed up for: to reply to your enquiry, run the live chat and AI agent, route conversations and provide analytics on your own conversations. We do not sell your data, do not share it with advertisers and do not train any model on it.

When the AI agent runs, your conversation content and any cited knowledge-base snippets are sent to the LLM provider you yourself configured. Their privacy policy applies to that leg of the request. We never route your data to an LLM you have not explicitly enabled.

Where we process your visitors' data we act as a processor on your instructions; our standard Data Processing Addendum covers the details and can be countersigned on request.

4. Where it lives

Operational data (Postgres, object storage, vector index) is hosted on encrypted disks in our infrastructure in India. Backups are encrypted and retained for 30 days. If you require a specific region or dedicated infrastructure for regulatory reasons, contact us and we will scope a Business-tier arrangement.

5. How long we keep it

• Enquiry form submissions: 24 months, then deleted.
• Conversation history: 90 days for Pro, configurable for Business.
• Account data: as long as your workspace is active, plus 30 days after closure.
• Backups: 30 days rolling.

6. Your rights

Under the Digital Personal Data Protection Act, 2023 (India), GDPR and similar regimes you have the right to access, correct, export or delete your personal data, and to withdraw consent at any time. Email [email protected] and we will respond within 30 days. We do not charge a fee for these requests.

7. Cookies

We use a single first-party cookie to remember a chat session identity so visitors can resume a conversation on the next page load. No third-party trackers, no advertising pixels, no analytics SDKs.

8. Security

All traffic to OpenAgent runs over TLS. Data at rest is encrypted. Access to production systems is limited to named team members and is gated by SSH key plus multi-factor authentication. If you discover a security issue, please report it responsibly to [email protected].

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email to workspace admins at least 30 days in advance and the "last updated" date above will be revised.