Skip to main content

Privacy Policy

Last updated: 2026-05-10

What we collect

Account data: name, email, hashed password, and (if you sign in via Google or GitHub) the OAuth subject and email returned by that provider.

Workspace content: projects, files, database tables and rows, AI conversations, integration credentials, workflow definitions, and any data you push into Coagentic via API.

Usage telemetry: request logs (IP, user-agent, timestamp, route) and audit events (sign-ins, key API calls). Used for security and abuse prevention.

Billing: Polar (our payment provider) handles all card data. We store only the customer / subscription identifiers Polar returns — never card numbers, never CVV.

How we use it

  • Run the product (auth, persistence, agent tools).
  • Send transactional emails (verification, password reset, invitations, alerts you opt into).
  • Detect abuse (rate limiting, audit log review).
  • Bill paid plans through Polar.

We do not sell your data, train AI models on your workspace content, or share it with advertisers.

Third parties

We use a small set of subprocessors to operate the service. The authoritative, dated list lives at /legal/subprocessors; today it covers:

  • Hetzner — compute, managed Postgres host volumes, network (EU)
  • Cloudflare — CDN, DNS, edge TLS, WAF, transactional email routing for *@coagentic.work
  • Polar — payments and subscriptions for paid Coagentic plans
  • DeepSeek — large-language-model inference for the agent
  • Sentry — application error monitoring (active only when configured)

Integrations you connect yourself (Polar, Twilio, etc.) call those providers directly. The credentials you supply are encrypted at rest with AES-256-GCM, decrypted only inside the worker that runs the corresponding action, and never returned to your browser — the dashboard shows them as ••••••••.

Your rights (GDPR / CCPA)

Export. Download a complete JSON archive of your workspace any time from Settings → Backup & export.

Deletion. Self-serve from Settings → Delete workspace — this immediately erases the workspace plus every project, file, conversation, and integration credential it owns. If you prefer a manual review, email [email protected] from the address on file and we will action it within 30 days.

Cookies

We use a small set of first-party cookies and no advertising or cross-site tracking cookies. The session cookie is coagentic_session; the full list (CSRF, referral attribution, admin impersonation) is documented in our cookie policy.

Security

Passwords are hashed with bcrypt. API tokens are stored only as SHA-256 hashes (the plaintext is shown to you once at creation and never again). Integration credentials (Polar tokens, Resend API keys, Twilio tokens, …) are encrypted with AES-256-GCM at rest using a master key held outside the database. All HTTP traffic in production is served over TLS. We apply per-IP rate limiting on auth and public endpoints, and audit-log administrative actions (suspensions, refunds, support impersonation).

Contact

Questions, complaints, or data requests: [email protected].

B2B customers can also review the Data Processing Agreement and the current sub-processor list.