Privacy Policy

Information we collect

We collect the following categories of information:

• Account information. When you sign in with Google, we receive your name, email address, and Google account ID from Google to create and identify your account. We do not receive or store your Google password.
• Agent inputs and outputs. The information you type into an agent's form fields is sent to our AI provider (currently OpenAI) to generate a response. We do not permanently store the content of your inputs or outputs beyond what is needed to serve that request and display it back to you in your browser session.
• Google account access. If you choose to connect a Google account for an agent, we request only two narrow OAuth permissions: gmail.send (the ability to send messages you explicitly authorize; we cannot read your inbox or contacts) and calendar.readonly (read-only access to view your upcoming events; we cannot create, edit, or delete anything on your calendar). Your Google refresh token is encrypted at rest (AES-256-GCM) and used only to perform the actions you explicitly request.
• Phone number and SMS data. If you connect a phone number at /account, we collect that number, a hashed form of it used for rate limiting, and a log of message outcomes (whether a text you sent was understood and what type of request it was) so the feature works and can be monitored for abuse. See Phone number and SMS below for full detail on this feature.
• Social media connections. If you connect an Instagram or TikTok account to schedule a post, we store an encrypted access token for that platform and the platform username/account ID needed to publish on your behalf, along with the media, captions, and schedule times you provide for posts you queue.
• Usage and log data. We log a hashed identifier derived from your IP address (never the raw address), the agent used, and whether each run or message succeeded, in order to enforce rate limits and prevent abuse of the service.
• Cookies. We use a small number of cookies required to keep you signed in (via Supabase Auth) and to remember your light/dark theme preference. We do not use third-party advertising or tracking cookies.

Phone number and SMS

If you connect a phone number at /account, we collect it solely to let you send email or check your calendar by text. After you verify a number with a one-time code, texting our number can trigger two things: (1) a request to send an email on your behalf, which always requires you to reply YES before anything is sent, and (2) a summary of your upcoming calendar events. Message frequency depends entirely on how often you text us — there is no recurring or scheduled messaging outside of what you initiate. Message and data rates from your carrier may apply. Reply STOP at any time to stop receiving texts, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. This includes text messaging originator opt-in data and consent — this information is not shared with any third party, for any purpose.

How we use information

We use the information described above to:

• Operate the core service: running agents, sending emails and texts you request, and displaying results.
• Authenticate you and maintain your session.
• Enforce rate limits and free-credit balances, and prevent abuse or fraud.
• Diagnose and fix technical problems.
• Communicate with you about your account when necessary (e.g. a verification code).

We do not use your information for advertising, and we do not build behavioral profiles about you for marketing purposes.

How we share information

We do not sell your personal information. We share information only with the service providers necessary to operate Agent Polo, each acting on our behalf and only for the purpose of providing their part of the service:

• OpenAI — processes the text you submit to generate an agent's response.
• Google — authenticates sign-in and, if you connect it, sends email or reads calendar data you request.
• Twilio — delivers and receives the SMS messages described above.
• Meta (Instagram) and TikTok — publish posts you explicitly schedule.
• Supabase — hosts our database and handles authentication.
• Vercel — hosts the application itself.

We may also disclose information if required by law, or to protect the rights, property, or safety of Agent Polo, our users, or the public.

Data retention

We retain account information for as long as your account is active. Agent run inputs/outputs are not retained beyond serving your request. Rate-limiting and message-outcome logs are retained only as long as needed to operate abuse prevention. If you disconnect a Google, phone, Instagram, or TikTok connection, we delete the associated stored token promptly.

Data security

OAuth refresh tokens and social platform access tokens are encrypted at rest using AES-256-GCM. Access to our database is restricted to server-side code using a service-role key that is never exposed to your browser. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices.

Your choices and rights

• You can revoke any Google access you granted us at any time from your Google Account's security settings (myaccount.google.com/permissions), which removes our access to send email or read your calendar.
• You can stop SMS messages at any time by replying STOP, which Twilio enforces at the platform level.
• You can request deletion of your account and associated data by contacting us using the details below.
• If you are in the EEA, UK, or a US state with its own privacy law, you may have additional rights to access, correct, or delete your personal information; contact us to exercise them.

Children's privacy

Agent Polo is not directed to, and we do not knowingly collect personal information from, anyone under the age of 18. If you believe a child has provided us with personal information, contact us and we will delete it.

International users

Agent Polo is operated from the United States and our service providers store and process data in the United States. If you access Agent Polo from outside the United States, your information will be transferred to, stored, and processed in the United States.

Changes to this policy

We may update this policy as the product changes. We will update the “Last updated” date above when we do, and material changes affecting how we handle phone number or SMS data will be reflected here before they take effect.

Contact us

Questions about this policy, or requests to access or delete your data, can be sent to ai-marketplace@linotechnologies.com.