Privacy Policy
How we handle information from our website, platform and connected services.
Last updated .
Ask a privacy questionOn this page
Scope
This policy describes how Atellagent, Inc. handles information from our website and contact forms, hosted platform and workspaces, agents and workflows, desktop apps, Atellagent Client and customer-configured connections to other services.
It does not replace the Customer Agreement or separate data processing terms that apply to your use of the service. Connected services and model providers also have their own terms and privacy practices. An organization using Atellagent controls the information it submits and the connections, permissions and policies it configures. Where we process information on its behalf, we do so to provide the service under the applicable agreement.
What we collect
We collect information needed to provide the features you use, operate the service and respond to requests.
Contact and account information
- For inquiries: name, email address, organization, request type, timing and message content.
- For accounts: user and organization identifiers, profile and membership information, roles, sign-in and authorization records, agreement acceptance and support communications.
- For billing: billing contact information, selected plans, subscriptions, usage, invoices, transaction identifiers and payment status. Our payment processor handles payment card details; Atellagent does not store full payment card details.
Platform content and configuration
Depending on the features you use, we process prompts, messages, attachments, model outputs, repository content, code changes, files and generated artifacts; policies, filters, workflow configuration and execution state; and user, agent, service and integration identities and access settings.
This describes information the service may process, not permission to submit it. The Customer Agreement's restrictions on production systems, production data and credentials, and personal, sensitive or regulated content still apply.
Connected services and credentials
A configured connection may access or return business records, documents, messages, comments, repository content, user or account identifiers, object identifiers, timestamps and permission information. A requested action may send content or changes to the connected service. The information involved depends on the service, permissions and action.
We process OAuth authorizations and tokens, application credentials, API keys, certificates and connection settings where the selected integration or authentication method requires them. Use the designated credential setup controls instead of placing credentials in prompts or ordinary messages. You must have authority to connect services and submit or access the information.
Desktop apps and Atellagent Client
The desktop apps and Client process local configuration, connection definitions, authentication material and diagnostics needed for their selected features. Discovery inspects supported agent settings and declared MCP servers on your machine. When discovery reporting is enabled, the service receives installation and client-version information, reporting times, supported-agent detection flags, and declared MCP server names and transport types. Discovery reports do not contain the contents of your files, conversations or credential values.
Local MCP setup also processes the endpoint or local program configuration needed to run the connection. Separately from discovery, governed agent and tool requests can include commands, file paths, arguments, content and results that reach a supported control boundary. Connecting an agent does not mean every action or file on the device is sent to Atellagent.
Technical and operational data
- Request metadata such as timestamps, requested pages, browser or device information and referrer data. Normal hosting, security and operational logs may include IP addresses and proxy-level request information.
- Execution and tool-call metadata, policy decisions, approvals, errors, usage metrics and audit or delivery evidence. Depending on the feature and retained record, these can contain request or result content.
- Conversation history, workflow state, summaries, memory and other retained context used to continue or review customer work.
- First-party website conversion events limited to event type and page path, such as a website button or contact-form action. These events do not include contact-form text, prompts, policy text, repository content, credentials or customer payloads. This limitation applies to website conversion events, not all platform records.
How we use it
Respond to inquiries
We use contact-form information to respond to demo requests, technical reviews, enterprise planning inquiries, and other business inquiries.
Provide the platform
We use platform and connected-service information to carry out customer-directed requests, authenticate users and services, manage connections, evaluate configured policies, coordinate agents and workflows, deliver outputs, administer subscriptions and billing, and retain the context and evidence used by the selected features.
Process information with models
Configured features may use a model to generate output, help author a policy, review an action, analyze content or summarize context. Information supplied to that feature, including relevant retained context, may be processed by the model provider involved. Provider processing, retention and any use for model improvement depend on the applicable provider terms, account settings and agreements.
Operate, support and protect the service
We use technical and operational information to serve pages, diagnose problems, maintain reliability, provide support, detect abuse or unauthorized activity, and secure the service. Operational metrics also help us improve the service and understand aggregate usage.
Improve our business processes
We may review high-level first-party website usage and inquiry patterns to understand interest in our product and business processes. Our first-party marketing measurement is limited to event type and page path. If you allow optional analytics, we also use HubSpot to understand website visits and how visitors reach us. HubSpot may process visited URLs, timestamps, IP addresses and browser identifiers. When you submit our contact form with analytics enabled, we may include your HubSpot visitor identifier to associate your inquiry with tracked visits. Contact requests are delivered through HubSpot whether or not you allow analytics. See HubSpot’s Privacy Policy (opens in a new tab) for its processing practices.
Cookies and browser storage
We use cookies and browser storage for functions such as sign-in, session security, preferences and local drafts. We also store your analytics choice in this browser for up to six months. We retain consent-choice records for one year, using a random identifier, the notice shown and a timestamp, without linking them to your account. HubSpot analytics loads only after you allow it. Use Cookie settings in the website footer to allow or decline analytics later; declining stops future analytics and removes accessible HubSpot analytics cookies, but does not erase information already received. Browser controls can clear or restrict storage, which may sign you out or affect those features. Our website does not change its behavior in response to browser Do Not Track signals.
Retention
We retain contact requests for business follow-up, sales evaluation, recordkeeping, and security purposes. We retain technical and operational logs for troubleshooting, abuse prevention, and infrastructure monitoring for periods that are appropriate to those purposes.
Platform retention depends on the record, features used, the applicable plan's retention windows and available customer controls. Connection information, policies, decision and audit evidence, workflow records, messages, summaries and memory can have different lifecycles. Automated lifecycle cleanup removes records beyond applicable retention windows. A plan downgrade or lapse can shorten those windows; see the Customer Agreement and Tier Schedule before changing your plan or exporting information you need to keep.
Deleting an original message or source object does not necessarily remove every retained copy immediately. Retention and deletion procedures vary by feature and connected service. Any backup copies follow their own lifecycle; this policy makes no backup, recovery or durability commitment.
Disconnecting a service or withdrawing an authorization is different from deleting information already retained in Atellagent. Retained records require the applicable deletion or retention process. Removing information in Atellagent does not by itself delete your original records at a connected service. Information already sent to a connected service or model provider is also subject to that recipient's practices. Local application files and settings have a separate lifecycle from hosted records.
Your choices
Customers and authorized administrators can manage connections, permissions, policies and available retention, export or deletion controls in the product. Users can manage their own authorizations where the feature permits; organization-wide settings may require an administrator. Discovery reporting controls are available in the desktop app. The signed-in Privacy & Deletion page provides available account and organization actions; it is separate from this public policy.
Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of or a copy of personal information we hold about you, or to object to or restrict certain processing and withdraw consent where processing relies on it. Use the Contact page to identify a privacy request. For information processed through an organization's workspace, its administrator may need to be involved.
We may need to verify your identity and authority before acting. Some information may be retained where required for legal, security or legitimate business reasons. The Customer Agreement explains the service's pre-production limitations and customer responsibilities. The service is intended for business use and is not directed to children under 13. Contact us if you believe a child has provided personal information.
Policy updates
We will post updates on this page and change the last-updated date. Where applicable law requires additional notice about a material change, we will provide that notice.
Contact
If you have questions about this Privacy Policy or want to make a privacy-related request, please use the Contact page and identify your request as a privacy inquiry.
Ask a privacy question