Privacy Policy

AgentAIShield by You! Ventures LLC ("AgentAIShield," "we," "us," or "our") provides an AI agent security monitoring platform. This Privacy Policy describes how we collect, use, store, and disclose information about you when you use our website, API, dashboard, and related services (collectively, the "Service").

1. Data We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password (stored as bcrypt hash). For team accounts, we collect organization name and the names and emails of invited members.

1.2 API Request Logs (Monitoring Data)

When your AI agents make requests through the AgentAIShield proxy, we log:

• Request metadata — timestamp, model provider, model name, API key ID, response latency, token counts (prompt and completion), HTTP status code
• PII detection metadata — entity types detected (e.g., "email," "SSN," "credit_card"), detection confidence scores, and redaction actions taken. We store the type of PII detected, not the PII values themselves.
• Injection detection signals — classifier scores, detected attack patterns, and whether the request was blocked or allowed
• Agent metadata — API key labels, agent identifiers you assign, and custom tags you configure
• Cost tracking data — token usage, estimated costs based on published provider pricing, and budget threshold events

What we do NOT log: We do not store the raw prompt or completion text by default. Request body inspection for PII and injection detection is performed in memory and discarded. Customers on Business+ plans may opt in to full request logging with appropriate data handling agreements.

1.3 Agent Trust Score™ Data

To compute and maintain each agent's Trust Score, we process and store: PII leak frequency, injection attempt rates, response consistency signals, data handling scores, and behavioral patterns over rolling time windows. This data is associated with your API key and organization, not with any individual.

1.4 Usage Analytics

We collect anonymized product usage data: pages visited in the dashboard, features used, button clicks, and session duration. We use this to understand how to improve the product. This data is never linked to your request traffic or monitoring data.

1.5 Billing Information

Payment is handled by Stripe. We store only your Stripe customer ID and the last four digits of your card. We never see or store full card numbers.

1.6 Communications

If you contact us via email or support, we retain those communications to respond and track issues. We do not share support communications with third parties.

2. How We Use Your Data

2.1 Service Delivery

• Proxy and analyze AI requests in real time
• Compute and update Agent Trust Scores
• Enforce budget limits and rate caps
• Generate compliance reports and audit trails
• Detect and alert on security anomalies

2.2 Product Improvement

• Improve detection model accuracy using aggregated, anonymized signal data (never raw content)
• Develop new features based on usage patterns
• Conduct performance optimization and capacity planning

2.3 Account Operations

• Send transactional emails (account confirmation, password reset, usage alerts, billing receipts)
• Provide customer support
• Enforce our Terms of Service

2.4 Marketing (opt-in only)

With your explicit consent, we may send product newsletters and announcements. You can unsubscribe at any time from any email or via account settings. Unsubscribing does not affect transactional emails.

3. Data Sharing

We do not sell your data. Ever.

3.1 Sub-processors

We use a small number of trusted service providers to operate the platform:

• AWS / Railway — cloud infrastructure and hosting. Data processed in US-East regions.
• Stripe — payment processing (PCI-DSS Level 1 certified)
• Resend / Postmark — transactional email delivery (processes email addresses only)

A complete and current list of sub-processors is available at [email protected] upon request, or in our DPA.

3.2 Legal Disclosures

We may disclose data if required by law, court order, or to protect our rights or the safety of users. We will notify affected customers unless legally prohibited from doing so.

3.3 Business Transfers

In the event of an acquisition or merger, your data may be transferred to the successor entity under equivalent privacy protections. We will notify you at least 30 days in advance.

4. Data Retention

• Request logs & monitoring data — 30 days (Free), 30 days (Starter), 90 days (Business), 1 year (Enterprise). Configurable within your plan limits.
• Agent Trust Score history — Retained for the lifetime of the API key, then deleted within 30 days of key deletion
• Account data — Retained while account is active. Deleted within 90 days of account closure, except records required for legal/tax compliance (up to 7 years)
• Billing records — 7 years per tax and financial regulations
• Support communications — 2 years

5. Your Rights

5.1 Access

Request a full export of your account data and monitoring metadata in JSON format. Available via the dashboard under Settings → Data Export, or by emailing us.

5.2 Deletion

Delete your account and all associated data at any time from Settings → Account → Delete Account. Processing completes within 30 days.

5.3 Correction

Update your account information, organization details, and notification preferences directly in the dashboard at any time.

5.4 Portability

Export your monitoring data, Trust Score history, and configuration in machine-readable formats. Available on all paid plans.

5.5 Opt-Out of Marketing

Use the unsubscribe link in any marketing email, or toggle off in Settings → Notifications. We will honor your preference within 10 business days.

6. Cookies & Tracking

AgentAIShield uses only essential cookies required for the Service to function:

6.1 Essential Cookies

• Authentication cookies — HTTP-only session tokens that keep you logged in. These expire when you log out or after 7 days of inactivity.
• CSRF tokens — Security tokens that protect against cross-site request forgery attacks. These are session-scoped.
• Preferences — Local storage entries for UI preferences (theme, dismissed notifications). These never leave your browser.

6.2 Analytics & Third-Party Tracking

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not share cookie data with any third parties.

Infrastructure-level analytics (e.g. Cloudflare Web Analytics) may be enabled at the network layer. This collects no personally identifiable information and sets no cookies in your browser.

6.3 Managing Cookies

You can clear all cookies at any time through your browser settings. Clearing authentication cookies will log you out of the Service. You can also use the cookie consent banner to record your preference.

We do not use advertising cookies or any third-party ad networks. Ever.

7. Security

See our Security page for a full description of our technical and organizational security measures, including encryption, access controls, and incident response. For data breaches, we notify affected customers within 72 hours of discovery.

8. Children

Our Service is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us data, contact us immediately at [email protected].

9. International Transfers

Our infrastructure is located in the United States. If you access the Service from the European Economic Area, UK, or Switzerland, your data is transferred to the US under appropriate safeguards (Standard Contractual Clauses). See our GDPR page for details.

10. Changes to This Policy

We will notify you via email at least 14 days before any material changes take effect. We will also display a prominent notice in the dashboard. Your continued use after changes take effect constitutes acceptance.