Privacy Policy
Last updated 20 July 2026
Agenta reads your inbox for one purpose: to identify the requests directed at you. Because that is genuinely sensitive, this policy is specific about what we access, where it goes, and what you can demand of us.
Who is responsible for your data
Agenta is operated by C.S DENG & P MA, a general partnership established in Australia (ABN 77 904 113 957), at 30 Kinarra Street, Ashmore QLD 4214, Australia. We are the data controller for the information described here. Privacy questions and requests: connor.si.deng@gmail.com.
What we access
With your explicit authorisation, Agenta reads email metadata and message content from the mailboxes you connect, and reads your calendars. We request read-only mailbox access, we cannot send, delete, or modify email. Calendar events are created only when you explicitly ask for one.
What we store
We store extracted tasks, the message context attached to those tasks, task updates, projects, collaboration membership, connected-account credentials encrypted at rest, feedback you submit, a bounded cache of calendar events, and subscription status and identifiers from Stripe. Stripe processes payment-card details; Agenta does not store your full card number. We do not copy or retain your entire mailbox.
Why we are allowed to do this
Where the GDPR or similar law applies, our lawful bases are: performance of a contract for scanning your inbox and maintaining your agenda, since that is the service you signed up for; consent for analytics cookies, which you can give or refuse without losing any functionality; and legitimate interests for keeping the service secure and preventing abuse.
People who email you
Your inbox contains other people's personal information. When Agenta processes a message someone sent you, we handle their name, address, and words too, they have no account with us and never agreed to anything. We rely on legitimate interests for this, we process only what is needed to identify a request, and we do not build profiles of senders, market to them, or use their data for anything beyond your agenda. Senders have the same rights listed below and can contact us directly.
Who else sees your data
We do not sell your personal information, and we do not share it for advertising. We use these service providers:
| Provider | What it does | Where |
|---|---|---|
| OpenAI | Extracts requests from email content. Receives message text during a scan. | United States |
| Supabase | Database, authentication, and storage of tasks and encrypted account credentials. | Managed cloud infrastructure |
| Vercel | Application hosting and request routing. | Global edge network |
| PostHog | Product analytics and error reporting. Only active if you accept analytics cookies. | European Union |
| Stripe | Processes subscription payments, invoices, refunds, and billing-account details. Agenta does not receive your full card number. | Global payment infrastructure |
| Gmail and Google Calendar access you explicitly authorise, and Google sign-in. | United States | |
| Microsoft | Outlook mailbox access you explicitly authorise. | United States |
Google user data
Agenta's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Gmail and Calendar data only to provide the features you can see in Agenta, we do not transfer it except as needed to provide those features or as required by law, we do not use it for advertising, and we do not use it to train or improve any generalised AI model. Message text is sent to OpenAI to extract requests under terms that prohibit using it for model training. No human at Agenta reads your email except where you specifically ask us to investigate a problem.
International transfers
We are based in Australia and some providers process data in the United States. Where data protected by the GDPR leaves the EEA, that transfer relies on the European Commission's Standard Contractual Clauses in our agreements with those providers.
How long we keep it
Tasks and their attached message context are kept until you delete them or delete your account. Connected-account credentials are deleted when you disconnect that account. Deleting your account removes Agenta-owned data within 30 days, except where we must retain something to meet a legal obligation. Aggregated usage counts that cannot identify you may be kept longer.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can delete your account and its data yourself from Settings at any time, and disconnect any mailbox without deleting your account. To make any other request, contact connor.si.deng@gmail.com. We respond within 30 days and will not charge you or degrade your service for asking.
If you are in the EU or UK, you may complain to your national supervisory authority. In Australia, you may complain to the Office of the Australian Information Commissioner. We would appreciate the chance to fix it first.
US state privacy rights
If you live in a US state with a consumer privacy law, you have rights to know, delete, correct, and opt out of sale or targeted advertising. Agenta does not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. Exercise the other rights through the contact address above.
Cookies
We set only strictly necessary cookies unless you accept analytics. See the Cookie Policy for the full list and to change your choice.
Security
Credentials are encrypted at rest, data is encrypted in transit, and access is enforced by row-level rules. See Security. If a breach affects your rights we will notify you and the relevant regulator as required by law.
Children
Agenta is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
We will update this page when our practices change and revise the date above. If a change materially affects your rights we will tell you in the app before it takes effect.
Alpha notice
Agenta is currently an alpha product. Avoid connecting regulated, highly sensitive, or business-critical accounts until the security and retention controls have been independently reviewed.