Privacy Policy

Last updated: October 31, 2026

This Privacy Policy explains how Webtelic.AI LLC, based in Oregon, United States ("Webtelic.AI", "Company", "we", "us", "our"), collects, uses, shares and protects personal information when you use webtelic.ai, the AEGIS platform and our related services (the "Service"), and the choices and rights you have. We decide how your personal information is processed. If you do not agree with this policy, please do not use the Service. Terms such as "Your Content" and "Output" have the meanings given in our Terms of Service.

Summary of Key Points

• What we collect: your Google account profile, the content you put into the Service, billing and usage records, and technical log data.
• AI processing: your prompts and project content are sent to AI model providers to generate responses. We do not use Your Content to train AI models.
• No selling, no ad tracking: we do not sell your personal information or share it for targeted advertising, and we do not use advertising or analytics cookies.
• Agent reviews: we keep a record of how your agents and AI helpers run, and we may review it, and the content of recent runs, to stop misuse and to fix problems.
• Payments: card payments are handled by Stripe; we never see your full card number.
• Your rights: you can ask to access, correct, export or delete your information.

1. Scope

This policy covers personal information we process when you visit our websites, sign in to and use the Service, contact us, or otherwise deal with us. It does not cover how applications that our customers build and publish with the Service handle their own users' information; section 10 explains our role for those applications. It also does not cover third-party websites or services that you reach through the Service, which have their own policies.

2. Information We Collect

2.1 Information from your sign-in provider

When you sign in with Google, Google shares your name, email address, profile picture and a unique account identifier with us. We request only Google's basic sign-in permissions ("openid", "profile" and "email"); we do not receive access to your Gmail, Google Drive, contacts or other Google data, and we never receive or store your Google password. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not control Google's own use of your information; see Google's privacy policy for that.

2.2 Content you provide

We store the content you put into the Service ("Your Content"), including:

• messages and prompts you write, and files, screenshots and images you attach or upload;
• project code and files, and the data in your project databases;
• the history of your agent sessions and chats, including the agent's replies and the results of the steps it ran;
• images you generate;
• custom agent instructions, scheduled tasks, notes the agents save for later, policies and other settings;
• the requests your applications send to their AI helpers, and the helpers' answers;
• passwords, API keys and other credentials you add to your projects.

Images you upload for editing are checked and re-encoded, which removes embedded metadata such as camera details and location.

2.3 Billing information

We keep your plan, subscription status and renewal date, payments and top-ups, usage balance, auto top-up settings, and the identifiers Stripe gives us for your customer record and payments. Card details are entered directly with Stripe and handled under Stripe's privacy policy; we receive only limited information from Stripe, such as whether a payment succeeded.

2.4 Usage information

For each AI request we record the model used, the tokens or images processed, the price charged, the time, and the session or feature it belongs to. We also record which features you use and the projects and applications you run. For each run of an agent or AI helper, we also record how it ran: when, for which agent and application, the model used, how long it took, what it cost, its steps and web lookups, whether it succeeded or why not, and requests that were refused. This information is linked to your account: it is shown on your Usage page and used for billing.

2.5 Log and device information

When you visit our websites or use the Service, and when anyone visits an application hosted on the Service, our servers automatically record technical information such as the IP address, browser type and version, operating system, the pages and addresses requested, the referring page, the date and time, and the response status, size and time. We also record error reports and security events, such as blocked or failed requests.

2.6 Information you send us

When you use our contact form, we receive your name, email address, company, subject and message, together with your IP address. We also keep your support conversations, feedback and any notices you send us.

2.7 Information from other users

If a workspace owner invites you to their workspace, we receive the email address they enter.

2.8 Sensitive information

We do not ask for sensitive personal information, such as health information, government identification numbers, financial account numbers, biometric data or precise location. Please do not include it in prompts, projects or uploads. If you do, you are responsible for having the right to share it, and it is processed like the rest of Your Content.

3. How We Use Information

We use personal information to:

• Provide the Service: sign you in; run agent sessions, chats, image generation and scheduled tasks; build, run and host your applications; store your projects; and run automated code reviews and security audits on your projects.
• Bill you: charge plan fees, top-ups and usage, show your usage and balance, and run automatic top-up.
• Communicate with you: send administrative messages about your account, billing, security and changes to our terms and policies, and respond to your inquiries and support requests.
• Keep the Service secure: monitor logs to detect, block and investigate attacks, fraud and abuse (including by blocking IP addresses), and enforce our Terms.
• Review agents: check the run records of agents and AI helpers, and where needed the conversations of their runs, to find agents that fail, cost unusually much, harm an application or break our Terms; to limit, adjust or suspend them; and to answer your support requests. Automated checks flag unusual agents for review by authorized staff, and we keep a record of every action our staff take on an agent.
• Maintain and improve the Service: diagnose problems, plan capacity and understand how features are used, using usage records and logs. We do not use Your Content to train AI models.
• Meet legal obligations: comply with law, respond to lawful requests, keep tax and accounting records, and establish, exercise or defend legal claims.
• Protect people: where necessary to prevent harm to someone's life, health or safety.
• Other purposes with your consent, which we will ask for when needed.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated systems do enforce usage limits and your balance and block traffic that looks like an attack; you can contact us to have any such action reviewed by a person.

4. How AI Models Process Your Information

The Service is built on AI models provided by third parties ("AI providers"). When you use the coding agent, Chat, image generation, custom agents or scheduled tasks, when your applications ask their AI helpers, and when automated code reviews and security fixes run on your projects, the relevant parts of Your Content are sent to the AI provider serving the model in use. That can include your message, the conversation so far, project files, data the agent reads from your project database, the results of the agent's steps, and images you provide.

• We access most models through Atlas Cloud, an AI model platform in the United States, which runs models itself or passes requests to the model's developer, such as OpenAI, Google, xAI, DeepSeek, Alibaba (Qwen), Moonshot AI, ByteDance, Zhipu AI or MiniMax. We may also send requests directly to a model's developer. AI providers may process your content in the United States or in other countries.
• You choose the model for your own sessions and chats; the model picker shows which model handles your requests. We choose the models used for automated tasks such as code reviews.
• AI providers process your content under their own terms and privacy policies, which may allow them to keep it for a limited time, for example to monitor for abuse or to comply with law. We do not control their practices.
• We do not use Your Content to train AI models. If you do not want certain information processed by an AI provider, do not include it in your prompts, projects or uploads.

AI Output can be inaccurate; see section 7 of our Terms of Service.

5. When and With Whom We Share Information

We do not sell your personal information, and we do not share it for targeted (cross-context behavioral) advertising. We share personal information only as follows:

• Service providers that process it for us to run the Service:
  • AI providers, as described in section 4;
  • hosting, infrastructure, storage and domain name providers that run the Service and your applications;
  • Stripe, for payments;
  • Google, for sign-in;
  • email providers that deliver the messages we send and receive;
  • the OSV vulnerability database (osv.dev, operated by Google): nightly security audits send it the names and versions of the software libraries your project uses, to look up known vulnerabilities. Your code is not sent;
  • Google Fonts: our pages load fonts from Google's servers, so Google receives your IP address and browser information when they load.
• People and services you choose: team members you invite, and the people you share projects with, can see the content of those projects. Anything you publish at an application's web address is public. MCP servers and other tools you connect to a session receive the information sent to them.
• Legal and safety reasons: when we believe in good faith that disclosure is required by law, subpoena, court order or other legal process; to protect the rights, property or safety of Webtelic.AI, our users or others; to investigate fraud, abuse or security incidents; or to enforce our Terms. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children.
• Business transfers: in connection with, or during negotiations of, any merger, sale of company assets, financing, acquisition, reorganization or bankruptcy involving all or part of our business.
• Affiliates: with any company we control or are under common control with, which must honor this policy.
• With your consent or at your direction.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Cookies & Similar Technologies

We use only the cookies and browser storage needed to run the Service: a session cookie used while you sign in with Google, and your browser's local storage for your sign-in token and settings such as the plan you selected and your display preferences. We do not use advertising cookies, analytics trackers, tracking pixels or third-party ad networks on our websites or in the app. If you block cookies or browser storage, signing in may not work.

Do Not Track and Global Privacy Control. Because we do not sell personal information or use it for targeted advertising, there is nothing for these signals to opt you out of, and our practices are the same whether or not your browser sends them. If that ever changes, we will treat a Global Privacy Control signal as a valid request to opt out.

7. How Long We Keep Information

We keep personal information only as long as necessary for the purposes in this policy, unless a longer period is required or permitted by law.

• Account information and Your Content: while your account is active. Content you delete is removed from our active systems.
• After your account closes: we may keep your workspace data for up to 30 days so you can ask for a copy, and then delete or de-identify it, except as described below.
• Agent runs: the conversation of a run that answered a request from your application (the request, the agent's steps and its answer) is deleted after 30 days. Its run record, without the request or the answer, is kept for 180 days, and the history of your scheduled tasks for 90 days. The sessions of scheduled and manual runs stay in your workspace like your other sessions.
• Billing and transaction records: as long as required for tax, accounting and legal purposes, generally up to seven years.
• Logs and security records: as long as needed for security, fraud prevention and investigating incidents. Logs are moved daily from our production servers to a separate restricted system for analysis.
• Backups: deleted information may remain in backups until they are replaced. We keep backups isolated from further processing until they can be deleted.
• Legal holds: we may keep information longer where needed to resolve disputes, enforce our agreements or comply with a legal obligation.

8. How We Protect Information

We use reasonable organizational and technical measures designed to protect personal information, including:

• HTTPS encryption for connections to our websites, the app and hosted applications;
• sign-in through Google, so we never store a password for you;
• access controls that keep each workspace's data separate, with projects shared only with the people you choose;
• running customer applications under a separate, restricted system account, apart from the platform;
• keeping passwords and keys out of the agent's replies;
• checking and re-encoding uploaded images, and limiting upload sizes and request rates;
• monitoring server logs for attacks and blocking addresses that attack the Service;
• limiting staff access to personal information to what their work requires.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorized third parties will never defeat our security and improperly collect, access, steal or modify your information. Transmission of personal information to and from the Service is at your own risk; you should only access the Service within a secure environment. If a security breach affects your personal information, we will notify you as required by law.

9. International Users & Transfers

The Service is operated from the United States. Your information is processed in the United States and in the other countries where our service providers, including AI providers, operate. Data protection laws in those countries may differ from those where you live. By using the Service, you consent to your information being transferred to, stored and processed in those countries, where consent is a valid basis for the transfer under the law that applies to you.

10. Applications You Build

Applications our customers build and publish with the Service may collect personal information from their own users, such as accounts, form submissions and data stored in the project database, and our servers log requests to them. For that information:

• the customer who owns the application decides what is collected and why, is responsible for giving the application's users a privacy notice, and handles their requests;
• we act as the customer's service provider: we process the information only to host, run, secure and support the application, and as the customer directs when they use the Service, which can include sending it to AI providers while an agent works on the project or when the application asks one of its AI helpers;
• we may access it to investigate abuse or security incidents, enforce our Terms or comply with law.

If you use an application built on the Service, please contact its owner about your information. Where appropriate, we pass on requests we receive to the application's owner.

11. Your Privacy Rights

Depending on where you live, you may have the right to:

• access your personal information and get a copy of it;
• correct inaccurate personal information;
• delete your personal information;
• receive your information in a portable format;
• object to or restrict certain processing;
• withdraw consent you have given, without affecting processing that took place before;
• not be subject to decisions with legal or similarly significant effects based solely on automated processing;
• complain to a data protection authority.

How to review, update or delete your data. You can view much of your information in the app, including your profile, projects, sessions and usage. To make any other request, including to close your account and delete your data, contact us through our contact page with the subject "Privacy Request". We will verify your identity, usually by confirming the email address on your account, and respond within the time the law requires. When we close your account, we delete or deactivate your information in our active systems, but we may keep some information as described in section 7, for example to prevent fraud, troubleshoot problems, assist with investigations, enforce our Terms or comply with legal requirements.

Marketing messages. We do not currently send marketing emails. If we do, each will include an unsubscribe link. We may still send you service messages needed to run your account, such as billing, security and policy notices.

11.1 European Economic Area, United Kingdom and Switzerland

If the EU or UK General Data Protection Regulation applies to you, we rely on these legal bases: performance of a contract, to provide the Service and bill you; legitimate interests, to secure the Service, prevent fraud and abuse, and maintain and improve the Service, where those interests are not overridden by your rights; legal obligations, such as tax records and lawful requests; consent, where we ask for it, which you can withdraw at any time; and vital interests, to protect someone's life or safety. You may complain to your local data protection authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner.

11.2 Canada

We process your information with your express or implied consent, which you may withdraw at any time subject to legal and contractual restrictions, or without consent where the law permits, for example to investigate fraud or a breach of an agreement, or to comply with a subpoena, warrant or court order.

12. United States Residents

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have additional rights to the extent that law applies to us.

12.1 Categories of personal information we collect

In the past twelve months we have collected the following categories of personal information:

• Identifiers (name, email address, Google account identifier, IP address, account and customer identifiers): yes.
• Personal information in the California Customer Records statute (name, email address, limited payment information): yes.
• Protected classification characteristics (such as age, race or gender): no, unless you include them in Your Content.
• Commercial information (plans, payments, top-ups, usage and charges): yes.
• Biometric information: no.
• Internet or other network activity (log data and how you use the Service; we do not track you on other websites): yes.
• Geolocation data: no precise location; an IP address can indicate an approximate region.
• Audio, electronic, visual or similar information (your profile picture, and images you upload or generate): yes.
• Professional or employment-related information: limited to a company name you give us.
• Education information: no.
• Inferences used to build a profile of your preferences or characteristics: no.
• Sensitive personal information: no. We do not use or disclose sensitive personal information to infer characteristics about you.

We collect this information from you, from Google when you sign in, from Stripe, from workspace owners who invite you, and automatically from your browser or device. We use it for the purposes in section 3, keep it for the periods in section 7, and disclose it for business purposes to the recipients in section 5.

12.2 No sale or sharing

In the past twelve months we have not sold personal information, and we have not shared it for cross-context behavioral or targeted advertising, or used it for profiling that produces legal or similarly significant effects. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

12.3 Your rights

Subject to the law of your state, you may have the right to:

• know whether we process your personal information, and access it;
• correct inaccuracies in it;
• delete it;
• obtain a copy of it in a portable format;
• obtain a list of the categories of third parties, or of the specific third parties, to which we have disclosed it;
• opt out of its sale, its use for targeted advertising, and profiling (we do none of these);
• limit the use of sensitive personal information (we do not use it in ways that give rise to this right);
• not be discriminated against for exercising your rights.

How to exercise your rights. Contact us through our contact page with the subject "Privacy Request". We will verify your identity using information we already hold and may ask for more if needed; we use information provided for verification only for that purpose. You may use an authorized agent; we may require written, signed permission from you and may verify your identity directly. We may deny a request where the law allows, and will explain why.

Appeals. If we decline to act on your request, you may appeal by contacting us with the subject "Privacy Request" and the word "Appeal". We will tell you in writing what action we took or did not take in response, and why. If your appeal is denied, you may contact your state attorney general.

California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing purposes. California residents may ask us about this once a year, free of charge, through our contact page.

13. Children's Privacy

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from someone under 18, we will delete it and close the account. If you believe we hold information about a child, please contact us.

14. Changes to This Policy

We may update this Privacy Policy from time to time, including to stay compliant with applicable laws. The "Last updated" date at the top shows when it last changed. We will notify you of material changes by email or through the Service. Please review this policy regularly.

15. Contact Us

Webtelic.AI LLC, Oregon, United States. For privacy questions or requests, contact us at webtelic.ai/contact with the subject "Privacy Request".