DRAFT — not legal advice. Written on 17 Oct 2026 as a starting point. Have a lawyer review it before publishing. Placeholders are in [BRACKETS].
Privacy Policy: agentprose Cloud
Last updated: [DATE]
1. Who we are
agentprose Cloud ("we", "us") is operated by [BUSINESS NAME, ENK/AS], organisation number [ORG NO], [ADDRESS], Norway. Contact: hello@agentprose.cloud.
This policy covers two groups of people:
- Account holders: people who sign up for agentprose Cloud. For their data we are the controller.
- Visitors to our customers' websites, and the AI agents acting for them. Our customers decide to install agentprose on their sites and are the controllers for that data. We process it as their processor under our Data Processing Agreement. If you're a visitor, contact the website owner first; we'll help them answer you.
2. What we collect
2.1 Account data (we are controller)
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | log-in, service and billing messages | contract (6(1)(b)) |
| Password, stored only as a scrypt hash | log-in | contract |
| Session cookie (random token; we store only its hash) and a CSRF token | keep you logged in, protect forms | contract / legitimate interest (6(1)(f)); strictly necessary, no consent needed |
| Your sites, API keys (secret keys stored only as a SHA-256 hash), settings, plan, usage counters | provide the service and enforce plan limits | contract |
| Billing: Stripe customer ID, subscription ID, plan, status. Name, billing address and VAT ID are collected and kept by Stripe | take payment, issue invoices, calculate VAT | contract; legal obligation (6(1)(c)) for bookkeeping |
We never see or store card numbers. Payments are handled by Stripe (see §5).
2.2 Agent-activity data from customers' sites (we are processor)
When a site uses agentprose with our cloud features, the site sends us one record per tool call an AI agent makes. A record contains:
- site, timestamp, tool name, success or error, latency in ms;
- page path, with the query string removed;
- for search tools, the search text typed by the agent (max 200 characters) and the result count;
- for citation checks, whether the quote was found;
- the agent family (e.g. "ChatGPT", "Claude", "other"), worked out from the User-Agent header. The User-Agent string itself is not stored;
- a daily-rotating salted hash of IP address + User-Agent + site, used only to count unique agents per day. The raw IP address is never stored; the salt changes every day and the old salt is deleted, so hashes can't be linked across days.
We don't set cookies on our customers' visitors and don't store page content from visitor sessions. Search text is written by AI agents. It rarely contains personal data, but it might (for example if a person asks an agent to search for a name). That is why it has a retention limit, and each customer can turn off search-text capture for their sites.
For the hosted search index we also store the published content of our customers' sites (titles, summaries, text, tags, author names as published), fetched from their public feeds or uploaded by them.
3. How long we keep it
- Agent-activity records: per the customer's plan, 30 days (Free), 365 days (Pro), 730 days (Team), then deleted automatically.
- Account data: while the account is open. When an account is closed, we delete its sites, records and index within [30] days. Backups roll off within [BACKUP RETENTION, e.g. 7–35] days.
- Billing records: as long as Norwegian bookkeeping law requires (the Bookkeeping Act sets [5 years] for primary documentation [lawyer/accountant to confirm]). Stripe keeps its own records under its own policy.
- Server logs and traces: [30] days.
4. Where it's stored
On Microsoft Azure in the Norway East region. See Sub-processors.
5. Who we share it with
- Microsoft Azure (hosting, database, secrets, monitoring) as our processor.
- Stripe (payments, invoices, tax calculation). Stripe processes billing data partly as our processor and partly as an independent controller, as described in its DPA (https://stripe.com/legal/dpa) and privacy policy (https://stripe.com/en-no/privacy).
- Authorities, when the law requires it.
We don't sell personal data and don't use it for advertising.
6. International transfers
Our primary hosting is in Norway (EEA). Stripe may transfer data outside the EEA; it relies on safeguards described in its DPA and Data Transfer Addendum (https://stripe.com/legal/dpa).
7. Your rights
You have the right to access, rectify, erase, restrict, object to processing of, and port your personal data (GDPR Art. 15–21). Email hello@agentprose.cloud. We answer within one month. You can complain to the Norwegian Data Protection Authority, Datatilsynet: https://www.datatilsynet.no/en/
8. Security
TLS in transit; encryption at rest on Azure; passwords hashed with scrypt; secret API keys and session tokens stored only as hashes; secrets in Azure Key Vault; least-privilege managed identities.
9. Changes
We'll post changes here and email account holders about material ones.
Applicable law: Personal Data Act (personopplysningsloven), which incorporates the GDPR into Norwegian law: https://lovdata.no/dokument/NL/lov/2018-06-15-38