Last Revised: 30 June 2026

AGILEWORK PRIVACY POLICY

Agilework (“we,” “us,” “our”) provides the AgileBot service at agilebot.dev and the AgileBot Roblox Studio plugin (the “Service”). This privacy policy explains how we collect, use, share, and protect your personal data when you use the Service.

We are the data controller for personal data processed through the Service:

We may update this policy from time to time. Changes are effective immediately upon posting (indicated by the date at the top). We encourage you to review this policy periodically.

1. Information We Collect

1.1 Information You Provide

• Account information: Email address, Roblox user ID, current Roblox username, and policy acceptance. Legacy accounts may also retain a hashed AgileBot password.
• Conversation content: Messages, prompts, and instructions you submit to the AI.
• Roblox project data: When using the Roblox Studio plugin, the Service accesses and transmits your Roblox project data including script source code, object hierarchies, instance properties, GUI element states, selection data, and output logs. This data is transmitted to generate AI responses and execute tool operations.
• Billing information: If you subscribe to a paid plan, your payment details are collected and processed by Polar.sh, our payment processor (Merchant of Record). We do not receive or store your full payment card details. We receive your subscription status and billing metadata from Polar.sh.
• Communications: Information you provide when contacting us for support.
• Support quality review: If you contact us about a poor or unexpected agent chain, we may review the relevant conversation details, prompts, responses, tool calls, tool results, project context, and operational logs needed to understand and resolve the issue.

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Log information: IP address, browser type and version, operating system, access timestamps, pages visited, referring URLs, and the page visited before navigating to the Service.
• Session information: User-Agent string and IP address associated with each login session.
• Usage data: AI model usage (token counts, model selection), feature usage, and interaction patterns within the Service.
• Engagement data: Activity sessions, usage frequency, conversation counts, feature interactions, and related engagement signals used to understand how the Service is used and where it needs improvement.
• Device information: Hardware model, operating system version, and browser configuration.

1.3 Cookies and Similar Technologies

We use the following cookies:

• Session cookie (agilebot_admin_session): Required for admin dashboard authentication. This is a strictly necessary cookie that maintains your admin login session.
• CSRF cookie: A double-submit cookie pattern used to prevent cross-site request forgery on admin pages. This is a strictly necessary security cookie.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies on our Service. The admin cookies are set only when you access the admin dashboard.

Most browsers allow you to control cookies through settings. Blocking necessary cookies may prevent the admin dashboard from functioning.

2. How We Use Your Information

We use your personal data for the following purposes:

• To provide the Service: Processing your prompts, transmitting project data to AI model providers, generating and returning AI responses, executing tool operations in Roblox Studio.
• To manage your account: Authentication, session management, password reset, account administration.
• To process payments: Facilitating subscription checkouts and managing billing via Polar.sh.
• To communicate with you: Sending technical notices, security alerts, support responses, and administrative messages.
• To provide support and investigate quality issues: Reviewing relevant conversation content, agent-chain steps, tool activity, and logs when you ask us to help with a low-quality, failed, or unexpected AI response.
• To enforce our terms and policies: Rate limiting, spending cap enforcement, abuse detection, and Terms of Service compliance.
• To improve the Service: Analyzing usage patterns, monitoring performance, debugging issues, and measuring user engagement.
• To comply with legal obligations: Responding to lawful requests, maintaining records as required by applicable law.

Legal Basis for Processing (EEA / UK Users)

For users in the European Economic Area and United Kingdom, we process personal data on the following legal bases:

• Contractual necessity: Providing the Service you requested (account management, AI processing, billing).
• Legitimate interests: Securing and improving the Service, preventing fraud and abuse, enforcing our Terms.
• Consent: Where required by law, we will obtain your explicit consent before processing (for example, for marketing communications, where applicable).
• Legal obligation: Complying with applicable laws and regulations.

3. How We Share Your Information

3.1 AI Model Providers

Your prompts, Roblox project data (script source code, object hierarchies, properties, GUI states), and conversation history are transmitted to OpenRouter (openrouter.ai) and its downstream model providers for the purpose of generating AI responses. These providers may include:

• OpenAI (United States)
• Anthropic (United States)
• Google (United States)
• MiniMax (China)

These providers receive and process your data solely to generate AI responses. Their privacy policies may allow them to collect and use submitted data for their own service operation, safety, abuse prevention, analytics, or model improvement purposes. Each provider operates under its own privacy policy and terms. We encourage you to review their policies:

• OpenAI: https://openai.com/policies/privacy-policy
• Anthropic: https://www.anthropic.com/privacy
• Google: https://policies.google.com/privacy
• MiniMax: https://www.minimax.io/privacy
• OpenRouter: https://openrouter.ai/privacy

Important: Some of these providers are located in countries outside the European Economic Area (including the United States and China) that may not provide the same level of data protection as your home country. By using the Service, you consent to the transfer of your data to these providers. We rely on standard contractual clauses and equivalent transfer mechanisms where available.

3.2 Payment Processor

Subscription payments are processed by Polar.sh (Polar AB, Sweden). When you initiate a checkout, your workspace ID, user ID, email address, IP address, and selected or detected billing country are transmitted to Polar.sh to create the checkout session. Polar.sh collects your payment details directly. Polar.sh is GDPR-compliant and acts as an independent data controller for payment processing.

3.3 Hosting and Infrastructure

Your data is stored and processed on:

• Netlify (United States): Application hosting
• PostgreSQL database services: Data storage
• Redis (optional, if configured): Rate limit storage

These providers act as data processors on our behalf and are contractually bound to protect your data.

3.4 Other Sharing

We may also share information:

• To comply with applicable law, regulation, legal process, or governmental request
• To enforce our Terms of Service and protect our rights, users, or the public
• In connection with a merger, sale of assets, financing, or acquisition of all or part of our business
• With your consent or at your direction

We do not sell your personal data.

4. Data Retention

Account Data

• Account information (email, Roblox identity, and any legacy password hash): Retained while your account is active.
• Conversation data (messages, AI responses, tool calls, runtime state): Retained while your account is active.

Upon Account Deletion

When you delete your account (via the Service dashboard or by contacting us):

• Your email is anonymized
• Your Roblox identity is removed and any legacy password hash is overwritten
• Your account is disabled
• All conversations, messages, tool requests, tool executions, runtime state, and associated operational data are permanently deleted
• All sessions and API keys are revoked

Retained After Deletion

• Anonymized usage records: Token counts, provider costs, and model usage are retained in de-identified form (disconnected from your identity) for business analytics and legal purposes.
• Server access logs: Retained for a maximum of 90 days for security and abuse prevention purposes.

Billing Records

Subscription and payment records are retained as required by Dutch tax law (typically 7 years for financial records).

5. International Data Transfers

Your data is processed and stored in the United States and the Netherlands. When we transfer personal data from the EEA to countries not recognized by the European Commission as providing adequate protection, we implement appropriate safeguards including:

• Standard contractual clauses approved by the European Commission
• Contractual commitments from service providers regarding data protection
• Technical measures including encryption in transit (TLS) and at rest

6. Data Security

We implement reasonable technical and organizational measures to protect your personal data, including:

• Password hashing using argon2 (state-of-the-art key derivation)
• API key and refresh token hashing using SHA-256 HMAC with secret pepper
• Transport Layer Security (TLS) encryption for all data in transit
• Rate limiting to prevent brute-force and abuse attacks
• Cross-Site Request Forgery (CSRF) protection for administrative functions
• Input validation and request size limits
• Regular dependency updates and security patches

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

EEA / UK Residents (GDPR / UK GDPR)

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): Request deletion of your personal data. You can exercise this directly through the Service by deleting your account, or by contacting us.
• Right to restriction: Request restriction of processing under certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: File a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).

To exercise your rights, contact us at team@agilebot.dev. We will respond within one month (extendable by two months for complex requests). We may need to verify your identity before processing your request.

California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Not be discriminated against for exercising your rights

To exercise these rights, contact us at team@agilebot.dev.

8. Children’s Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal data, contact us immediately at team@agilebot.dev. If we become aware that a child under 16 has provided personal data, we will delete it.

9. Automated Decision-Making

The Service uses AI models to generate code and responses automatically. This constitutes automated processing. However, the AI output is advisory in nature — the decision to use generated code in your Roblox projects is yours. We do not use automated decision-making that produces legal or similarly significant effects without human intervention.

10. Contact Us

For privacy-related questions, to exercise your rights, or to report a data breach:

If you are in the EEA, you may also contact our lead supervisory authority: