Privacy Policy

1. Data We Collect

• Account data — your email address and company name when you create an account. Passwords are stored as scrypt hashes; we never store plaintext passwords.
• API usage logs — request timestamps, HTTP method, endpoint path, response status, duration in milliseconds, and a truncated prefix of your API key for tracing. We store a salted commitment to agent output content inside each receipt — never the raw text itself or a plain hash of it.
• Payment information — plan name, billing cycle, subscription status, invoice IDs, and payment confirmation tokens. Full card numbers are processed exclusively by Stripe or Multicard Mesh; we never receive or store raw card data.
• Technical metadata — IP address, HTTP user agent, and X-Request-Id correlation headers collected for security, abuse prevention, and debugging.

2. What We Do Not Collect

• The raw text of any AI agent output you submit for validation — only a salted commitment to it is stored, never a plain hash of it.
• Biometric data, precise geolocation, or social profile information.
• Data about your end-users unless you explicitly include it in API request fields.
• Tracking cookies, advertising identifiers, or third-party analytics data.

3. Legal Basis for Processing (GDPR)

We rely on the following lawful bases under GDPR Article 6:

• Contract (Art. 6(1)(b)) — processing your email, API keys, and usage logs to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — server logs and IP addresses retained for security, fraud prevention, and abuse detection. Our interest does not override your rights.
• Legal obligation (Art. 6(1)(c)) — billing records retained for 7 years to comply with tax and accounting law.
• Consent (Art. 6(1)(a)) — marketing and lifecycle email sequences. You may withdraw consent at any time by clicking "Unsubscribe" in any email or emailing info@pactum.uz.

4. How We Use Your Data

• Provision and operate the AgentGate API and dashboard.
• Issue and rotate API keys; enforce plan quotas and rate limits.
• Send transactional emails: account confirmation, password reset, payment receipts, and usage alerts.
• Send the getting-started email series, only if you ticked the box for it when you signed up. Every email in it has an unsubscribe link, and /unsubscribe works at any time.
• Detect abuse, prevent fraud, and enforce our Terms of Service.
• Improve gate rules and compliance mappings using aggregated, anonymised statistics only — never individual user content.

5. Data Processors & Sub-processors

We do not sell your data. We share it only with the following processors under binding data processing agreements (DPAs):

We will notify you within 72 hours of discovering any processor breach that affects your personal data.

6. Data Retention

Raw agent output submitted to /v1/validate is processed in-memory and never persisted. Only the data types below are stored.

• API keys — retained while your account is active; deleted within 30 days of account deletion Active account
• Validation metadata — SHA-256 hashes, gate outcomes, domain, tier, timestamps. Raw content is not stored. 90 days (Free) / 12 months (Paid)
• Audit packages — evidence chains, attestation hashes. Exportable as JSON. 90 days (Free) / 12 months (Paid)
• API usage logs — request counts, latency, error rates (no request bodies) 90 days
• Payment & billing records — required by tax law 7 years
• Account data (email, company name) — deleted after account closure 30 days post-closure
• Server access logs (IP, user agent) 30 days

7. Your Rights

Under GDPR (EU residents) and CCPA (California residents) you have the following rights. To exercise any of them, email info@pactum.uz with the subject "Data Request". We will respond within 30 days (GDPR) or 45 days (CCPA).

You also have the right to lodge a complaint with your supervisory authority. For EU residents, this is typically your national data protection authority (e.g., CNIL in France, ICO in the UK, BfDI in Germany).

DPO: We are not legally required to appoint a Data Protection Officer (fewer than 250 employees, no large-scale systematic monitoring). The privacy contact above handles all data requests.

8. Cookies & browser storage

9. International Data Transfers

Our primary infrastructure (Supabase, Hostinger) is located in the EU. Where data is transferred outside the EU/EEA — specifically to SendGrid (USA) and Stripe (USA) — we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46(2)(c) as the lawful transfer mechanism.

Multicard Mesh operates in Uzbekistan, which does not have an EU adequacy decision. We transfer only the minimum data necessary (customer ID, invoice amount) and do so under contractual obligations that mirror GDPR-equivalent protections.

10. Security

• All data in transit is encrypted with TLS 1.2 or higher.
• Data at rest is encrypted with AES-256.
• API keys are held in a server-side key store and compared in constant time; request logs keep only a truncated prefix.
• Passwords are hashed with scrypt.
• Webhook payloads are verified with HMAC-SHA256 signatures.
• Evidence chains use SHA-256 chaining to detect any tampering with audit records.
• Access to production systems is restricted to named individuals with MFA enforced.

11. Children

AgentGate is a B2B service directed at businesses and developers, not at individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, contact info@pactum.uz and we will delete it promptly.

12. Changes to This Policy

We will notify registered users by email and update the "Last updated" date at the top of this page when we make material changes. Continued use of AgentGate more than 30 days after notification constitutes acceptance of the revised policy. Non-material changes (formatting, typo fixes) take effect immediately without notification.

13. Contact