Privacy Policy
What we collect when you build an agent or chat with one, why we collect it, who processes it, and how to ask for a copy or deletion.
This is an early-access product. Features change often, and we will update this page when they do.
Last updated:
Who we are
Agentbase is a product of Polymath Labs (“Agentbase”, “we”, “us”). Creators use Agentbase to build an AI agent from their own material and share it with one link, often in their social media bio. Anyone with the link can chat with the agent without creating an account.
This policy covers agentbase.so, the published agent pages at agentbase.so/a/…, agent chats embedded on other websites, and the messaging channels a creator connects to their agent. We call people who build agents creators and people who chat with them visitors.
What we collect
If you are a creator
- Account details. Your name, email address, profile photo and sign-in method. Sign-in is handled by Clerk.
- Agent content. Agent names, instructions, look and voice settings, and the published versions of your agents.
- Knowledge sources. Text you paste, files you upload (PDF, Markdown and plain text), website links and YouTube links, plus the text we extract from them. Original uploaded files are stored in Cloudflare R2. Extracted text is stored in our Postgres database, hosted by Neon.
- Channel connections. If you connect a messaging channel (for example Telegram, WhatsApp, SMS or email), the connection details and credentials you provide. We store channel credentials encrypted.
- Connected apps. If you connect third-party apps (for example Gmail or Slack) so your agents can use them, the authorizations you grant through Composio. Composio holds the sign-in tokens for those apps; we store which apps you connected and whether each connection is active.
If you chat with an agent
- Your messages and the agent’s replies. We store the conversation so the agent can continue where you left off.
- A visitor identifier. A random ID in a first-party cookie (
ab_vid) that links your messages to one conversation and applies message limits. You do not need an account to chat. - Your email address, if you choose to sign in. You can sign in with a one-time email link to keep more messages and continue on another device. We store your email address and a hashed sign-in token. A session cookie (
ab_cs) keeps you signed in. - Usage counts. How many messages you have sent, so we can apply free message limits.
- Messaging channel details. If you message an agent through a channel its creator connected (such as Telegram, WhatsApp, SMS or email), we receive your message and the identifier that channel provides, such as your username, phone number or email address.
For everyone
- Technical and usage data. Your IP address, browser and device type, pages you visit and actions you take in the product. We use this for security, rate limiting, analytics and fixing errors.
- What you send us. Messages you send through our Contact page or feedback form.
How we use information
- To run Agentbase: build and publish agents, answer chats, remember conversations and deliver messages on connected channels.
- To let creators review and improve their agents. The creator of an agent can see the conversations people have with it.
- To send email you ask for, such as sign-in links, and messages about the service.
- To keep Agentbase safe and reliable: apply message limits, prevent abuse and spam, investigate problems and fix bugs.
- To understand how Agentbase is used so we can improve it.
- To meet legal obligations and enforce our Terms.
We do not sell personal information, and we do not use your conversations or sources to train our own AI models.
How AI replies are made
When you chat with an agent, we send your message, the recent conversation, the creator’s instructions and relevant passages from the creator’s sources to a third-party AI model provider through the Vercel AI Gateway. Depending on the agent, the provider may be OpenAI, Anthropic, Google or another provider available through the gateway. The provider generates the reply and we send it back to you.
Some agents can search the web. When they do, parts of your question may be sent to our web search provider, Firecrawl. When a creator adds a website, Firecrawl fetches the page. When a creator adds a YouTube video, we send the video link to Google’s Gemini API to produce a transcript.
Creators can also give their agent tools. An agent may fetch web addresses or call online services the creator chose, and may take actions in apps the creator connected through Composio (for example reading or sending email, or posting a message). When it does, the parts of your conversation needed for that request or action are sent to Composio and to the service or app involved, and their own privacy policies apply to what they receive.
AI replies can be wrong, incomplete or out of date. They are not medical, legal, financial or other professional advice. Please do not share sensitive information, such as health or financial details, in a chat unless you are comfortable with the creator and our providers processing it.
Who we share information with
We share information with the service providers that run Agentbase for us, only as needed for the purposes above:
- Vercel: hosting, the AI Gateway that routes chats to model providers, and web analytics.
- AI model providers (for example OpenAI, Anthropic and Google), reached through the Vercel AI Gateway: generating agent replies.
- Google (Gemini API): transcribing YouTube videos that creators add as sources.
- Firecrawl: importing websites that creators add and running web searches for agents that use them.
- Composio: connecting creators’ third-party apps and running actions in them for agents that use them.
- Neon: our Postgres database.
- Cloudflare (R2): storing files that creators upload.
- Clerk: creator sign-in and account management.
- Resend: sending email, such as sign-in links, and receiving email for agents connected to an email address.
- Upstash: rate limiting and background task delivery.
- PostHog and Google Analytics: product and website analytics.
- Sentry and Better Stack: error monitoring and application logs.
- Formbase: our feedback and contact form.
- Messaging providers, when a creator connects a channel: Telegram, WhatsApp (Meta, with our partners Kapso and Zernio), Twilio for SMS, and Resend for email.
Apps and services a creator chooses. When a creator connects an app or gives their agent a tool that calls a web address, that app or service receives the information needed to carry out the agent’s request or action, which can include parts of your conversation. The creator chooses these integrations, not us.
We also share information with the creator of an agent you chat with, as described above; when the law requires it; to protect the safety, rights or property of our users, the public or us; and with a buyer or successor if Agentbase is sold or reorganised.
Our providers may process information in the United States and other countries. Where the law requires it, we rely on the transfer safeguards our providers offer, such as standard contractual clauses.
How long we keep information
- Creator accounts, agents and sources: while your account is active. You can remove sources from your agent at any time, and you can ask us to delete your account.
- Conversations: while the agent exists, so chats can continue and creators can review them. During early access we have not set an automatic deletion period; you can ask us to delete your conversations at any time.
- Sign-in data: email sign-in links expire after 15 minutes, sign-in sessions after 30 days, and the visitor cookie after 1 year.
- Analytics, logs and backups: for the periods set by the providers listed above.
We may keep limited information for longer when we need it to meet legal obligations, resolve disputes or prevent abuse.
Your choices and rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict how we use it. Where we rely on your consent, you can withdraw it at any time.
To make a request, including a request to delete or export your data, use our Contact page. Tell us which agent you chatted with or which account you use, and the email address you signed in with, if any. We may need to confirm it is you before we act. If you chatted without signing in, we may only be able to find your conversation if you also tell us roughly when it happened and what it was about. We aim to respond within 30 days.
If a request concerns a creator’s own use of your information, we may pass it to that creator. You also have the right to complain to your local data protection authority.
Children
Agentbase is not directed to children under 13, or under 16 in the European Economic Area, the United Kingdom and Switzerland, and they should not use it. If you believe a child has given us personal information, please contact us and we will delete it.
Security
We use HTTPS for all traffic, store channel credentials encrypted, store only a hash of email sign-in tokens, and limit access to personal information to people who need it to run Agentbase. No system is perfectly secure, so we cannot guarantee the security of information you send us.
Changes to this policy
We will update this policy as Agentbase changes and show the new date at the top. If a change significantly affects how we use your information, we will let you know on the site or by email before it takes effect.
Contact
Questions about this policy or your information? Reach us through our Contact page. See also our Terms of Service.