Privacy Policy

1. Introduction & Overview

This Privacy Policy describes how AgentMink (“AgentMink”, “we”, “us”, or “our”) collects, uses, processes, and protects your personal information when you access or use our website (agentmink.com), our developer dashboard (app.agentmink.com), our API proxy gateway (gateway.agentmink.com), and associated documentation (agentmink.com/docs).

By creating an account, generating an API key, or routing requests through AgentMink, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

2. Stateless Gateway Architecture & Zero Prompt Retention

AgentMink is architected specifically as a zero-data-retention proxy gateway for artificial intelligence inference traffic. Our technical processing model adheres to the following structural guarantees:

• No Payload Logging: The full text, embeddings, images, JSON schemas, function arguments, and completion outputs transmitted in API requests are processed strictly in volatile memory (RAM) within isolated edge worker environments. They are never written to persistent disk storage, database tables, or permanent logs.
• In-Flight Transit Only: Payloads stream directly between your client application and the selected upstream model provider (e.g., OpenAI, Anthropic, Google, Groq, DeepSeek) over TLS 1.3 encrypted sessions.
• Ephemeral Error Boundaries: If an upstream provider returns an error, only the HTTP status code and standardized error type are handled by the routing state machine. Prompt bodies are immediately discarded from memory upon response completion or connection termination.

3. Information We Collect

To provide authentication, billing, routing configurations, and operational telemetry, AgentMink collects the following categories of data:

3.1 Account & Identity Data

• Contact Information: Email address, firm or organization name, and primary contact name provided during registration.
• Authentication Credentials: Salted and hashed passwords (via bcrypt) or third-party OAuth provider identifiers (such as GitHub or Google OAuth tokens).
• Profile Preferences: Selected timezone, default routing strategy (cost_first, quality_first, latency_first), and incident webhook URLs (Slack, Discord).

3.2 Encrypted BYOK (Bring Your Own Key) Vault

When you configure your own vendor API keys (such as OpenAI, Anthropic, Gemini, Groq, or DeepSeek) in your workspace settings:

• Credentials are immediately encrypted using AES-256-GCM authenticated encryption with unique per-workspace initialization vectors before being saved.
• Keys are decrypted exclusively in-memory inside isolated edge execution workers for the sole purpose of dispatching authorized requests to the respective provider.
• Plain-text keys are never stored, logged, or visible to AgentMink personnel.

3.3 Operational Telemetry & Ledger Metadata

For billing calculation, quota enforcement, and analytics in your developer dashboard, AgentMink logs high-level numerical metadata for each request:

• Timestamp and unique request identifier (UUID).
• Selected model identifier (e.g., gpt-4o, claude-3-5-sonnet).
• Token counts (prompt tokens, completion tokens, total tokens) reported by the upstream provider.
• Gateway latency and upstream response latency in milliseconds.
• HTTP status code and applied routing strategy.
• Calculated financial cost and estimated cost savings.

3.4 Billing & Payment Information

Payment transactions for monthly platform software subscriptions are processed directly by our payment processor, Stripe. AgentMink does not receive, store, or process raw credit card numbers or bank account details. We retain only transaction receipts, subscription tier statuses, and Stripe Customer IDs.

4. Zero AI Model Training Guarantee

We do not use, sell, lease, or distribute customer prompt text, completion text, system instructions, or telemetry metadata to train, re-train, fine-tune, or validate machine learning models for ourselves or any third party.

When routing through your own BYOK provider keys, your existing enterprise data terms and zero-retention commitments with those respective providers (such as OpenAI Business Terms or Anthropic Commercial Terms) remain fully governed by your direct agreements with them.

5. How We Use Collected Information

We use the limited non-payload data we collect for the following legitimate business purposes:

• To authenticate API requests and verify workspace spending caps.
• To route inference requests to the optimal model provider according to your configured strategy.
• To render usage charts, spending breakdowns, and token ledgers in your developer console.
• To dispatch automated webhook notifications for rate limit alerts, 5xx provider failovers, and budget caps.
• To process subscription invoices and calculate accurate usage fees.
• To protect against fraudulent, unauthorized, or abusive usage of the gateway.

6. Third-Party Sub-Processors & Service Providers

AgentMink partners with verified infrastructure and payment providers to deliver global edge proxy capabilities:

7. Data Security & Encryption Standards

We implement strict administrative, technical, and physical security measures to safeguard data against unauthorized access, destruction, or disclosure:

• Transport Layer Security: All API and dashboard traffic enforces TLS 1.3 with modern cipher suites and HTTP Strict Transport Security (HSTS).
• Authenticated Vault Encryption: AES-256-GCM encryption protects all stored vendor API keys with automated cryptographic rotation support.
• Isolate Sandboxing: Edge processing runs in secure, ephemeral JavaScript V8 isolates with zero shared memory across tenants.
• Access Controls: Multi-factor authentication (MFA), role-based access control, and strict least-privilege principles govern internal administrative access.

8. International Data Transfers & GDPR Compliance

AgentMink processes data across a globally distributed edge network. If you access our services from the European Union (EU), European Economic Area (EEA), or United Kingdom (UK), your data may be processed in countries outside the EEA that may have different data protection laws.

Where cross-border transfers occur, we rely on standard contractual clauses (SCCs) approved by the European Commission and ensure equivalent data protection mechanisms. For more details on your GDPR rights, please review our dedicated GDPR Compliance Notice.

9. Data Retention & Permanent Deletion Rights

You maintain complete control over your account and telemetry history:

• Telemetry Ledger: Numerical metadata is retained for the duration of your active workspace to provide historical analytics. You can purge historical telemetry logs at any time from your dashboard settings.
• Account Deletion: You may request permanent deletion of your workspace, user identity, and encrypted BYOK credentials at any time by navigating to /dashboard/settings or by emailing privacy@agentmink.com. Account deletion triggers immediate irreversible deletion across all edge KV nodes within 24 hours.

10. Cookies & Browser Storage

AgentMink uses minimal, strictly necessary browser storage mechanisms:

• Session Tokens: Secure HTTP-only authentication cookies and local storage tokens to maintain your login session.
• UI Preferences: localStorage.theme to remember your selected dark or light mode preference.
• Zero Advertising Trackers: We do not deploy third-party advertising cookies, behavioural cross-site tracking pixels, or data broker scripts.

For further details, please review our Cookies Policy.

11. Children’s Privacy

Our services are directed strictly to developers, businesses, and individuals aged 18 and older. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal information, please contact us immediately so we can delete such records.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect architecture enhancements, regulatory updates, or operational changes. When modifications are made, we will update the “Last Updated” date at the top of this page. For material changes, we will notify registered users via email or a prominent notification in the developer dashboard.

13. Contact Information & Data Protection Officer

If you have questions, feedback, or requests regarding this Privacy Policy or our data practices, please contact our legal team:

• Email: privacy@agentmink.com
• Security Inquiries: security@agentmink.com
• Legal Address: AgentMink Data Privacy Office