GDPR Data Protection Policy

Agentic Tech LLC ("we," "us," or "our") is committed to protecting the personal data of individuals in accordance with applicable data protection laws. This GDPR Data Protection Policy (the "Policy") addresses our compliance with the European Union's General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") where it applies to our processing of personal data of individuals located in the European Union or European Economic Area ("EU/EEA").

Although we are established in the United States, this GDPR policy may apply extraterritorially if we process personal data of individuals in the EU/EEA in connection with offering goods or services (irrespective of payment) or monitoring their behavior in the EU/EEA (GDPR Article 3(2)). This Policy supplements our general Privacy Policy and outlines our approach to GDPR compliance.

1. Scope and Applicability

This Policy applies to the processing of personal data of data subjects located in the EU/EEA when such processing relates to:

• Offering our Website (agentic-plugin.com), programs, or services to individuals in the EU/EEA;
• Monitoring the behavior of individuals in the EU/EEA (e.g., through Website analytics);
• Any other activities that fall within the territorial scope of the GDPR.

If you are located outside the EU/EEA, this Policy does not apply to your personal data unless otherwise specified. We process personal data primarily under U.S. laws, including state privacy regulations where applicable.

2. Data Controller

Agentic Tech LLC acts as the data controller for personal data processed under this Policy. When we process data on a site owner's behalf through our hosted Agentic AI services, the site owner is the controller and we act as its processor. Our contact details are:

Agentic Tech LLC
773 Derrydown Way
Decatur, Georgia 30030
United States
Email: [email protected]

3. Personal Data We Process

We may process the following categories of personal data from EU/EEA individuals:

• Contact information (name, email address, postal address);
• Account and license data (username, license keys, site URLs, subscription details);
• Payment-related data (processed via Stripe—we do not store full card details);
• Marketplace developer and affiliate data (agent submissions, API keys, earnings, referrals and commissions);
• Stripe Connect payout data — developers and affiliates onboard to Stripe Connect Express, and Stripe collects their identity, bank and tax details directly. We receive only the connected account ID, onboarding/verification status, payout status, payout country and earnings records;
• Technical data (IP address, browser type, device information, usage data via cookies or analytics);
• Conversation data (user prompts, AI agent responses, session identifiers, tool invocations, token usage) — stored in the site owner’s WordPress database (30 days by default, configurable by the site owner);
• Hosted AI service data — site URL, license key, prompts and media/document payloads sent to our hosted Agentic AI services. Hosted chat stores no prompt text (only model, token counts, credits, status and timestamps); the first 2,000 characters of image and video prompts are kept for 30 days, then deleted;
• Plugin telemetry (self-hosted edition only, off by default, opt-in) — site URL, license key, Plugin version and feature-usage events. The WordPress.org edition sends no telemetry;
• Any other data voluntarily provided through forms, emails, or interactions.

4. Purposes and Legal Bases for Processing

We process personal data for the following purposes, relying on the specified GDPR legal bases (Article 6):

• Performance of a contract or steps prior to a contract — Processing registration, license, or payment data to provide services or fulfill commitments, including hosted AI services and paying marketplace developers and affiliates through Stripe Connect (Art. 6(1)(b));
• Legitimate interests — Improving our Website, analyzing usage (with safeguards), communicating about our products, and preventing fraud (balanced against your rights) (Art. 6(1)(f));
• Consent — For Google Analytics cookies, optional Plugin telemetry (self-hosted edition), marketing communications, or specific processing where consent is obtained (withdrawable at any time) (Art. 6(1)(a));
• Legal obligation — Complying with tax and accounting requirements, including records of marketplace earnings, developer payouts and affiliate commissions (Art. 6(1)(c)).

5. Email Communications

We send two distinct categories of email, each with a different legal basis:

• Transactional emails — Sent when necessary to deliver our service or fulfil a legal or contractual obligation. These include license keys and activation details, purchase receipts and invoices, billing notices and payment failures, password resets, and security alerts. The legal basis is performance of a contract (Art. 6(1)(b)) or legal obligation (Art. 6(1)(c)). These emails cannot be opted out of while you hold an active account or license, as they are required to deliver the service you have purchased.
• Marketing & newsletter emails — Sent to keep you informed about product updates, new features, marketplace agents, and promotions. The legal basis is your consent (Art. 6(1)(a)), given at the point of registration. You may withdraw this consent at any time, without affecting the lawfulness of processing based on consent before withdrawal, by:

• Clicking the Unsubscribe link in any marketing email;
• Managing preferences at My Account → Email Preferences; or
• Contacting us at [email protected].

Unsubscribing from marketing emails does not delete your personal data. To request erasure of your data, see Section 7 (Data Subject Rights) below.

6. Data Sharing and Transfers

We share personal data only as necessary with:

• Service providers — Stripe (payments and Stripe Connect payouts), Google Cloud (hosting and private backups), Cloudflare (CDN/security and transactional email), Akamai/Linode (mail relays in the United Kingdom), Google Workspace (support mailboxes) and Google Analytics (with consent), each under its standard online data-processing terms;
• AI providers — Google (Vertex AI / Gemini) and xAI process prompts for our hosted Agentic AI services, and Jamendo receives music-search terms relayed by our video service. AI providers you connect with your own key (for example OpenAI, Anthropic or DeepSeek) receive data directly from your site under your own account; they are your processors, not ours;
• Relevant authorities for legal compliance.

Personal data may be transferred to the United States or other countries outside the EU/EEA. We rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) incorporated in our providers' standard data-processing terms, or other mechanisms permitted under GDPR Chapter V. A list of our subprocessors is available at our subprocessors page.

7. Data Subject Rights

Under the GDPR (Articles 15–22), EU/EEA data subjects have the right to:

• Access their personal data (Art. 15);
• Rectify inaccurate data (Art. 16);
• Erase data — right to be forgotten (Art. 17);
• Restrict processing (Art. 18);
• Data portability (Art. 20);
• Object to processing, including for legitimate interests or direct marketing (Art. 21);
• Withdraw consent where processing is based on consent;
• Lodge a complaint with a supervisory authority (e.g., in your EU/EEA member state).

To exercise these rights, contact us at [email protected] with proof of identity. We will respond within one month (extendable under GDPR Article 12(3)).

8. Data Security and Retention

We implement technical and organizational measures (Art. 32 GDPR) to protect personal data against unauthorized access, loss, or misuse, including:

• Encryption in transit (TLS) and at rest where applicable;
• Access controls, and backups kept in a private, access-controlled storage bucket;
• Vulnerability reporting and response.

Security reports. Report vulnerabilities through our Patchstack vulnerability disclosure programme or to [email protected]. We aim to acknowledge reports within 3 business days.

Personal data breaches. If a personal data breach occurs, we will assess it and, where GDPR requires, notify the competent supervisory authority (Art. 33) and affected individuals (Art. 34) within the time limits GDPR sets. Where we act as a processor for a site owner, we will inform that site owner without undue delay after becoming aware of a breach affecting its data.

Personal data is retained only as long as necessary for the purposes outlined, or as required by law, after which it is securely deleted or anonymized. Specifically, conversation logs (user prompts, AI responses, session metadata) are automatically purged after 30 days by default, and hosted image and video prompts are purged after 30 days. Hosted chat stores no prompt text. See our Privacy Policy Section 6 for all retention periods.

9. International Data Transfers

As noted, transfers outside the EU/EEA use appropriate safeguards compliant with GDPR requirements. For EU/UK users, we rely on:

• European Commission-approved Standard Contractual Clauses (SCCs), as incorporated in our providers' standard data-processing terms;
• Other lawful mechanisms under GDPR Chapter V.

Contact us for copies of safeguards.

10. Changes to This Policy

We may update this Policy to reflect changes in our practices or legal obligations. The revised Policy will be posted on our Website with the updated effective date. Material changes will be notified by a notice on the Website and, where the law requires it, by email.

11. Contact and Complaints

For questions, rights requests, or concerns regarding this Policy or our GDPR compliance, please contact us:

Email: [email protected]
Agentic Tech LLC
773 Derrydown Way, Decatur, Georgia 30030, United States

If unsatisfied with our response, you may contact your local EU/EEA supervisory authority.