Privacy Policy

1. Introduction

Agentic Tech LLC ("we," "us," or "our"), the owner and operator of agentic-plugin.com (the "Website") and the Agent Builder WordPress plugin (the "Plugin"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you access or use our Website, Plugin, hosted AI services, marketplace, affiliate programme, or related services (collectively, the "Services").

We act as the data controller for personal data collected directly through the Website, account management, purchases, the marketplace and the affiliate programme. When we process data on a site owner's behalf through our hosted AI services, we act as a data processor on that site owner's instructions. You remain the data controller for any personal data processed through AI agents you build or deploy on your WordPress sites.

This Policy is intended to meet the requirements of the EU General Data Protection Regulation (GDPR), UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration: email address, username, password, profile details;
• Marketplace developer and affiliate applications: name, business name, contact details and the information you submit for review (see section 2.2 for payouts);
• Support/contact: information in tickets, emails, or forms;
• Purchases and donations: name, email address and billing details. Stripe processes full card details; we do not receive or store them.

2.2 Marketplace Developers and Affiliates (Stripe Connect)

Marketplace developers and approved affiliates receive their earnings through Stripe Connect Express. When you connect a payout account, you complete onboarding directly with Stripe, and Stripe collects your identity, bank account and tax details itself (for example government ID, date of birth, address, bank details and tax identifiers). We do not receive or store those details.

From Stripe and from our own records we receive and keep: your connected account ID, the account's onboarding and verification status, whether payouts are enabled, your payout country, payout and transfer status, and earnings records (sales, our 30% platform fee, your share, refunds, chargebacks and affiliate commissions). We use this to pay you, to vet sellers and affiliates, to handle refunds and disputes, to prevent fraud and to meet tax and legal obligations. Stripe processes the onboarding data under its own privacy policy and the Stripe Connected Account Agreement you accept with it.

2.3 Automatically Collected Information

• Technical/usage data: IP address, browser type/version, device info, operating system, pages visited, time spent, referral sources;
• Plugin-specific: license key validations (license key, site URL, WordPress and Plugin versions—used only for verification);
• Plugin telemetry (self-hosted edition only, opt-in): off by default. If a site administrator enables it, the Plugin sends the site URL, license key, Plugin version and feature-usage events. It does not send post content or conversations. The WordPress.org edition of the Plugin sends no telemetry;
• Website analytics: on agentic-plugin.com we use Google Analytics only after you consent through our cookie banner;
• Affiliate attribution: if you arrive through an affiliate referral link, we record the referral so the affiliate can be credited (see our Cookie Policy);
• Cookies & similar: see section 9 and our Cookie Policy.

2.4 Hosted Agentic AI Services

If you use our hosted AI services (Agentic AI chat, image generation, text-to-speech and video generation), your WordPress site sends us your site URL, license key, the prompt text and any task-specific media or document payloads. We process these on our infrastructure using Google Vertex AI / Gemini (chat, image, text-to-speech and video) and xAI (voice and parts of video generation) to return a response. Royalty-free background-music searches made during video generation are relayed through our video service to Jamendo (search terms only).

For hosted chat we do not store prompt or response text; we store only the model used, token counts, credits, request status and timestamps. For image and video generation we store the first 2,000 characters of each prompt, which are deleted automatically after 30 days. We also keep usage and credit records (credits purchased and used) for billing.

2.5 AI Providers You Connect Yourself

When you connect your own AI provider key (OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, Mistral, Meta Llama API, Cohere, Kimi/Moonshot AI, OpenRouter, or a local Ollama model), your prompts and inputs are sent from your WordPress server directly to that provider and do not pass through us. That provider processes the data under your account and its own terms, so it is your processor, not ours, and you are responsible for accepting its data-processing terms. Some of these providers process data outside the EU and US (for example DeepSeek and Moonshot AI).

2.6 Conversation Data

To provide conversation history, activity logging, and debugging capabilities, the Plugin stores the following data in your WordPress database:

• User prompts (messages you send to AI agents);
• AI agent responses;
• Session identifiers linking messages within a conversation;
• Tools invoked by agents during conversations;
• Token usage and estimated cost per interaction;
• Timestamps and user identifiers.

This data is stored in your WordPress database and, by default, is automatically purged after 30 days (the site administrator can change this period). To generate responses, prompts and relevant site content are sent to the AI provider in use: our hosted Agentic AI services (see section 2.4) or a provider you connect with your own key (see section 2.5). Site owners deploying agents on the front-end are responsible for informing their visitors about this data processing (see our GDPR and Data Protection documentation).

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes and legal bases (primarily under GDPR):

• Performance of contract: providing Services, account management, license validation, hosted AI services and credits, marketplace sales, and paying marketplace developers and affiliates through Stripe Connect (Art. 6(1)(b) GDPR);
• Legal obligations: tax and accounting records, payout and tax reporting for developers and affiliates, seller vetting required of us as a Stripe Connect platform, and responding to authority requests (Art. 6(1)(c));
• Legitimate interests: fraud prevention, security, service improvement, affiliate attribution (Art. 6(1)(f))—balanced against your rights;
• Consent: Google Analytics cookies, optional Plugin telemetry (self-hosted edition), and optional marketing emails (you can withdraw anytime).

Under CCPA/CPRA, we collect categories such as identifiers, commercial information, internet/activity data, geolocation (inferred), and professional info—for providing/improving Services, not for sale or sharing in the CCPA sense.

4. Data Sharing and Recipients

We do not sell personal information. We share data only as necessary:

• Service providers/subprocessors: Stripe (payments, and Stripe Connect payouts to developers and affiliates), Google Cloud (hosting, databases and private backups), Cloudflare (CDN/security and transactional email), Akamai/Linode (our own mail relays, used for bulk email), Google Workspace (support mailboxes) and Google Analytics (website analytics, with consent);
• AI providers: for our hosted services, Google (Vertex AI / Gemini) and xAI, plus Jamendo for music search; providers you connect with your own key receive data directly from your site under your own account and are your processors, not ours;
• Resellers: if you buy Agent Builder Pro on wpbay.com, WPBay handles that sale under its own terms and privacy policy;
• Marketplace developers: when you buy an agent, the selling developer can see sales and license records for their agent;
• Legal/compliance: to comply with law, protect rights, or respond to subpoenas;
• Business transfers: in mergers/acquisitions (with notice where required).

Current subprocessors are listed on our Subprocessors page. We rely on each provider's standard online data-processing terms; we have not negotiated separate agreements with them.

4.1 Google Vertex AI / Gemini (Hosted Services)

For premium Vector Store (RAG training and semantic retrieval) and Image Generation services, your uploaded content, prompts, documents, and generated outputs are processed using Google Vertex AI services — including embeddings, vector search, and generative models (e.g., Imagen 4 for image generation). This processing occurs on our managed backend infrastructure. Our hosted chat, text-to-speech and video generation services also use Google Vertex AI / Gemini, and xAI for voice and parts of video generation.

Google LLC acts as our subprocessor for these features. Google processes this data under its standard Google Cloud data processing terms, which we rely on. Google will not use your prompts, inputs, or generated outputs to train or fine-tune AI models without your explicit permission (per Vertex AI Service Specific Terms).

For generative AI features (e.g., Image Generation via Imagen 4):

• Prompts and outputs may be subject to Google's abuse monitoring and safety classifiers. Data is logged only for detected violations or safety enforcement purposes;
• Generated images include Google's SynthID digital watermark — an imperceptible, non-removable watermark embedded for traceability and responsible AI compliance. This is a mandatory feature of the Vertex AI Imagen service and cannot be disabled;
• Certain content may be blocked by safety filters in accordance with Google's Generative AI Prohibited Use Policy.

You remain the data controller for content processed via your WordPress site and agents. Relevant Google policies:

• Vertex AI Service Specific Terms
• Generative AI Prohibited Use Policy
• Google Cloud Acceptable Use Policy
• Google Privacy Policy

5. International Data Transfers

Data may be transferred to and processed in the United States or other countries (for example, our mail relays are in the United Kingdom). For EU/UK users, we rely on:

• European Commission-approved Standard Contractual Clauses (SCCs), as incorporated in our providers' standard data-processing terms;
• Other lawful mechanisms under GDPR Chapter V.

Contact us for copies of safeguards.

6. Data Retention

We retain data only as long as necessary:

• Active accounts: duration of account + reasonable period post-termination;
• Conversation logs and chat history (stored in your WordPress database): 30 days by default, then automatically deleted;
• Hosted chat: no prompt or response text is stored; usage metadata (model, token counts, credits, status, timestamps) is kept for billing;
• Hosted image and video prompts (first 2,000 characters): 30 days, then automatically deleted;
• Plugin telemetry (self-hosted edition, opt-in):[period to be confirmed];
• Transaction/financial records, marketplace earnings, payout and affiliate commission records: 7 years (legal/tax requirements);
• Website analytics (Google Analytics):as set in our Google Analytics retention setting;
• Support tickets: 2 years after closure;
• Backups: kept in a private Google Cloud Storage bucket and overwritten on a rolling basis.

Data is securely deleted or anonymized thereafter.

7. Your Privacy Rights

Subject to verification and applicable law, you may:

• Access, correct, or delete your data (GDPR Art. 15-17; CCPA "right to know/delete");
• Request data portability (GDPR Art. 20);
• Object to/restrict processing (GDPR Art. 18, 21);
• Opt out of "sales/sharing" (CCPA/CPRA—though we do not sell/share);
• Withdraw consent (where applicable);
• Lodge a complaint with a supervisory authority (e.g., your EU data protection authority or California AG).

To exercise rights, email [email protected] with proof of identity. We respond within 1 month (GDPR) or 45 days (CCPA, extendable). No fee unless manifestly unfounded/excessive. Identity, bank and tax details you gave Stripe during payout onboarding are held by Stripe; you can manage them in your Stripe Express Dashboard or ask Stripe directly.

8. Security of Your Data

We implement appropriate technical and organizational measures (Art. 32 GDPR), including:

• Encryption in transit (TLS) and at rest where applicable;
• Access controls, and backups kept in a private, access-controlled storage bucket;
• Vulnerability reporting and response (below).

No method is 100% secure—we cannot guarantee absolute security.

Reporting a vulnerability. Report security issues through our Patchstack vulnerability disclosure programme or by email to [email protected] (see our security.txt). We aim to acknowledge reports within 3 business days, and to fix critical and high-severity issues within 14 days and medium-severity issues within 30 days. These are targets, not guarantees.

If a breach affects your data. If we become aware of a security incident that affects your personal data, we will investigate it, take steps to contain it, and notify you and the relevant authorities where the law requires us to, within the time limits the law sets. We will tell you what happened, what data was involved and what you can do, as far as we know at the time.

We track emerging U.S. federal frameworks for AI agent security — including the proposed Stop Rogue AI Act (a bill introduced in the U.S. House in September 2026 that would direct NIST to publish AI-agent security guidelines) — and design the Plugin's risk-tiered permissions, approval workflows, and activity logging with that direction in mind. This is a statement of engineering posture, not a claim of certification against any standard, since none has been published yet. See our AI Agent Regulation and Compliance Readiness page for details.

9. Cookies and Tracking Technologies

We use essential cookies for core functionality (sessions, login, security, checkout fraud prevention, your cookie choice), a small number of functional cookies, and an affiliate-referral cookie when you arrive through an affiliate link. Google Analytics cookies are set only if you accept them in our cookie banner, and we use no advertising cookies. You can change your choice through the cookie banner or your browser settings. For the full list, see our Cookie Policy.

10. Children's Privacy

Our Services are not directed to children under 16 (or 13 in the US under COPPA). We do not knowingly collect data from children. If we learn of such collection, we will delete it promptly.

AI-generated content — including images produced via our Image Generation service — is subject to Google Vertex AI safety filters that automatically block prohibited material including child sexual abuse material, hate speech, and other harmful content. We do not knowingly process such content through any of our services.

11. Changes to This Privacy Policy

We may update this Policy. We will post the revised Policy here with a new "Last updated" date and, for material changes, show a notice on the Website and, where we have your email address and the law requires it, email you before the change takes effect.

12. Contact Us

For privacy questions or rights requests, contact:

[email protected]
Agentic Tech LLC
773 Derrydown Way, Decatur, Georgia 30030, United States