Privacy Policy
Last updated 17 September 2026
AgentMax provides AI employees that run sales, support, SEO, WhatsApp ordering, and appointment workflows for businesses. This policy explains what personal data we process when you use the service, why we process it, who receives it, how long we keep it, and the rights you can exercise. It covers our websites, applications, and APIs.
1. How we use your personal data
AgentMax is operated by [TO CONFIRM: registered legal entity name and address]. For the data described in this section we act as the data controller: we decide why and how it is processed.
| Purpose | How we use it | Personal data | Legal basis | Retention |
|---|---|---|---|---|
| Creating and running your account | Register you, authenticate you, and identify your workspace. | Name, email address, password hash, Google account identifier, email verification status, account role. | Performance of a contract | While your account is active, then [TO CONFIRM: retention period]. |
| Keeping you signed in | Issue and validate a signed session token stored in a first-party cookie. | Account identifier, session token. | Performance of a contract | 7 days per session, then the cookie expires. |
| Billing and subscriptions | Take payment, manage plans and per-agent licensing, and issue receipts. | Billing contact details, Stripe and PayPal customer identifiers, plan and subscription state. Card numbers are handled by the payment provider and never reach AgentMax servers. | Performance of a contract; legal obligation for tax and accounting records | [TO CONFIRM: retention period] — statutory accounting retention usually exceeds account deletion. |
| Running your AI employees | Store and execute the configuration you create so your agents behave as instructed. | Workspace and agent configuration, agent instructions, knowledge-base content you upload. | Performance of a contract | While your account is active, then [TO CONFIRM: retention period]. |
| Metering usage and enforcing licensing | Count agent activity to apply plan entitlements and produce billing figures. | Usage logs tied to your workspace and agents, timestamps, operation counts. | Performance of a contract; our legitimate interest in preventing plan abuse | [TO CONFIRM: retention period] |
| Service and transactional email | Send account, welcome, appointment confirmation, and appointment reminder messages. | Name, email address, and the booking details contained in the message. | Performance of a contract | Sent through Brevo; [TO CONFIRM: retention period]. |
| Connecting Google Search Console and Google Analytics | Show the search-performance and traffic reports for the property you select. | Google account identifier, OAuth tokens, and the read-only report data returned by Google. | Consent, given on Google's consent screen | Only while the connection is active. Disconnecting deletes the stored tokens. |
| Connecting LinkedIn and Meta accounts for publishing | Publish or schedule the social content you approve. | OAuth tokens, account and page identifiers, the content you submit. | Consent | Only while the connection is active. |
| Operating WhatsApp ordering and messaging | Send and receive messages, run ordering flows, and hand conversations to a human. | Phone numbers, message content, order and cart records, one-time passcodes. | Performance of a contract with you; see section 1.1 for the people on the other side of the conversation | One-time passcodes and cart sessions expire automatically. Orders and conversations are kept while your account is active. |
| Support | Answer your questions and investigate faults you report. | Your contact details and anything you include in the request. | Our legitimate interest in supporting our customers | [TO CONFIRM: retention period] |
| Security, abuse prevention, and reliability | Rate limiting, audit logging, fraud and abuse investigation, and diagnosing outages. | IP address, device and browser data, request logs, authentication events. | Our legitimate interest in keeping the service secure and available | [TO CONFIRM: retention period] |
1.1 Data you put into AgentMax about other people
Your AI employees handle conversations with your own customers. When that happens we process their personal data as a processor, on your instructions, and you remain the controller for it. This includes names, email addresses, phone numbers, message and conversation content, order and cart records, appointment bookings, campaign contact lists, and handoff records.
You decide what enters the platform and are responsible for having a lawful basis to send it to us, for telling those people how their data is used, and for keeping workspace access limited to authorised team members. We do not use your customers' data for our own purposes, and we do not sell it.
2. About cookies
AgentMax sets only strictly necessary first-party cookies. We do not run analytics, advertising, or third-party tracking cookies on our website or in the product, and we do not build advertising profiles. Because no optional cookies are set, there is no consent banner to accept or reject.
| Name | Purpose | Provider | Type | Expiry |
|---|---|---|---|---|
| agentmax_session | Keeps you signed in to your workspace between requests. | AgentMax (first party) | Strictly necessary | 7 days |
| agentmax_admin_session | Keeps an AgentMax administrator signed in to internal admin tooling. Never set for ordinary users. | AgentMax (first party) | Strictly necessary | 7 days |
Both cookies are HttpOnly, restricted to the AgentMax domain, and sent with SameSite=Lax. In production they are transmitted only over HTTPS. Blocking them will prevent you from signing in. Signing out clears them immediately.
3. Who receives your information
We do not sell personal data. We share it only with providers that process it on our behalf under contract, and only to the extent each provider needs to perform its function.
3.1 Service providers
- Cloudflare — website and application hosting, CDN, and object storage for cached assets.
- MongoDB — the primary application database holding account and workspace records.
- Brevo — delivery of transactional email such as welcome and appointment messages.
- Stripe and PayPal — subscription billing and payment processing. They receive the billing data needed to take payment; AgentMax never stores full card numbers.
- Twilio and the WhatsApp messaging gateway — sending and receiving WhatsApp and SMS messages for the ordering and appointment agents.
- n8n — the workflow automation layer that executes scheduled and event-driven agent jobs.
- Semrush and the Google PageSpeed Insights API — SEO keyword, competitor, and page-performance data used by the SEO agent. These queries concern websites and keywords rather than individuals.
We may also disclose information where the law requires it, to establish or defend legal claims, to protect the rights and safety of users and the public, or to an acquirer as part of a merger, acquisition, or transfer of assets. If AgentMax changes hands we will tell you before your data becomes subject to a different privacy policy.
3.2 Google API Services
When you connect Google Search Console or Google Analytics, AgentMax requests only the read-only scopes shown to you on Google's consent screen: analytics.readonly and webmasters.readonly. We use your Google account identity to label the connected account, Search Console data to show search-performance reports for a site you select, and Analytics data to show traffic and engagement reports for a property you select.
AgentMax's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it to others except as necessary to provide or improve the connected features or to comply with law, do not allow humans to read it except with your explicit consent, for security purposes, or where the law requires it, and do not use it to determine credit, insurance, employment, or any other eligibility.
Google OAuth refresh tokens are held server-side in encrypted form and are never exposed to workspace members or placed in browser storage. You can disconnect Google inside AgentMax at any time, which deletes the stored tokens. You should also remove AgentMax from the third-party access list in your Google Account to revoke Google's own grant.
3.3 AI functionality providers
AgentMax uses OpenAI models to generate agent replies, summaries, SEO drafts, and social content. To produce a response we send the model the prompt and the context needed for that task, which can include your agent instructions, selected knowledge-base content, and the relevant part of the conversation. That context may contain personal data if you or your customers put personal data into the conversation or the knowledge base.
We access these models through the OpenAI API, which does not use submitted content to train its models by default. We do not send more of your data than a request requires, and we do not use your content to train models of our own.
AI output can be inaccurate. Please do not treat agent responses as legal, financial, or medical advice, and review anything an agent publishes or sends on your behalf.
4. To what countries do we transfer your personal data
Our providers operate internationally, and several of them — including Cloudflare, OpenAI, Stripe, and Twilio — process data in the United States. If you use AgentMax from the European Economic Area or the United Kingdom, your personal data may therefore be transferred outside your home country.
[TO CONFIRM: the transfer mechanism relied on — Standard Contractual Clauses, the EU-US Data Privacy Framework, or the UK Addendum — together with the hosting regions actually configured for the database and application.] We will name the safeguard here so you can request a copy of it.
5. Links to third-party websites
The service and our marketing pages link to websites we do not operate, including Google, payment providers, and social platforms. Following those links takes you outside AgentMax, and the destination site's own privacy policy governs what it collects. We are not responsible for the content or privacy practices of sites we do not control.
6. Marketing messages
Most email we send is transactional: account confirmations, welcome messages, appointment confirmations, and appointment reminders. You cannot opt out of these while you hold an active account, because they are part of providing the service.
We send marketing email only where you have consented or where applicable law otherwise permits it for an existing customer. Every marketing message carries an unsubscribe link, and you can also withdraw consent by writing to hello@agentmax.io. Withdrawing marketing consent does not stop transactional email.
Campaigns that your own Business Developer agent sends to your contacts are sent by you, not by AgentMax. You are the sender and the controller for those messages and are responsible for consent and unsubscribe handling in them.
7. Children
AgentMax is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16, and you must be old enough to enter a contract in your country to hold an account. If you believe a child has given us personal data, write to hello@agentmax.io and we will delete it.
8. Your rights
Subject to the conditions in the law that applies to you, you can exercise the following rights over the personal data we hold about you as a controller:
- Access — ask whether we process your data and obtain a copy of it.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where we have no overriding basis to keep it.
- Restriction — ask us to pause processing while a dispute about accuracy or legitimacy is resolved.
- Objection — object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time.
- Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Withdraw consent — disconnect Google, LinkedIn, or Meta at any time, or withdraw marketing consent, without affecting processing already carried out.
- Complain — lodge a complaint with your local data protection supervisory authority.
Write to hello@agentmax.io from the address on your account. We will respond within one month, and will tell you if we need longer because the request is complex. We do not charge for these requests unless they are manifestly unfounded or excessive.
To delete your account and workspace data, email hello@agentmax.io from the account address. We will delete or anonymise eligible data within 30 days, other than records we must keep for legal, tax, or security reasons. If your request concerns data we hold as a processor on a customer's behalf, please contact that customer directly; we will forward the request to them if you cannot identify them.
9. Updating your data
You can review and change your account details and workspace configuration inside the product at any time, and you should keep them accurate. If details we hold are wrong and you cannot correct them yourself, tell us at hello@agentmax.io and we will fix them.
10. Changes to this Privacy Policy
We may update this policy as the service changes or the law requires. The date at the top of this page always shows the current version. If a change materially affects how we use your personal data we will give you notice by email or in the product before it takes effect, so that you can review it and, if you disagree, close your account.
11. Contact information
For privacy questions, data subject requests, or to raise a concern, email hello@agentmax.io. For help with the product, email support@agentmax.io. Please include your workspace name and the email address on your account so we can locate your records. Our operating entity and registered address are [TO CONFIRM: registered legal entity name and address].