GDPR Compliance

1.1 AISOLO Technologies Private Limited [CIN: U62099MH2023PTC403351] operates Agentbeam and is committed to GDPR compliance for every EU and UK data subject, regardless of where they access the Platform from.

1.2 This document sets out our roles, our legal bases for processing, your rights as a data subject, and how we protect personal data across the website, local runtime recorder, browser extensions, command-line tools, App monitoring, assistant, team library and cloud dashboard.

1.3 Agentbeam is architected privacy-first: the most sensitive data — the content of agent shell commands, file diffs and tool-call arguments — is recorded locally by default and is not transmitted to us unless you connect a device, browser or application to a cloud workspace. This data minimization by design substantially reduces what GDPR rights we need to act on, because for most users, most data never reaches us at all.

3.1 Lawful bases under GDPR Article 6 (where we are controller)

• Consent (Article 6(1)(a)): marketing communications, optional website analytics and session replay where consent is required, and browser extension permissions you grant
• Contract (Article 6(1)(b)): providing the Service to a registered account, including cloud dashboard sync, billing, and support
• Legal obligation (Article 6(1)(c)): tax and financial record-keeping, and responding to lawful regulatory requests
• Legitimate interest (Article 6(1)(f)): security monitoring, fraud and spam prevention, product analytics and masked session replay to improve the Platform, and improving the reliability of the Platform

Where we are processor, the customer determines the lawful basis (often legitimate interest in securing its systems and data, or legal obligation) and is responsible for it.

3.2 Special category data

• We do not seek to process special category data under GDPR Article 9
• Synced agent activity, browser activity and App monitoring findings are technical and operational in nature (commands, file paths, rule matches, request metadata) — they are not designed to capture special category data, and your organization controls what fields are synced
• Prompts, files and logs a customer chooses to connect may nonetheless contain such data. Redaction is pattern-based and not complete, and customers should minimize collection, keep redacted-text collection off, and not connect sources with data they cannot lawfully process
• Browser extension access to page content requires explicit browser permission; the content it inspects is checked in your browser and is not sent unless your administrator turns on redacted text

4.1 Privacy-by-design implementation

Because most Platform data is local by default, several GDPR rights are effectively pre-satisfied for the local recorder and browser extension: data minimization (we only receive what you sync), storage limitation (retention windows below), and purpose limitation (synced fields are scoped to your organization's own policy).

If you are a member of a workspace, your organization is the controller of Workspace Data about you. We will pass on requests we receive about it, or help you with the right contact, and will assist the customer in responding.

4.2 Right of access (Article 15)

• View account and billing information from your cloud dashboard settings
• Request a full export of the personal data we hold via [email protected]
• Response time: within one month, typically within 5 business days

4.3 Right to rectification (Article 16)

• Update account details directly in dashboard settings
• Request correction of any other inaccurate data via [email protected]

4.4 Right to erasure (Article 17)

• Request full account and synced-data deletion via [email protected]
• Locally recorded data can be deleted immediately and directly by you using the Platform's local tooling — no request to us required
• Cloud-side deletion is completed within 14 working days, and residual backups are purged within 45 days, subject to legal retention requirements (e.g. billing records)

4.5 Right to restrict or object to processing (Articles 18 & 21)

You may ask us to restrict processing of your data, or object to processing based on legitimate interest (including product analytics and session replay), by writing to [email protected]. We will honor the request unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim.

4.6 Right to data portability (Article 20)

Request an export of your data in a structured, commonly used, machine-readable format (JSON or CSV) via [email protected]. Export requests are processed within 30 days. Administrators can also export the bounded audit log as CSV from the dashboard.

4.7 Withdrawing consent (Article 7(3))

Where we rely on consent you can withdraw it at any time without affecting earlier processing, for example by disconnecting a browser or device, unsubscribing, or writing to us.

• Local-first architecture: sensitive agent activity stays on-device unless you opt into cloud sync
• Granular controls: organizations choose what is collected, including whether full event payloads and redacted browser text are stored, which apps are monitored, and who can see what
• Role-based access with least privilege, an audit log of administrative changes, and an owner privacy setting that hides owner data from other roles by default
• Redaction of recognized credential formats before storage, and of emails and credentials in App monitoring excerpts; raw log lines are never sent
• Masking of all form inputs in session replay; the Platform does not send page addresses or file names from the workspace browser extension
• Remote requests to devices are scoped to the device's own inventory, are audited, and can be disabled on a device
• No training of third-party foundation models on your data
• Access to cloud-stored data is limited to authorized personnel on a least-privilege basis
• Encryption in transit for all data sent to our cloud infrastructure; App monitoring tokens are stored only as hashes and integration URLs and keys are stored encrypted

Where we process personal data on a customer's behalf, and until a Data Processing Addendum is signed, we will:

• Process it only on the customer's documented instructions, as set out in the Terms and the customer's configuration of the Platform, and tell the customer if an instruction appears to infringe the GDPR
• Ensure personnel with access are bound by confidentiality
• Implement appropriate technical and organizational measures (Section 5)
• Use only the sub-processors in Section 10 and impose equivalent data-protection obligations on them; give notice of changes to customers who ask for it, who may object on reasonable grounds
• Assist the customer, taking into account the nature of processing, with data-subject requests, security, breach notification, impact assessments and consultations
• Notify the customer without undue delay after becoming aware of a personal data breach affecting its data
• Delete or return personal data when the service ends, as described in the Privacy Policy, unless law requires retention
• Make available information reasonably necessary to demonstrate compliance and allow for audits by written request, no more than once a year, subject to confidentiality and reasonable notice

A signed Data Processing Addendum, including Standard Contractual Clauses and the UK International Data Transfer Addendum where required, is available on request at [email protected]. Where signed, it prevails over this page for personal data under the order of precedence in the Terms.

We are headquartered in India, and we and our sub-processors may process data in India, the United States and elsewhere. Where personal data is transferred outside the EEA or UK — for example, to infrastructure providers with data centers in the United States — we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision or another lawful transfer mechanism, and require our sub-processors to maintain equivalent protections. Customers remain responsible for assessing transfers they initiate by connecting third-party destinations.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms and we are the controller, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by GDPR Article 33, and will notify affected individuals directly without undue delay where the breach is likely to result in a high risk, as required by Article 34. Where we are processor, we will notify the affected customer without undue delay so that it can meet its own obligations.

The Platform is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected a child's personal data, we will delete it promptly.

We use the following sub-processors to operate the cloud dashboard, App monitoring, the assistant and the website. Services a customer chooses to connect (chat and paging tools, its own model keys, webhooks) are the customer's own choice and are not our sub-processors.

Named hosting and infrastructure providers, regions and a notification list are available on request.

Agentbeam's scanners and risk-flagging rules are heuristic pattern matches, and any model review of findings or action judging is advisory. They do not produce legal or similarly significant effects on individuals within the meaning of GDPR Article 22 — a flagged action is a recommendation for human review, never an automatic account, employment or access decision by us. Customers who enable enforcement, blocking or address pauses decide how those controls are used, and should not rely solely on automated output for decisions about individuals. We do not use profiling to make decisions about individuals.

GDPR inquiries and requests can be sent to:

• Email: [email protected]
• Subject: “GDPR Request — [Right to Access / Erasure / Rectification / Portability / Restriction / Objection]”
• Include your account email and the specific request details
• We may request identity verification before actioning a request
• Response: within one month, extendable by two further months for complex requests, with notice
• Company: AISOLO Technologies Private Limited, CIN: U62099MH2023PTC403351
• Registered office: 1003, Kamdhenu Commerz, Sector 14, Kharghar 410210, Navi Mumbai, Maharashtra, India

If you are not satisfied with our response, you may lodge a complaint with your local EU/UK supervisory authority. See also our Data Rights page for rights under other jurisdictions.