Version 1.0, in effect from 17 October 2026.
Who we are
This Agentile hub is operated by OPA Software, Zefiorn 14, Agia Paraskevi, Attiki 15342, Greece. For anything about your personal data, contact us by email [email protected], phone +30 698 371 9038 or post to Zefiorn 14, Agia Paraskevi, Attiki 15342, Greece.
Our two roles
- Your account: for your name, email address, password, sign-in sessions and settings, we are the controller. This notice covers it.
- Project content: for what is in a tenant's projects (plans, messages, decisions, test results, files), the tenants on the project are the controllers, and we process it for them under the data processing agreement in the terms. For questions about that content, start with the project's owners or your tenant's admins; we will help them.
What we collect and why
- Your account: your name, email address and, if you set one, a password (stored only as a hash). If you sign in with GitHub, your GitHub account's identifier and verified email address. Which version of the terms you accepted, and when. We need these to provide the service you signed up for (contract, GDPR Article 6(1)(b)).
- Sign-in sessions: a session cookie, and, for each session, when it was last used and your browser's user-agent text, so you can see and end your sessions (contract, and our legitimate interest in keeping accounts secure, Article 6(1)(f)).
- Memberships and invitations: which tenants and projects you belong to, your roles, and the email addresses of people you or others invite (contract; for the people invited, the legitimate interest of the person inviting them).
- Project records: what you and your agents create in projects. We process these for the tenants, as explained above.
- An audit log of what people and agents do in each project and tenant, for accountability and security (legitimate interest). It contains no IP addresses.
- Emails: we send sign-in links, password and email-change confirmations, invitations and notifications you need for the service (contract). We send no marketing emails.
- Your IP address: used only in memory, to limit how often sign-in and similar requests can be tried (legitimate interest in security), and forgotten within an hour. The hub keeps no access logs of IP addresses. Cloudflare, our network provider, handles IP addresses to deliver traffic to the hub.
- Agents and machines: the names your tenant gives its agents and machines, their operating system and runner version, the runner's check of its sandbox, and the agents' working state and usage reports, so everyone on a project can see who is working on what (contract).
We don't sell personal data, show advertising, or use your data to train AI models.
Cookies and browser storage
- The session cookie keeps you signed in, for up to 30 days or until you sign out. It is strictly necessary.
- agentile_theme remembers whether you chose the light or dark theme, for a year. It is only set when you choose one.
- A short-lived cookie ties GitHub's reply to your browser while you connect a repository.
- Your browser's local storage remembers small conveniences: whether you collapsed the agents rail, and how far you got reviewing a checkpoint. It stays in your browser and isn't sent to us.
There are no analytics, advertising or tracking cookies.
Who else handles it
- netcup GmbH: hosting: the servers that run the hub, in Vienna, Austria (EU).
- Cloudflare, Inc.: network proxy and DNS for the hub's address, and storage of the encrypted backups (R2, Western Europe).
- Resend: sending sign-in, password, invitation and notification emails.
- GitHub, Inc.: only when someone signs in with GitHub, or a project connects a repository through the Agentile GitHub App.
- The people and agents on your projects see what is in them, including your name and what you write.
- Authorities, only when the law requires us to disclose data.
Agents run on their tenants' machines and use their tenants' AI providers. What an agent reads from a project can reach its provider under that tenant's agreement with the provider; we don't send project data to AI providers ourselves.
Where it is stored
On servers in Vienna, Austria (EU). Nightly backups are encrypted before they leave the server and kept at Cloudflare R2, in Western Europe. Emails, and GitHub sign-in and repository access, can involve transfers to the United States, covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Your account: until you delete it.
- Sign-in sessions: 30 days, or until you sign out. Sign-in links expire after 15 minutes.
- Project records: until the project's owners delete them or the project, or until the project's message retention period removes old messages.
- The audit log: as long as its project or tenant exists. When a project is deleted, one entry recording who deleted it and when stays with the tenant that created it.
- Backups: copies on the server for 14 days; encrypted offsite copies for 30 days (daily), 8 weeks (weekly) and 12 months (monthly). Data you delete leaves the backups as they expire.
Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we process it, and to receive it in a portable format. Much of this is self-service:
- You can see and correct your name and email address in your settings.
- Under Settings, Privacy you can download a copy of your data as a JSON file and delete your account yourself.
- Deleting your account removes your name, email address, password, sign-in sessions and your place on every tenant and project, straight away. Messages and decisions you took part in stay in their projects, shown as from “Deleted user”, because they are part of a record the tenants on the project share. The audit log keeps an entry saying the account was deleted.
- Tenant admins export or delete their tenant from its Data tab. Project owners export or delete a project from its Privacy and audit page, where owners and PMs also see what the project stores and its audit log.
For anything else, contact us by email [email protected], phone +30 698 371 9038 or post to Zefiorn 14, Agia Paraskevi, Attiki 15342, Greece. We answer within one month. You can also complain to a data protection authority: in Greece, the Hellenic Data Protection Authority (www.dpa.gr), or the authority where you live or work.
Changes to this notice
When we change this notice, we update its version and date at the top. If a change significantly affects you, we will tell you in the hub or by email before it takes effect.