Privacy Policy

1. Who we are and what this covers

Agaro Technologies LLC ("Agaro," "we," "us") is based in Brambleton, Virginia, United States. This policy covers agaro.ai, our sales and support conversations, and Agaro ERP at erp.agaro.ai, together the "Services."

Agaro ERP is currently in a Preview and Pilot phase, available to selected pilot customers. Features, providers and this policy may change as the service moves toward general availability. We will update this page when they do.

Applications and websites that customers build and publish with App Builder or Studio are operated by those customers. Their own privacy notices apply to people who use them.

2. Our role: controller or processor

For information we use to run our own business (website visitors, sales contacts, account holders, billing and our own analytics) Agaro is the controller, the party that decides why and how the information is used.

For information an organization puts into its Agaro ERP workspace ("Customer Content"), the organization is the controller and Agaro is its processor, called a "service provider" under California law. We process Customer Content only to provide, secure and support the Services under the organization's instructions and our agreement. If you are an employee, client or contact of an Agaro customer, that organization's privacy notice governs your information and it is your first point of contact.

If your organization needs a data processing agreement, write to legal@agaro.ai before you load personal information that requires one.

3. Information we process

What we process depends on the modules your organization uses and what it chooses to store.

• Contact and inquiry information: name, email, phone, company, role, messages and booking details.
• Account and security information: user identifiers, password hashes, two factor settings, sign in events, IP address, device and browser details, workspace roles and permissions.
• Business records: customers, leads, vendors, contracts, projects, tasks, products, inventory, orders, invoices, expenses, payments, accounting and documents.
• People and payroll records: employee contact details, employment details, attendance, leave, compensation, payslips, tax identifiers, bank details for salary payment, and documents such as passports or work permits if your organization stores them. Attendance features can record location or IP address when enabled. Some of this is sensitive personal information under applicable law.
• AI information: prompts, messages, attached files, workspace context the agent reads, model responses, tool calls and their results, approvals and usage.
• Connector information: external account identifiers, encrypted access tokens or API keys, and the records exchanged with the connected service.
• Marketing and messaging information: email lists, campaign content, delivery, open, bounce and unsubscribe events, inbound replies, and SMS or call records when messaging is enabled.
• Billing information: plan, seats, usage, invoices, billing contact and payment status. Card and bank details entered in Stripe checkout are processed by Stripe; we receive status, identifiers and limited details such as card brand and last four digits.
• Diagnostic information: error reports, request logs, rate limit records and security events.

4. How we use information

• Provide the modules you use, store your records and carry out the actions you or your agents request.
• Authenticate users, enforce workspace isolation and permissions, keep activity logs, and detect and stop abuse.
• Run connectors, send email and messages you configure, and register domains you buy.
• Bill subscriptions and usage, and manage credits and add ons.
• Answer inquiries, schedule calls, provide support and send service notices.
• Understand how the Services are used and improve them, subject to the analytics and AI choices described below.
• Meet legal, tax and accounting obligations and handle disputes.

We do not sell Customer Content or account data, and we do not use Customer Content to build advertising profiles.

6. Connectors, domains and messaging

When you connect an external account, Agaro exchanges data with that service within the scopes you approve. Connector authorization runs through Composio or Nango, and stored credentials are encrypted. Data you send to an external service is governed by that service's own terms.

Disconnecting stops future access. It does not delete data already copied into Agaro or into the other service, and you may also need to revoke access in that provider's settings.

When a workspace buys a domain, the registrant details are shared with name.com and published in registration records as registry rules require. When a workspace enables SMS or voice, Agaro creates a dedicated Twilio subaccount for it. Marketing email is sent through Resend with unsubscribe handling.

7. This website, cookies and tracking

agaro.ai does not take payments and does not show advertising. We do measure how the website is used, using the services below. They set cookies or use local storage in your browser to tell visits apart. None of them runs until you press Accept on the cookie banner. You can turn tracking off at any time with the button below.

• PostHog: records the pages you open, your clicks, how far you scroll, which sections you see, how long you spend on a page, page speed and browser errors. Session replay, a recording of how the page was used, is part of this. Everything you type into a form is masked and is never recorded, including the free text answers in our questionnaire. For the questionnaire we record which step you reached and which fixed choice you picked on each step. The data goes to PostHog's US cloud.
• Google Analytics: measures visits, pages and traffic sources through Google's tag, and sets Google cookies. Google receives your IP address and device information.
• Cloudflare: hosts the site and processes request data such as IP address, browser and requested page for delivery, security and basic traffic measurement.
• Unsplash: serves some images, so your browser requests them from Unsplash.

We use this to understand how people use the website and to improve it. We do not use it to build advertising profiles, and we do not sell it. Some privacy laws, such as California's, treat sharing data with analytics providers as "sharing" or "sale" in certain cases. You can opt out as described below.

How to opt out

If your browser sends a Global Privacy Control or Do Not Track signal, we turn off PostHog and Google Analytics for you and we do not record your session. You can also turn them off yourself with the button below, which remembers your choice in this browser. You can also block these services in your browser or with a content blocker, or use Google's opt out add on for Google Analytics. Booking and forms keep working if you do. You can also email legal@agaro.ai and ask us to delete analytics data about you.

Turn off analytics in this browser

Done. Analytics is off in this browser. Clearing your browser data resets this choice.

When you submit a form, your email, message, the page you were on, and for the contact form your IP address and browser details, are sent to Agaro's own Agaro ERP workspace as a lead and contact record. For the get started questionnaire, the answers you give are included. If that delivery fails, the submission can be written to our Cloudflare logs so we can recover it.

Inside Agaro ERP, turning off "Allow product analytics" under Settings, Privacy stops analytics events for your activity, and session replay masks all text and inputs.

8. Service providers and subprocessors

These providers process personal information for us to run the Services. "Set by provider" means we have not contractually fixed the processing location.

Services you choose to connect (for example Google, Microsoft, QuickBooks, Gusto or Discord) and electronic invoicing networks your workspace enables (such as a Peppol access point) receive the data you send them as your choice, not as our subprocessors. We will update this list before adding a provider that processes Customer Content and, where a customer agreement requires it, give advance notice.

9. Other disclosures

• Inside your organization: administrators and colleagues with the right permissions can see records and activity in your workspace.
• Professional advisers and authorities: accountants, lawyers, insurers and authorities when reasonably needed to meet legal obligations, respond to valid legal process, or protect rights and safety. Where lawful, we will tell the affected customer before disclosing Customer Content.
• Business transfers: parties to a merger, financing or sale of assets, under confidentiality obligations, with this policy continuing to apply.

10. Legal bases

Where the GDPR, UK GDPR or similar laws apply, we rely on: performing our contract with you or taking steps you request before one; legitimate interests in running, securing, improving and marketing our business to other businesses, balanced against your rights; legal obligations; and consent where the law requires it, which you can withdraw at any time for future processing.

For Customer Content, the workspace owner chooses and is responsible for the legal basis, including for employee and payroll data and marketing email.

11. Security

• Tenant isolation: workspace data is separated by PostgreSQL row level security, enforced by the database, in addition to checks in the application.
• Access control: roles, module permissions, attribute based rules on records, and two factor authentication. SAML single sign on can be configured.
• Agents and API: AI agents, API keys and MCP clients act as a specific user and cannot exceed that user's permissions.
• Encryption: connections use TLS, and connector credentials, payroll bank details and other secrets are additionally encrypted at the application layer with a key specific to each workspace (AES 256 GCM).
• Support access: Agaro staff cannot open your workspace unless a Super Admin approves a request. A grant lasts 24 hours, can be revoked at any time, and every step is recorded in your activity log.
• Activity log: changes to records and security events are recorded and visible to authorized administrators.

No system is perfectly secure. Report a suspected vulnerability to legal@agaro.ai without including passwords or unnecessary personal information.

12. Security incidents

If we confirm a security incident that affects Customer Content or your personal information, we will notify affected customers without undue delay, tell them what we know and what we are doing, and provide information they need to meet their own obligations. We will notify regulators and individuals where the law requires us to. Early reports may be incomplete and will be updated as the investigation continues.

13. Retention, export and deletion

• Workspace records: kept while the workspace exists. We do not delete records on a fixed timer.
• Export: administrators can export the workspace in CSV or JSON for each module, with attachments, from Settings. Contact us if you need help with a large export.
• Workspace deletion: a Super Admin can request deletion of the whole workspace in Settings. It stays pending for 30 days, can be cancelled in that time, and is then permanently deleted from the live database.
• Personal account deletion: deleting your own account immediately anonymizes your profile. Business records you created and activity history remain with the workspace, which owns them.
• Former employees: when an employee leaves, they keep read only access to their own payslips and tax forms for four years by default. An administrator can shorten or extend this. When it ends, the sign in closes; the payroll history stays in the workspace.
• Inactive workspaces: a workspace without an active paid plan that has no sign in or change for 90 days becomes read only. Nothing is deleted, and signing in or activating a plan restores it.
• Cancellation: ending a subscription does not delete your workspace. Request deletion separately if you want it removed.
• Backups, logs and billing records: copies in provider backups expire on the provider's backup cycle. Billing and tax records are kept as long as the law requires. We have not set a fixed retention period for analytics and diagnostic logs.
• Website leads: kept in our sales workspace until they are no longer useful or you ask us to delete them.

14. International transfers

Agaro is based in the United States. Our primary database is in the United States, and our providers may process information in other countries. We do not offer a choice of data residency region today, including in the European Union.

Where the law requires safeguards for transfers out of the EU, the UK or another country, those safeguards, such as standard contractual clauses, must be agreed in writing with us. Contact legal@agaro.ai before loading data subject to transfer restrictions so we can confirm what is in place.

15. Your privacy rights

Depending on where you live, laws such as the GDPR, the UK GDPR, and the California Consumer Privacy Act may give you rights to access, correct, delete or receive a copy of your personal information, to object to or restrict some processing, to withdraw consent, to opt out of sale, sharing or targeted advertising, and to complain to a regulator. California residents will not be treated differently for using these rights. This summary is for information only and is not legal advice.

To make a request, email legal@agaro.ai or call +1 (571) 278 8979. Tell us which account or relationship it concerns. Do not send passwords or identity documents in your first message. We will verify your identity in proportion to the request, respond within the time the applicable law allows, and explain any part we cannot fulfill. You may use an authorized agent where the law allows. To appeal a decision, reply and say you are appealing.

If your information is in an employer's or client's workspace, that organization controls it. We will pass your request to them and help them respond.

16. Children

The Services are for businesses and are not directed to children under 16. We do not knowingly collect their information for our own purposes. If you believe a child has given us personal information, contact us and we will delete it where appropriate.

17. What we do not claim

To be plain about it: we do not currently hold SOC 2, ISO 27001, HIPAA or similar certifications or attestations, we do not currently offer HIPAA business associate agreements, we do not offer an uptime or response time guarantee in this policy, we do not offer selectable data residency, and we do not promise that every third party provider retains nothing. Ask us before relying on any of these.

18. Changes to this policy

We will update this policy as the Services change and show the new date above. For material changes we will notify account holders by email or in the product before they take effect, and ask for consent where the law requires it.

19. Contact