Privacy Policy

The controller of your personal data is:

As data controller, GRONDIN Florian determines the purposes and means of the personal data processing carried out by Agentizen within its applications, including the Citizen of AI Service.

We apply the principle of data minimisation (art. 5 GDPR): only the data strictly necessary for the Service to operate is collected.

2.1 Account data

2.2 Usage data

• History of conversations with AI Agents;
• Custom AI Agent settings (chosen model, instructions, enabled tools);
• Technical metadata: IP address, browser type, operating system, connection timestamps.

2.3 Payment data

2.4 Files and documents transmitted

Your data is processed for the following purposes, each governed by a specific legal basis (see article 4):

• Service provision: account creation and management, access to AI Agents, conversation history.
• AI Agent customisation: remembering your AI Agents' settings and custom instructions.
• Billing and subscription management: tracking subscriptions and usage via Stripe.
• Security and abuse prevention: detection of unauthorised access, fraud prevention, technical logs.
• Service improvement: aggregated and anonymised usage analysis to improve features.
• Legal compliance: compliance with applicable legal, accounting and tax obligations.

In accordance with Article 6 of the GDPR, each processing operation is based on one of the following legal bases:

• Art. 6(1)(b) — Contract performance: processing necessary for the provision of the Service in accordance with the Terms (account management, AI Agent access, billing).
• Art. 6(1)(f) — Legitimate interest: securing the Service, fraud prevention, feature improvement, technical logs.
• Art. 6(1)(a) — Consent: sending optional marketing communications, depositing non-essential cookies. Consent is freely revocable at any time.
• Art. 6(1)(c) — Legal obligation: retention of accounting and tax data in accordance with French law.

Your data may be transmitted to the following recipients, strictly within the limits of the purposes mentioned in article 3. No data is sold to third parties.

• AI providers (third parties): OpenAI, Anthropic, Mistral AI, Google — only the data necessary to process your requests (message content, agent settings). Each provider operates under its own privacy policy.
• Stripe, Inc. (third party): payment provider. Receives the data necessary for billing (email, customer ID). Based in the United States — covered by adequate contractual guarantees (DPA + SCCs).
• Contabo GmbH (EU): server hosting. Processing carried out in Germany (European Union), GDPR compliant.
• Cloudflare, Inc. (third party): CDN, DDoS protection and DNS. Limited access to network metadata (IP, HTTP headers). Covered by adequate contractual guarantees.

Data is retained for the period strictly necessary for the purposes for which it was collected, in accordance with Article 5(1)(e) of the GDPR.

Deletion periods are defined by a policy stored under the data_retention_policy key and can be revised by the service operator.

Purges are triggered on natural application cycles (server startup after migrations, then end of each task-engine cycle), not on a dedicated timer.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access (art. 15): obtain a copy of all personal data concerning you that we hold.
• Right of rectification (art. 16): correct inaccurate or incomplete data concerning you.
• Right to erasure (art. 17): request the deletion of your data, subject to legal retention obligations.
• Right to restriction (art. 18): temporarily restrict the processing of your data in certain cases provided for by the GDPR.
• Right to portability (art. 20): receive your data in a structured, machine-readable format, or have it transmitted to another controller.
• Right to object (art. 21): object to processing based on legitimate interest, or to marketing communications at any time.

How to exercise your rights

Any request may be sent by email to contact@agentizen.ai, specifying your name, account email address and the nature of your request.

We undertake to respond within a maximum of one (1) month of receipt of your request (a period that may be extended to 3 months for complex requests, with prior notice).

We implement appropriate technical and organisational measures to protect your data against any unauthorised access, disclosure, alteration or destruction, in accordance with Article 32 of the GDPR.

• Encryption in transit: TLS 1.2/1.3 on all communications between your browser and our servers.
• Password hashing: bcrypt algorithm with individual salting. Your passwords are never stored in clear text.
• Application firewall: WAF (Web Application Firewall) and DDoS protection via Cloudflare.
• Environment isolation: strict separation of production, staging and development environments.
• Restricted access: principle of least privilege — access to data limited to duly authorised people.
• Breach notification: in the event of a data breach, notification to the CNIL within 72h and to affected persons if necessary.

Despite these measures, no system is infallible. If you suspect your account has been compromised, contact contact@agentizen.ai immediately.

Some of our processors are established outside the European Union, notably in the United States. These transfers are governed by appropriate safeguards in accordance with Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into the data processing agreements (DPA) concluded with each processor;
• Adequacy decision where applicable (e.g. EU-US framework when applicable);
• Certifications of processors (e.g. ISO 27001, SOC 2).

You can obtain a copy of the safeguards in place by sending a request to contact@agentizen.ai.

In accordance with our transparency obligation, here is the up-to-date list of our subprocessors within the meaning of Article 28 of the GDPR. This list is subject to change; any substantial change will be reflected in this policy.

The Citizen of AI Service is intended for persons aged at least 16. We do not knowingly collect personal data concerning children under 16.

If you are a parent or legal guardian and believe your child has provided personal data without your consent, contact us at contact@agentizen.ai so that we can delete it promptly.

This privacy policy may be updated to reflect legal, regulatory, technical or business practice developments.

In the event of a substantial change affecting your rights or the nature of the processing, we will inform you by email and/or by a visible notice on the Service, at least 15 days before the changes come into effect.

The current version is always available at the address www.agentizen.ai/legal/privacy-policy. Previous versions are archived and available on request.

For any question relating to this policy or the exercise of your rights, you can contact the data controller: