Effective: 2026-04-15 · Last updated: 2026-04-15
Agent2Human (“A2H”, “we”, “us”, “our”) is operated by Simplysoft GmbH, a Swiss limited liability company with its registered seat in Switzerland. For the purposes of the GDPR, the UK GDPR, the Swiss FADP, Brazil’s LGPD, and similar laws, Simplysoft GmbH is the data controller for the personal data processed through the Platform.
You can reach our privacy team at privacy@a2h.net. Mail is monitored by a human, not an auto-responder.
This policy applies to the entire Agent2Human Platform, including:
CF-IPCountry header), and timestamp, for abuse prevention.hello@a2h.net via Cloudflare Email Routing. Not stored in our own database.Access to the Platform is invitation-only. When you accept an invitation, you sign in through a supported provider (Google, GitHub, Facebook, or Microsoft). During sign-in we receive from the provider:
We never receive your password. The sign-in flow keeps your password with your provider; we only see the information you explicitly authorise to share. We do not ask for any additional permissions beyond what is needed to identify you.
We create an account record containing these fields plus your creation timestamp and last-login timestamp.
Through the agent management dashboard, you may provide or configure:
When someone interacts with your agent — whether through our messaging interface, through a supported protocol client, or through any other interface — the Platform records:
Conversation history for an ongoing conversation is accessible to the Creator through the Platform’s messaging interface.
Billing is processed by Stripe, Inc., our payment processor. When you subscribe to a tier or purchase platform credits:
If you turn on real-time push notifications, your browser gives us a subscription that lets us deliver messages to your device. We store that subscription so we can alert you when a message arrives for one of your agents. We sign the notifications ourselves, and each notification is encrypted before it leaves our servers, so the push service that routes it to your device sees only routing information, not the notification content.
We do not receive personal data about you from third-party data brokers, marketing networks, or advertising platforms. The only third parties we receive data from are the parties you have actively chosen to involve: your OAuth provider when you sign in, your payment processor when you pay, and your own BYOK provider when you connect it.
Under the GDPR and comparable laws, we need a specific legal basis for each use of your data. Here is the exhaustive list:
| Purpose | Data used | Legal basis |
|---|---|---|
| Process your waitlist request and notify you when an invitation is available | Email address | Your consent (GDPR Art. 6(1)(a)) |
| Respond to contact-form messages | Name, email, topic, message content | Pre-contractual steps at your request (Art. 6(1)(b)) or our legitimate interest in replying to inquiries (Art. 6(1)(f)) |
| Detect and prevent abuse on the marketing website (bot signups, spam, scraping) | IP, user-agent, country, Turnstile signals | Legitimate interest in keeping the Platform safe (Art. 6(1)(f)) |
| Create and operate your Account on the Platform | OAuth identifiers, email, display name, avatar URL | Performance of our contract with you (Art. 6(1)(b)) |
| Operate the agents you create, including routing requests, storing configurations, and generating or relaying responses | Agent definitions, personas, access grants, Inputs, Outputs, conversation state | Performance of our contract with you (Art. 6(1)(b)) |
| Generate AI Outputs through third-party AI providers (platform-credit mode) | Inputs, agent system prompts, relevant conversation context | Performance of our contract with you (Art. 6(1)(b)) |
| Generate AI Outputs through your own provider (BYOK mode) | Inputs, agent system prompts, your BYOK API key | Performance of our contract with you (Art. 6(1)(b)); in BYOK mode the provider side of the data flow is governed by the provider’s own terms and your relationship with them |
| Process payments, subscriptions, credit purchases, and invoices | Stripe customer/subscription identifiers, invoice data, AI usage events | Performance of our contract with you (Art. 6(1)(b)), and compliance with tax and accounting obligations (Art. 6(1)(c)) |
| Deliver push notifications when a message arrives for one of your agents | Push subscription endpoint, P256dh key, auth key, notification body | Performance of our contract with you (Art. 6(1)(b)), subject to your browser-level permission |
| Detect and prevent platform abuse and security incidents | IP, user-agent, country, request logs, rate-limit state, Turnstile signals | Legitimate interest in keeping the Platform safe (Art. 6(1)(f)) |
| Comply with legal obligations (responding to valid data-subject requests, law-enforcement orders, tax audits, and similar) | Whatever is strictly necessary | Legal obligation (Art. 6(1)(c)) |
We do not use your data for marketing that is unrelated to your Account or the Platform, for profiling, for training machine-learning models (unless you have separately opted in), or for any purpose outside the table above.
Kept until you ask us to delete it, until you accept an invitation and sign in (at which point the record migrates into the Account database), or until we prune dormant entries that have been inactive for more than 24 months — whichever comes first.
Kept for as long as your Account exists, plus up to 30 days after deletion to allow for accidental-deletion recovery and operational continuity. After that we hard-delete your account record and the link to your sign-in provider. We keep a minimal internal marker that the deletion took place, so we have an auditable record that we honoured your request.
Kept for as long as the Agent exists. When you delete an Agent, we delete the configuration, persona, capabilities, and access grants associated with it, subject to a short operational tail (typically no more than 30 days for backups).
Kept while the provider integration is active on your Account. Removed immediately when you disconnect the provider or delete the Account.
Kept for as long as the corresponding Agent or Account exists, unless you delete an individual conversation sooner. The Platform currently does not apply a time-based auto-purge to conversations; if you want your conversation history purged on a schedule, tell us and we will talk about how to implement that for your Account.
Stripe customer and subscription identifiers, invoice references, and AI usage events are kept for as long as is required by Swiss tax and accounting law — typically ten (10) years for documents that establish an invoice position. This is a legal obligation we cannot waive at your request. The content of Inputs and Outputs is not part of the billing record, only the metering (tokens, cost, timestamp).
Kept while the subscription is valid on your device. Removed when you unsubscribe from notifications, when the push gateway tells us the subscription is no longer valid, or when you delete your Account.
Cloudflare retains edge access logs according to its own retention windows (typically on the order of days for edge logs). We do not copy those into our own long-term storage. Where we do collect abuse signals into our own systems (for example, Turnstile verification records associated with a blocked request), we retain them for no more than 90 days.
The message content is not stored in any database. It is forwarded through Cloudflare Email Routing into a shared team inbox at hello@a2h.net. Replies in that inbox are retained for as long as is reasonable for the conversation and deleted when the thread is clearly over.
You can email privacy@a2h.net and ask us to delete your entire personal data. We will do so promptly, except for:
We will give you a confirmation of what has been deleted and what (if anything) has been retained.
The Platform is designed to involve as few third parties as possible. The ones that do touch your data, and what each of them sees, are listed here.
The Platform runs on Cloudflare, Inc.’s infrastructure. Cloudflare hosts the databases (in the European Union region), holds the real-time conversation state, delivers the contact-form email routing, signs push notifications through its edge, and provides the bot-protection widget used on the waitlist and contact forms. Cloudflare is our processor under GDPR Art. 28, governed by its publicly-available Data Processing Addendum and the EU Standard Contractual Clauses. Its privacy statement lives at cloudflare.com/privacypolicy.
When you sign in, you authenticate against one of the supported OAuth providers (Google, GitHub, Facebook, Microsoft). The sign-in itself is a redirect from our site to the provider’s site; the provider then redirects back to us with an authorisation code. The OAuth provider sees the fact that you are signing in to Agent2Human and the scopes we request. We see the identifier, email, name, and avatar URL the provider returns. We do not share any Platform-internal data back to the provider beyond the bare minimum the OAuth flow requires.
When you pay for a Subscription or purchase Credits, Stripe collects your payment details directly in its own systems and returns us a customer identifier plus a subscription state. Stripe is a separate data controller for the payment data it collects and is governed by its own privacy policy and data-protection commitments. We send Stripe the minimum data needed to set up the payment (your email, your tax-related billing country if you have entered one, the subscription or product identifier, and usage-meter events for metered pricing). Stripe’s privacy center is at stripe.com/privacy.
When an Agent generates an AI Output using providers we have contracted with directly, we forward the Input, the agent system prompt, and the relevant conversation context to the provider’s inference API. The provider processes the request and returns an Output. Providers currently in use or available for selection include: OpenAI, Anthropic, Google, xAI, Mistral, DeepSeek, and Cloudflare Workers AI. Each of those providers has its own privacy policy and data-usage policy. We configure our API calls to request, where the provider offers it, that your Inputs and Outputs not be used to train the provider’s models. Not every provider currently offers this guarantee on every tier; we will not enable a provider or a tier for which training cannot be opted out.
When you configure a BYOK API key, AI Outputs are generated directly against your own account at the provider. In BYOK mode, the provider’s privacy policy is what governs the data path, not ours. We still see the Inputs and Outputs in transit through the Platform (because we need to render them, log them for your conversation history, and meter your usage), but the provider’s own processing is between you and them. You must read the privacy policies of the BYOK providers you configure and be comfortable with the way they process data.
When you enable push notifications, the alert is delivered to your device through the push service operated by your browser vendor (typically Google for Chrome and Android, Apple for Safari and iOS, or Mozilla for Firefox). We encrypt the notification content before it leaves our servers, so the push service only sees routing information — not the body of the notification. Those services have their own privacy policies that apply to any metadata they keep (delivery timestamps, device information, and so on).
We may disclose your data to courts, regulators, or law-enforcement authorities if required by a valid legal process. We will push back on overbroad or extraterritorial requests and we will tell you about the request unless we are legally prohibited from doing so. We do not pre-emptively share data with government agencies.
If Simplysoft GmbH is ever acquired, merges with another company, or sells all or substantially all of its assets, your data may transfer as part of that transaction. We will notify Account holders by email before any such transfer takes effect and will give you the opportunity to delete your data first.
The marketing website does not set any cookies of its own during ordinary page views. You can read every marketing page, including this one, without receiving a single cookie from us.
The Platform itself uses a very small number of functional mechanisms:
We do not use analytics cookies, marketing cookies, cross-site tracking cookies, advertising pixels, web beacons, or local-storage trackers.
Your personal data is processed in multiple countries because of how the Platform and its third-party providers are distributed:
We recognise that “is the company going to train on my conversations?” is one of the first questions users ask any AI platform, so we are stating the answer clearly:
We do not train machine-learning models on your Inputs, your agent configurations, your conversation history, or on Human Responses composed by Creators — unless you have separately and affirmatively opted in through a feature explicitly described to you as a training opt-in. Accepting the Privacy Policy or the Terms of Service, by itself, is not such an opt-in.
When an AI Output is generated through a third-party provider in platform-credit mode, we configure the API call to request that the provider also not use your data for training, where the provider offers that option. Not every provider offers this guarantee on every tier; we will not enable a tier that cannot be opted out of training. If a provider later changes its default in a way that conflicts with this commitment, we will notify affected users before the change takes effect.
BYOK mode is different: when you bring your own provider key, the provider processes your Inputs under your own account under the terms you accepted with them directly. You are responsible for reading those terms and for any training-opt-out settings your provider offers.
No matter where you are in the world, you can ask us to:
To exercise any of these rights, email privacy@a2h.net. We aim to respond without undue delay and in any event within one month of receiving your request, as required by the GDPR. If we need longer (for a complex request), we will tell you and explain why. We will not charge a fee or ask for disproportionate proof of identity for a routine request — though for requests that could expose someone else’s data, we may ask you to sign in to your Account before we act.
Because our audience is global, some people reading this policy have legal rights that go beyond the baseline above. The sub-sections here spell those out. Nothing in a regional supplement takes away from your baseline rights — it only adds to them.
Simplysoft GmbH is subject to the revised Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023). Under the revFADP you have the rights listed in Section 10 above, plus the right to know the country to which your data is transferred and the safeguards applied (see Section 8). You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
If you are in an EEA member state (all 27 EU countries plus Iceland, Liechtenstein, and Norway), your processing is subject to the EU GDPR. You have all the rights in Section 10. You can lodge a complaint with your national data-protection authority; a full list is maintained by the European Data Protection Board at edpb.europa.eu/about-edpb/board/members_en.
EU representative (Art. 27 GDPR). At Simplysoft GmbH’s current scale, the processing carried out through the Platform is being evaluated against the Art. 27(2)(a) exemption for occasional, non-high-risk processing. Where we determine that the exemption applies we will continue to rely on it; where we determine that it does not, we will appoint an EU representative and publish their contact details here. If you need to contact our EU representative for a specific matter, email privacy@a2h.net and we will route your request appropriately.
If you are in the United Kingdom, your processing is subject to the UK GDPR and the Data Protection Act 2018. You have the same rights as EEA residents. You can lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights:
Categories of personal information collected (in CCPA terms): “identifiers” (email, IP, OAuth identifier, user ID, Stripe customer ID), “commercial information” (subscription state, credit balances), “internet or other network activity” (request metadata, user-agent), and “inferences drawn from other personal information” (none — we do not build inferred profiles).
Global Privacy Control. We honor the Global Privacy Control signal. If your browser sends a GPC header, we treat it as a valid opt-out of any “sale” or “sharing” under the CCPA — even though we do not sell or share to begin with.
To exercise any of these rights, email privacy@a2h.net.
If you are a resident of Colorado, Connecticut, Delaware, Iowa, Montana, Oregon, Tennessee, Texas, Utah, or Virginia, comparable consumer-privacy laws give you rights that closely mirror the California rights listed above: access, correction, deletion, opt-out of sale or targeted advertising, and non-discrimination. We honor all of these at privacy@a2h.net, and as noted, we do not sell your data or serve targeted ads to begin with.
Nevada SB 220. We do not sell any covered information as defined by Nevada Revised Statutes Chapter 603A.
If you are in Brazil, Lei Geral de Proteção de Dados (Lei nº 13.709/2018) applies to this processing. Simplysoft GmbH is the data controller (controlador). You have rights of confirmation, access, correction, anonymisation, portability, deletion, information about shared parties, and revocation of consent. You can exercise these at privacy@a2h.net. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial laws (Quebec Law 25, Alberta PIPA, British Columbia PIPA) govern our handling of your personal information. You have the right to access, correct, and withdraw consent to the processing of your personal information. You can lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If you are in Australia, our handling of your personal information is subject to the Australian Privacy Principles under the Privacy Act 1988 (Cth). You have the right to access and correct your personal information. You can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
If you are somewhere not listed above and your country has a privacy or data-protection law giving you additional rights, we will honor those rights in good faith at privacy@a2h.net, even if we have not written a dedicated sub-section for your jurisdiction.
Agent2Human is not directed at children and we do not knowingly collect personal data from anyone under the age of 16. If local law in your country sets a higher age of digital consent, that higher age applies instead. If you believe a minor has submitted personal data to us, please contact privacy@a2h.net and we will delete it promptly.
When you interact with a waitlist or contact form, Cloudflare Turnstile makes an automated assessment of whether you are a human or an automated script. This is authorised by your implicit consent when you use a form protected by a visible CAPTCHA widget and has no effect on you other than blocking a single submission (which you can retry).
When an Agent generates an AI Output, the underlying large language model is an automated system. We do not consider AI Output generation to be automated decision-making with legal or similarly significant effects on you for the purposes of GDPR Art. 22 — because nothing in the Platform takes a legally binding decision about you based on the AI Output. The Output is a message, not a decision. You should not rely on any Output for decisions that have legal or similarly significant effects on you or on anyone else. See the Terms of Service for the full discussion of AI-output reliance.
We do not carry out any profiling, inference-building, or automated decision-making that has legal or similarly significant effects on you. We do not train machine-learning models on your personal data without your affirmative opt-in (Section 9).
We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse:
No system is perfectly secure, and we cannot guarantee absolute security of data transmitted over the internet or held on any server. If we become aware of a personal-data breach that affects you, we will notify you as soon as reasonably possible, in line with applicable law (within 72 hours for GDPR-covered incidents).
If you discover a security vulnerability, please disclose it privately to security@a2h.net. Good-faith security research is welcome.
We will update this page when we make meaningful changes to how we handle personal data. The “Effective” and “Last updated” dates at the top reflect the most recent change. For material changes that affect Account holders — for example, a new category of data collected, a new processor, a new purpose, or a change in retention — we will send an email at least 30 days before the change takes effect and give you the opportunity to delete your data beforehand. Non-material changes (typos, clarifications, new regional supplements that only add protections) take effect on publication.
Questions, requests, or complaints about this privacy policy should go to privacy@a2h.net. Security-related disclosures go to security@a2h.net. Formal legal notices go to legal@a2h.net. Postal mail can be addressed to Simplysoft GmbH, Switzerland — email us at the same address for the current mailing address.
Simplysoft GmbH · Switzerland
This policy is drafted to comply with the Swiss revFADP, the EU GDPR, the UK GDPR, the California CCPA/CPRA, other US state consumer-privacy laws listed in §11.5, Brazil’s LGPD, Canada’s PIPEDA and provincial equivalents, and the Australian Privacy Act 1988.
Nothing in this document is legal advice. If a specific clause conflicts with a mandatory protection under your local law that is more protective of you, that local protection takes precedence over the text here.