Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address, name, and passkey credentials. We also store organization information you provide.

Usage Information

We collect information about how you use the Service, including agent runs, API calls, feature usage, and performance metrics. This helps us improve the Service and optimize costs.

Technical Information

We automatically collect IP addresses, browser type, device information, and session data for security and analytics purposes.

2. How We Use Your Information

• To provide, maintain, and improve the Service
• To process billing and credit transactions
• To execute agent runs on your behalf
• To send transactional emails (approvals, alerts, receipts)
• To detect and prevent fraud and abuse
• To provide customer support
• To generate aggregate analytics (never individual)
• To comply with legal obligations

3. AI Agent Data Handling

When AI agents work on your behalf, they may access data you provide through integrations (e.g., GitHub repositories, databases). Agent interactions are logged in an immutable audit trail. We use the “Phantom Token” pattern — your real credentials are never exposed to AI models. Agent execution data is used only for your benefit and is not shared with other users.

4. Data Sharing

We do not sell your personal information. We may share data with:

• AI Model Providers — Agent prompts are sent to language model providers (e.g., Anthropic) for processing. We minimize data sent and never include your credentials.
• Payment Processors — Stripe processes your billing information. We do not store credit card numbers.
• Infrastructure Providers — AWS hosts the Service. Data is encrypted in transit and at rest.
• Legal Requirements — We may disclose data if required by law, regulation, or legal process.

5. Data Security

We implement industry-standard security measures including: TLS 1.3 encryption, password hashing with bcrypt, credential isolation via the Phantom Token pattern, immutable audit logging, and regular security reviews. SOC 2 Type II certification is planned.

6. Data Retention

We retain your account data for as long as your account is active. Agent run data and audit logs are retained for 2 years for compliance and replay purposes. Usage metrics are aggregated and anonymized after 90 days. Upon account deletion, personal data is removed within 30 days.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Export your data in a machine-readable format
• Object to certain processing
• Withdraw consent for optional communications

To exercise these rights, contact us at privacy@mightykey.ai.

8. Cookies

We use essential cookies for authentication (session tokens and organization context). We do not use advertising or tracking cookies. Analytics are handled server-side.

9. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email at least 30 days before taking effect.

11. Contact

For privacy questions or data requests, contact us at privacy@mightykey.ai.