Disclosure Regarding End User Data

AgentCat provides analytics for MCP (Model Context Protocol) servers. Our customers install our SDK in MCP servers they own or control, and it captures how the people and AI agents that use those servers ("End Users," shown as "Actors" in our product) interact with them.

This Privacy Policy does not apply to End User Data. "End User Data" means the events our SDK captures from a customer's MCP server and transmits to AgentCat, including tool-call parameters and responses, error messages and stack traces, IP addresses, End User identifiers and metadata, session records, and AI-generated session summaries. We process End User Data on our customers' behalf under our Terms of Service and Data Processing Addendum, and our customers' respective privacy notices govern its collection and use. If you interact with an MCP server that uses AgentCat and have questions or requests concerning your personal information, please direct them to the company that operates that server. If you contact us instead, we will promptly forward your request to the applicable customer and notify you that we have done so (see Section 13).

1. Who This Policy Covers

This Privacy Policy covers the personal information AgentCat collects for its own purposes from:

• Site visitors — individuals who browse agentcat.com or our documentation.
• Customers — individuals who create or use an AgentCat account.
• End Users — as described in the Disclosure Regarding End User Data above, this Privacy Policy does not apply to End User Data; we process it as a service provider on behalf of our customers. Section 13 describes how to direct a request.

2. Personal Information We Collect

Site visitors. We collect your IP address, browser and device information, the pages you visit, and identifiers collected through cookies and similar technologies, including an identity-resolution service that may associate your visit with your name, work email address, and LinkedIn profile (see Section 5 for details and opt-out choices).

Customers. We collect your email address (used for authentication), your name and avatar if you choose to provide them, your organization's name, billing information (payments are processed by Stripe; we do not store card numbers), the settings and content you create in the dashboard, and information about how you use it, including session replays.

End Users. We collect End User Data on behalf of our customers rather than for our own purposes, as described in the Disclosure Regarding End User Data above. The categories of personal information our SDK captures are summarized in that disclosure and listed in full in our Data Processing Addendum.

3. How We Use Personal Information

We use personal information to provide the service, for administrative and security purposes, and to communicate with you, as described below.

Site visitors. We use visitor information to operate, secure, and improve agentcat.com, to understand interest in AgentCat, and — through the cookies and similar technologies described in Section 5 — to measure and improve our advertising.

Customers. We use customer information to:

• Provide the service: authenticate you with one-time email codes and, for our MCP endpoint, OAuth; operate your dashboard; meter usage; and bill you through Stripe.
• Communicate with you: transactional email such as sign-in codes, invites, and weekly project activity summaries (which you can turn off), responses to support requests, and occasional product updates you can opt out of.
• Secure and improve the service: monitoring for abuse, debugging, and producing de-identified, aggregated statistics.
• Comply with legal obligations.

End User Data. We process End User Data only to provide the service to the customer it belongs to — storing Events, organizing them into Sessions, grouping errors into Issues, generating the AI analyses described in Section 7, and exporting data to destinations the customer configures. The purposes of that processing are set by our customers as its controllers; see the Disclosure Regarding End User Data and our Data Processing Addendum.

Legal bases. Where the GDPR or UK GDPR applies, our legal basis for providing the service and communicating with you about your account is the performance of our contract with you. Our legal basis for operating and securing our website, improving the service, and measuring our advertising is our legitimate interests. We rely on your consent for cookies and marketing communications that require it, and on our legal obligations where processing is required to comply with law.

4. What We Do Not Collect, and Privacy Controls

Some things we deliberately do not do:

• We never collect or store passwords. Signing in uses one-time codes sent to your email.
• We do not store payment card numbers. Card details go directly to Stripe, our payment processor.

Controls that limit what reaches or stays with us:

• Server-side redaction, on by default. Every project starts with redaction enabled: sensitive values in Event payloads — such as email addresses, IP addresses, and unique identifiers — are redacted before storage. You can adjust this per project.
• SDK-side redaction that fails closed. Our SDKs accept custom redaction functions that run inside your own infrastructure, removing values before data is sent to us. If a redaction function fails, the affected values are replaced with placeholders rather than transmitted unredacted.
• AI features can be disabled for your organization on request (Section 7).
• Real deletion. Deleting a project starts the permanent, irreversible deletion described in Section 10.

5. Cookies and Tracking Technologies

On our marketing website. We and our partners use cookies and similar technologies: for analytics, to understand how visitors use our site (including Google Analytics, and Plausible — a cookieless service that stores no identifiers on your device); for advertising, so our advertising partners can measure our campaigns and attribute sign-ups, which may involve cookies that recognize your browser across sites; and for business identity resolution, which may associate your visit with professional contact details such as your name, work email address, and LinkedIn profile.

Where your region's law requires consent, a banner lets you accept or decline non-essential cookies before they are set; its preferences let you decide about analytics and advertising separately. Wherever you are, you can review or change your choices at any time through the "Your Privacy Choices" link in our footer. Our advertising and analytics tags are suppressed on our unsubscribe pages.

In the dashboard. The dashboard does not use advertising or marketing cookies. It uses cookies and browser storage needed to keep you signed in and operate the product, and the session-replay tooling described in Section 2 uses browser storage to link a session together.

6. Your Advertising and Tracking Choices

You can decline non-essential cookies in the consent banner where it is shown, enable the Global Privacy Control in your browser (we honor it automatically), or use the "Your Privacy Choices" link in our footer. Any of these stops the advertising and identity-resolution activity described in Section 5 for your browser. We do not sell personal information in exchange for money, and we do not sell or share customer account information or End User Data.

7. Artificial Intelligence

Some AgentCat features use large language models to analyze Customer Data. "Customer Data," as defined in our Terms of Service, is the data you or your MCP servers send to AgentCat, and includes End User Data. These features discover session goals, categorize and summarize sessions, and assist with error analysis. Inference runs on AWS Bedrock in the United States. Prompts and outputs are not sent to the model's developer, and AWS does not use them to train models.

We may use Customer Data to train or fine-tune machine learning or artificial intelligence models solely for the benefit and use of the customer the data belongs to. We do not use one customer's data to train models made available to any other customer or third party.

AI-generated output is probabilistic and may be inaccurate or incomplete. Analyses derived from End User Data — such as inferred user intent, session goals, and session categories — are themselves End User Data, covered by the Disclosure Regarding End User Data and processed on our customers' instructions. AI analysis features can be disabled for your organization on request.

8. Storage and Security

AgentCat is hosted on Amazon Web Services in the United States, where Customer Data and End User Data are stored, including in our analytics database (ClickHouse Cloud, also on AWS in the United States). AI inference runs on AWS Bedrock in the United States (Section 7).

We maintain a security program that includes annual SOC 2 Type II audits covering all five Trust Services Criteria, quarterly security assessments, and annual third-party penetration tests. Data is encrypted in transit and at rest, and access to production systems is limited to personnel who need it. Our current certifications and security documentation are available at trust.agentcat.com.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you as required by applicable law.

9. Third-Party Services

We share personal information with service providers that help us operate AgentCat, under agreements that limit their use of it to providing services to us: Stripe for payments, Resend for transactional email, Amazon Web Services for hosting and AI inference (Section 8), our session-replay provider (Section 2), our customer-relationship and internal-alerting tools, and the analytics and advertising services described in Section 5. The providers that process End User Data on our customers' behalf are listed, with change notifications available, at trust.agentcat.com; that list concerns your end users' data, while this policy concerns yours.

We may also disclose personal information where required by law or legal process, to protect the rights, safety, or property of AgentCat, our customers, or others, or in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply until it is updated.

10. Retention and Deletion

We retain personal information for as long as it is needed for the purposes described in this policy. In practice: customer account information is retained while your account is active, and Customer Data and End User Data are retained while the project they belong to exists. Deleting a project — or canceling your account, which deletes its projects — starts a permanent deletion: the data remains available for export for 30 days and is then irreversibly deleted. If we terminate an account for a violation of our Terms of Service, or where the law requires, we may delete data sooner.

Customers can request deletion of account information by emailing privacy@agentcat.com. If you are an End User, deletion requests run against the customer that operates the MCP server you used (Section 13).

11. International Transfers

We are a United States company, and the personal information described in this policy is processed in the United States. Where we receive personal information protected by the GDPR, the UK GDPR, or Swiss law, we transfer it under the European Commission's Standard Contractual Clauses, together with the UK Addendum and Swiss adaptations where they apply, as set out in our Data Processing Addendum.

12. Your Rights

Depending on where you live, you may have rights over your personal information, including the right to access a copy of it, correct it, delete it, receive it in a portable format, object to or restrict certain processing, and withdraw consent you have given. If you are in the European Economic Area, the United Kingdom, or Switzerland, these rights arise under the GDPR, the UK GDPR, or the Swiss FADP; several U.S. states provide similar rights (Section 14).

To exercise any of these rights, email privacy@agentcat.com. We may need to verify your identity, normally by confirming your control of the email address associated with your account. We respond within 30 days. If we decline a request, we will explain why, and you may appeal by replying to our response. You may also lodge a complaint with your local supervisory or data-protection authority.

If you are an End User, these rights run against the customer that operates the MCP server you used — see Section 13.

13. If You Are an End User

AgentCat processes End User Data as a service provider on behalf of the customer that operates the MCP server you interacted with. That customer decides what is collected and why, and privacy rights over End User Data run against that customer, not against us. If you contact us about End User Data, we will promptly forward your request to the applicable customer and confirm to you that we have done so; beyond that acknowledgment, we act only on the customer's instructions. If you do not know who operates the MCP server you used, tell us what you know and we will try to identify the right customer.

14. United States State Privacy Disclosures

Several U.S. states, including California, grant residents rights like those described in Section 12. For the purposes of those laws: we collect the categories of personal information described in Section 2 and use them for the purposes described in Section 3; we do not use or disclose sensitive personal information for purposes that would trigger a right to limit; we do not sell personal information as "sell" is defined by the CCPA; and our use of the advertising services described in Section 5 may constitute "sharing" as defined by that law, from which Section 6 describes how to opt out, including through the Global Privacy Control and the "Your Privacy Choices" link in our footer. We do not knowingly sell or share the personal information of consumers under 16. We will not discriminate against you for exercising any privacy right.

15. Children's Privacy

AgentCat is not directed at children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If a change is material, we will email registered customers at least 30 days before it takes effect; other changes take effect when posted on this page, and the effective date always appears at the top.

17. Contact

For privacy questions or requests, contact privacy@agentcat.com. For anything else, contact hi@agentcat.com.

AgentCat is operated by AgentCat, Inc., a Delaware corporation based in New York City.