Privacy — agentcheck

Who holds it

Your data is held by TrainedBooks, an independent software business in California, United States, which operates the agentwares products. Questions, exports and deletions: https://agentwares.vercel.app/contact.

Data is stored in the United States. If you are in the EEA or the UK, that is a transfer outside your region, and using the service is you asking us to provide it from there.

What we collect

• Account identity: your GitHub login, name, email and avatar, so you can sign in.
• What you configure: the targets, servers, policies or queries you set up.
• Run output: what the service produced, and transcripts of what your endpoints returned. These can contain whatever your systems return, so treat them as you would your own logs.
• If you ask to be emailed when a server changes, without signing in: your email address, used only to send the one confirmation and then alerts about that server and never shown on any public page (the server's status page names the account by a random handle), and a one-way hash of your network address made with a salt that is discarded every day, kept only to limit how many requests one sender can make; every alert has a link that stops the emails, and the address is deleted on request through the contact form.
• Billing records, held by Stripe. We never see or store your card number.
• If you write to us through the contact form: your message, the reply address if you give one, and a one-way hash of your network address made with a salt that is discarded every day, kept only to limit how many messages one sender can send. The address itself is never stored.
• Page views, whether or not you are signed in: each page load here sends one to our own collector at agentwares.vercel.app, holding this site's host, the page's path (never its query string), the host of the page that linked you here if there was one, and two yes-or-no flags — whether the browser looks like a crawler and whether it is one of our own scripts. The user-agent is read to set those flags and then discarded, and your network address is held in memory for up to a minute, to stop one client flooding the collector, and never written down. No cookie is set or read. Page views identify nobody, so they are kept without an expiry date.
• If you leave an email address on a waitlist for something not built yet: we send one confirmation email and store the address only if you follow its link. Until then, and for no more than 24 hours, we keep one-way hashes, made with a secret key, of the address and of your network address, only to limit how many confirmations one address or one sender can be sent. When you confirm, we keep the address, which waitlist it is for, when you confirmed and the sentence you agreed to, and use it once: the one email you asked for, when that thing exists, and nothing else. The address is never shown anywhere, never added to our analytics and never shared, except with Resend, which delivers the emails. It is deleted once that email is sent, after 12 months if the thing is never built, or as soon as you follow the removal link in the confirmation email.

What we do not do

We do not sell your data. We do not use your content to train models. We do not share it with anyone except the processors below, and only to run the service.

Who else touches it

• Vercel (hosting) and Neon (database), both in the United States.
• Stripe, for payments.
• Resend, Slack and Discord, only to deliver alerts and waitlist emails you asked for.
• Model providers, only to evaluate your own runs. Your content is not used to train their models under the terms we use.

How long we keep it

Run results are kept for the retention window of your plan and deleted automatically after that. Delete your account and we remove the rest.

Blockchain payments are the exception we cannot honour a deletion request for: a public chain is not ours to erase.

Your rights

Ask and you get a copy of your data, a correction, or its deletion — whether or not the law where you live requires it of us. Ask at https://agentwares.vercel.app/contact. We aim to answer within 30 days.

Secrets

Credentials you give the service are used to make the requests you asked for and are not shown back to you in the interface. Give it the smallest credential that works: a read-only key is a smaller blast radius than a write key.

seatledger, the team ledger

seatledger is an agentwares product operated by TrainedBooks. Its command-line tool reads a developer's own machine and sends nothing. When a developer joins a team and runs `seatledger push`, the team ledger receives these aggregates and nothing else:

• per developer, day, coding-agent client, client version and model: the number of requests, the input, output, cache-read and cache-write token counts, and the API-equivalent dollar figure the tool computed;
• the step changes `seatledger rates` found, as numbers: the day each starts, the client version and the one before it, and the before and after medians;
• the name the developer chose on the team, and a SHA-256 hash of their key (never the key);
• project folder names only if the developer pushes with `--project-names`.

We never receive prompts, responses, tool output, file contents, file paths, or session or request ids: the service refuses any field that could carry text. For the team itself we keep its name, the owner's account (a GitHub sign-in, or none for a team created over the API), and the alert email address and Slack webhook URL the owner sets.

The team owner sees every developer's rows. Each developer sees the team's totals and their own row. Usage per developer is information about people: the team owner is responsible for telling the developers on the team and, where the law requires one, for having a lawful basis to collect it. Every developer can see exactly what is sent with `seatledger push --dry-run`.

How long: usage and findings are kept for as long as the team's plan keeps history — 30 days on Free, 13 months on Team and Business — and deleted after that by a daily job. After a downgrade, history older than the new plan keeps is deleted. A revoked developer's history stays until it ages out.

Deletion on request: the team owner can ask us to delete the whole team, or one developer's data, at https://agentwares.vercel.app/contact, and a developer can ask for their own; we aim to do it within 30 days. Alerts go through Resend (email) and Slack (if the owner sets a webhook); payment through Stripe.