Privacy Policy

This explains what a hosted instance stores and where it goes. If you self-host, none of it applies: nothing leaves your machine and we never see it.

What we hold

• Account details. Name, email, billing country. Card details are handled by Lemon Squeezy and never reach us.
• Instance configuration. Your bot token, the ids or numbers on your allowlist, your timezone, your Anthropic key, and any tokens you ask us to configure.
• Agent data. Everything your agent produces or is sent: messages, voice notes, photos, documents, the facts it records, its schedules and its skills.
• Operational logs. Timestamps, turn and token counts, errors and resource usage, passed through a redactor that strips known secret patterns.

Where it lives

Each customer runs under its own operating-system account on a virtual server, with its own database, working directories and Claude credentials. Customers on the same machine cannot read each other’s data.

Who else sees it

• Anthropicreceives the content of each turn, because that is what running the model means. It is sent under our account on a key dedicated to your instance, so your usage is never mixed with another customer’s.
• Telegram, WhatsApp and Slack, whichever you enable, carry your messages, exactly as they do already.
• Any service you connect. You choose these.
• The operator. We can technically read your instance’s files because we administer the server. We do so only to fix a problem.

We do not sell your data, share it for advertising, or use it to train any model.

How long it is kept

While your subscription is active. Message logs older than ninety days are pruned automatically. Backups are kept fourteen days. After you cancel, your instance is archived for thirty days and then deleted.

Security, honestly

Servers are SSH-key only with password login disabled. Tenant accounts have no administrative privileges. Only the web ports and SSH are reachable; the agent’s control endpoints listen on loopback.

What that does not give you: data is not encrypted at rest beyond the disk’s own encryption, and an administrator with server access could read it. If your data is regulated to a standard that forbids that, self-host instead.

Your rights

You can ask us to export, correct or delete your data and we will do it within thirty days. Write to ysahil816@gmail.com. Depending on where you live you may have additional statutory rights, including complaining to a data protection authority. Nothing here limits them.