legal
Privacy policy
This page is an English translation provided for convenience. The French version is the legally binding one.
Data controller#
SICCARDI TECH LEADS, 12 route du Tilleul, 78125 Raizeux, France — contact: pierre@tech-leads.net.
What we collect#
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address, team name | Create the account, authenticate, notify | Performance of the contract | Account lifetime + 1 year |
| Session tokens (stored as hashes) | Keep you signed in | Performance of the contract | 90 days |
| Uploaded agents: code, prompts, schemas, tests | Deliver the service | Performance of the contract | Account lifetime |
| Execution traces: inputs, outputs, tool calls, tokens, cost | Let you debug, bill at cost | Performance of the contract | 12 months |
| Technical logs (IP address, timestamp, errors) | Security, incident diagnosis | Legitimate interest | 90 days |
| Payment history (amount, date, last four digits) | Accounting obligation | Legal obligation | 10 years |
We set no advertising cookies and use no third-party analytics on this site. Any cookies are technical and strictly necessary to operate the admin interface.
What we do not do#
- We do not train any model on your prompts, data or traces.
- We do not sell or rent your data.
- We access the content of your agents only when indispensable to diagnose an incident you reported, or when required by law.
Data processed by your agents#
For personal data your agents process on behalf of your own users, you are the controller and we act as your processor within the meaning of Article 28 GDPR: we process that data only to deliver the Service, on your instructions as embodied in the configuration of your agents. Sub-processors are those listed below; any change to that list is published on this page before it takes effect. In the event of a data breach affecting such processing, we notify you without undue delay so you can meet your own notification obligations. Deletion follows the terms of the "Deletion" section.
Processors#
The Service relies on the following providers, which process data on our behalf:
| Provider | Role | Region |
|---|---|---|
| Cloudflare, Inc. | hébergement, exécution des agents à l'edge, CDN | Mondial (UE/US) |
| Convex, Inc. | base de données du control plane (comptes, agents, runs) | UE (eu-west-1) |
| Stripe, Inc. / Stripe Payments Europe Ltd | paiement, facturation, TVA (Managed Payments) | UE/US |
| Resend | envoi des emails transactionnels (liens de connexion) | UE/US |
| Vercel AI Gateway / OpenRouter | acheminement des appels aux modèles de langage | US |
| Composio | connecteurs applicatifs tiers activés par l'utilisateur | US |
Some of these providers are established in the United States. Such transfers rely on the European Commission's standard contractual clauses, supplemented where applicable by the EU–US Data Privacy Framework.
Content sent to models#
When one of your agents runs, the content required for it to work — prompt and input data — is sent to the model provider you chose. In prepaid-credit mode, requests pass through a gateway (Vercel AI Gateway or OpenRouter) which routes them to the infrastructure of the selected model's provider: the actual recipient therefore depends on the model configured for each agent. Those providers apply their own retention policies. If that transmission is sensitive in your context, prefer BYOK mode, which lets you contract directly with the provider of your choice.
Security#
Encryption in transit on all exchanges; session tokens and API keys stored as hashes and never redisplayed; agent secrets isolated at the execution worker level; strict separation between teams verified by automated tests; magic-link authentication with a verification code, designed to resist phishing.
Your rights#
You have rights of access, rectification, erasure, restriction, objection and portability. Write to pierre@tech-leads.net: we answer within one month.
Exporting your agents is immediate and requires no request — forge pull retrieves all your files.
You may lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
Deletion#
Deleting a team erases its agents, deployed workers and traces within 30 days, except accounting records we are legally required to keep.