Privacy Policy

1. Introduction

Agentcroft ("we", "us", "our", or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.agentcroft.com and engage with our marketing services. Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide, including:

• Contact information (name, email, phone number, company name)
• Billing and payment information
• Service preferences and communication preferences
• Project details and business information
• Content you provide for our services
• Communications and correspondence

2.2 Information Collected Automatically

When you visit our website or use our services, we automatically collect:

• Log data (IP address, browser type, pages visited, timestamps)
• Device information (device type, operating system)
• Cookies and similar tracking technologies
• Usage patterns and analytics data
• Location data (if permitted)

2.3 Information from Third Parties

We may receive information about you from:

• Payment processors and financial institutions
• Marketing platforms and analytics providers
• Business partners and service providers
• Publicly available sources
• Social media platforms

3. How We Use Your Information

We use the information we collect for purposes including:

• Providing, maintaining, and improving our marketing services
• Processing transactions and sending billing information
• Communicating with you about services, updates, and changes
• Responding to inquiries and customer support requests
• Personalizing and improving your experience
• Creating and analyzing marketing campaigns
• Complying with legal obligations
• Preventing fraud and protecting security
• Conducting research and analytics
• Marketing and promotional communications (with your consent)

4. Legal Basis for Processing

We process your personal data based on:

• Contract: Performance of our marketing services agreement
• Consent: Your explicit agreement (for marketing communications)
• Legal obligation: Compliance with UAE and applicable laws
• Legitimate interests: Business operations and fraud prevention
• Vital interests: Protecting health and safety

5. Sharing Your Information

We may share your information with:

• Service providers (hosting, analytics, payment processing)
• Business partners necessary for service delivery
• Legal authorities when required by law
• Professional advisors (legal, accounting, consulting)
• Successors in case of business transfer or acquisition

We do not sell your personal information to third parties for their marketing purposes.

6. Data Security

We protect your personal data with these technical and organisational measures:

• Customer data is hosted in Singapore, with our application on Vercel and our database on Supabase.
• The service is provided over HTTPS.
• Separation between customer workspaces is enforced in the database by row-level security, and our build checks that queries against sensitive data are scoped to a single customer.
• Credentials for the accounts you connect are encrypted at rest with AES-256, and the key that bypasses database protections is used only on our servers.
• Access tokens and share links are stored only as hashes.
• We do not use passwords: people sign in with Google or a single-use email link.
• Card details are handled by Stripe and never reach our systems.
• Our code is scanned for leaked secrets on every change and weekly across its full history.
• The database is backed up daily (kept 7 days) and weekly to a separate store (kept 30 days).
• We have a written incident response procedure and will notify affected customers without undue delay, and within 72 hours, of becoming aware of a personal data breach affecting their data.

While we strive to protect your information, no security system is impenetrable. We cannot guarantee absolute security of your data.

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services
• Fulfill contractual obligations
• Comply with legal requirements
• Resolve disputes
• Enforce agreements

We keep two kinds of information on different schedules.

• Client service data - the marketing data we connect to, the insights built from it, reports, documents and user accounts - is retained for the duration of the engagement. When an account is closed we retain it for a further 90 days so that it can be reactivated or exported, after which it is deleted. We keep backup copies of our database - a daily snapshot retained for seven days, and a weekly copy retained for thirty - so a deleted record is also gone from every backup within thirty days.
• Business records - contracts, invoices and billing details - are retained after the relationship ends for as long as we are required to keep them under UAE tax and company law.

In either case we retain data for longer only where the law requires it.

8. Your Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (right to be forgotten)
• Restrict processing
• Data portability
• Withdraw consent
• Lodge complaints with supervisory authorities

To exercise these rights, contact us at info@agentcroft.com with details of your request.

9. Cookies and Tracking

Our website uses cookies and similar technologies for:

• Authenticating users
• Remembering preferences
• Analytics and performance monitoring
• Advertising and retargeting
• User experience improvements

You can control cookies through your browser settings. Disabling cookies may affect website functionality. We respect Do Not Track signals where applicable.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any external websites before providing personal information.

11. International Data Transfers

Agentcroft is based in Dubai, UAE. Your information may be transferred to, stored in, and processed in countries other than your residence. By using our services, you consent to such transfers. We ensure appropriate safeguards are in place for international data transfers.

12. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover we have collected data from a child, we will delete it immediately. Parents or guardians who believe their child has provided information to us should contact us at info@agentcroft.com.

13. California Privacy Rights

If you are a California resident under the California Consumer Privacy Act (CCPA), you have specific rights including the right to know, delete, and opt-out. We do not sell personal information. For CCPA-related requests, contact us at info@agentcroft.com with "CCPA Request" in the subject line.

14. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. The "Effective Date" at the top indicates the last update. Continued use of our services after changes constitutes your acceptance of the updated policy. We will notify you of material changes by email or through our website.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Agentcroft LLC-FZ (trading as Agentcroft)
Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
Licensed by Meydan Free Zone, licence number 2649175.01
Email: info@agentcroft.com
Website: www.agentcroft.com
Data Protection Officer: info@agentcroft.com

16. Compliance

This Privacy Policy is written to meet our obligations under:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
• GDPR (EU General Data Protection Regulation) where applicable
• CCPA (California Consumer Privacy Act) for California residents
• Google API Services User Data Policy, including the Limited Use requirements

17. Google User Data (Google API Services Limited Use)

When you choose to connect a Google account to our platform - for example, to enable reporting on Google Analytics, Google Search Console, or Google Ads - you grant us read-only access to specific data in those accounts through Google APIs. This section describes how we handle that data and applies in addition to the rest of this Policy.

17.1 What we access

Only with your explicit consent, and only for the Google account and properties you authorize, we access the following on a read-only basis:

• Google Analytics (scope: analytics.readonly) - traffic, engagement and conversion metrics;
• Google Search Console (scope: webmasters.readonly) - organic search queries, clicks, impressions and average positions;
• Google Ads (scope: adwords) - advertising performance such as spend, clicks, conversions and return on ad spend. We use this scope solely for read-only reporting queries; we do not create, modify, or manage your campaigns.

17.2 How we use it

We use Google user data exclusively to provide the features you have requested: displaying your performance dashboards, generating marketing reports and insights for your own account, and surfacing recommendations to you. We do not use Google user data for advertising purposes, and we do not sell it.

17.3 Sharing and processing

We do not transfer Google user data to others except as necessary to provide or improve these user-facing features, to comply with applicable law, or as part of a merger or acquisition. We do not use Google user data to develop, improve or train any generalized artificial intelligence or machine-learning model. To generate written reports and insights, it is sent to third-party AI providers through their business APIs, acting as our sub-processors. We cannot determine how each provider uses or retains data it receives; that is governed by each provider's own terms. Our data processing page lists which providers receive what. We do not allow humans to read your Google user data except where you expressly consent, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymized.

17.4 Limited Use disclosure

Agentcroft's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

17.5 Retention and revocation

You can disconnect your Google account from our platform at any time, and you can revoke our access directly from your Google Account at myaccount.google.com/permissions. When you disconnect, we stop accessing your Google data and delete the stored authorization credentials. Report data already generated may be retained in accordance with Section 7 (Data Retention).

18. Data from Connected Business Tools

When you connect a business tool to our platform, such as a CRM (for example HubSpot, Salesforce, GoHighLevel or Microsoft Dynamics 365), an email marketing platform, an online shop or an advertising account, you authorize us to access data in that account on your behalf. This section applies in addition to the rest of this Policy and to Section 17 for Google accounts.

18.1 Our role

The data in your connected tools belongs to you and often includes personal data about your own customers and contacts. For that data we act as your processor: we process it only on your instructions and only to provide the platform to you. You remain responsible for having a lawful basis to share it with us.

18.2 What we access

Only for the accounts you connect, and only what our features use:

• CRM - contacts, deals or opportunities and their pipelines, and activity such as calls, emails and messages. We use these to report on leads, sales, pipeline value, revenue by channel and how quickly leads are followed up. Some views show contact or deal names, for example a list of top deals.
• Email platforms - campaign and list performance.
• Online shops - orders and products. Where a platform lets us, we read orders without customers' names, email addresses or postal addresses.
• Advertising accounts - spend and performance figures.

18.3 What we write back

We do not change your records, except in two cases, and only if you switch on the feature that does it:

• a website chat feature that captures a lead may create a contact in your CRM;
• a calling feature may log a call's outcome against an existing contact.

We never delete records in your connected tools.

18.4 How we use it and who processes it

We use this data only to provide the features you request: your dashboards, reports, insights and recommendations. We do not sell it or use it for advertising. We do not use it to train any AI model ourselves. To write reports and insights, it is sent to third-party AI providers through their business APIs, acting as our sub-processors. We cannot determine how each provider uses or retains data it receives; that is governed by each provider's own terms. Our data processing page lists which providers receive what. If you use your own AI provider key, your own agreement with that provider applies. Our people do not read it except to provide support you ask for, for security, or where the law requires.

18.5 Disconnecting

You can disconnect any tool from your account's Setup page at any time. When you do, we stop accessing it and delete the stored access credentials. You can also remove our access from within the tool itself, for example from its connected apps settings. Data already brought into the platform is kept and deleted in line with Section 7 (Data Retention).