Privacy at AutoAGI.

Updated September 30, 2026. AutoAGI is operated by AGI Layer. Contact support@agilayer.com with privacy or account requests.

Information we use

We store your account email, profile information you choose to provide, membership and billing references, conversations, uploaded files, generated work, and task activity. We record model usage and operating costs to enforce your membership allowance and operate the service.

Google sign-in

If you choose Google sign-in, we request your basic account identity: name, email address, and profile picture. This lets us authenticate you and associate your work with your account. Google sign-in does not give AutoAGI access to your Gmail, Drive, Calendar, or other Google content.

Personal setup and LinkedIn

When you choose LinkedIn import, we send the public profile URL you provide to Apify and the selected actor provider to retrieve professional details and, when available, your profile photo. We store the limited imported fields shown for your review, not an enriched contact list. You can skip import, edit the details before completing setup, or remove the imported context later. Google profile photos take priority when available; LinkedIn is the fallback. Loading a profile photo contacts its image host.

When you ask us to prepare your setup, Firecrawl reads the public business website you provide. Relevant website text and imported professional context go to OpenRouter to draft answers and to TypeSafe/Jev to estimate their source support and relevance. We retain the suggested answers, short supporting excerpts, and source URLs for your review. These estimates do not guarantee accuracy. Your confirmed goals, workflows, tool preferences, and working style are used to personalize future tasks. AI providers may help generate suggested projects and short titles, summaries, and categories for your private work and files. Selecting a preferred tool does not grant access to that account.

Contacting support

Contact forms send your name, reply email, topic, and message through Resend to our support team. To limit abuse, we store a keyed hash of your request IP and submission identifier for up to two days. We retain support correspondence as needed to handle your request and related service issues.

Processing your requests

Your prompts, relevant conversation history, saved business context, and attached or knowledge-base files may be sent to AI providers to complete your requests. Depending on the selected features, processing uses OpenRouter and its model providers, TypeSafe/Jev, OpenAI voice services, or Harness Router agent workspaces. Your content is not used to train AI models. These providers process submitted content to complete your request, under their own applicable policies. Avoid submitting information you are not authorized to share.

Supabase stores accounts and private workspace data. Vercel hosts the application. Stripe processes subscriptions and payment details; AutoAGI stores billing references rather than full payment-card numbers. Resend delivers authentication and service emails. Bunny serves background media. Infrastructure providers may receive technical information, such as IP addresses and request logs, needed to deliver their services.

Agent connections and connected apps

An agent connection lets an AI agent that you run sign in to your AutoAGI account, hand work to AutoAGI, and read the results. You choose what each connection can do and which of your connected apps it may use, at read or read and write access. A connection can only use the apps and permissions you granted, and never more than the settings of the connected app itself allow.

Keys and sign-in tokens for a connection are stored only as one-way hashes, so we cannot show them to you again. The activity log for each connection keeps the tool name, the time, whether the call worked, the task id when there is one, and a short label such as the app and action name. It never keeps the arguments or the results. Entries are kept for 30 days and then removed.

Each app action run through a connection also leaves a record of the app, the action, the resource it touched and the outcome. The result of the action is kept only when the agent asked for retry safety by sending an idempotency key, so that a repeated request can return the same outcome instead of running twice. That result is the app’s response and can include content from the app. It stays with the connection’s record until the connection is removed, which happens 90 days after you revoke it. An action run without a key keeps only whether it worked and how large the response was.

Work that a connection starts is stored like any other task. Its request, its result, the files it makes and the connected-app actions it runs, with their results, sit in your library and history. Anything AutoAGI returns to an agent goes to the agent and the vendor you connected, and we do not control what they do with it.

You can revoke a connection at any time in Account, under Agent access. Revoking stops its access at once: its keys and tokens stop working on the next request, and you can also stop any work it is still running. A routine that a connection saved belongs to you and keeps running until you pause or archive it.

Suggestions from your connected apps

Suggested tasks are on by default on paid plans once you connect a supported app. AutoAGI reads recent items from the apps you connected, such as the sender, subject and preview of recent emails, direct messages sent to you, pull requests waiting for your review, upcoming meetings, failed deployments, overdue payments and open deals. It does this at most once every 90 minutes, only reads, and changes nothing in your apps. You can turn it off at any time in Account under Connected tools, and it stays off until you turn it back on.

The records it reads are sent to our AI provider through OpenRouter to write the suggestions, and AutoAGI does not store them. We keep each finished suggestion, which can name a person, a subject or a record id from your app, for up to 14 days after it expires. Turning suggestions off deletes the ones we made. Using a suggestion only places its text in your message box. Nothing runs until you send it.

Private workspaces and saved memory

Account access controls separate members’ conversations and files. Selected prior conversation excerpts, saved business context, and knowledge files can be reused in later requests. Work remains saved so you can return to it. Authorized service operations and support may access data when needed to operate, secure, or troubleshoot the service.

Your controls

You can edit your profile and task-email preferences in Account, export your account data, and manage your subscription through the Stripe billing portal. Contact support@agilayer.com to request account or data deletion. We may retain records needed for billing, security, disputes, or legal obligations. Backup copies and records held by service providers may follow their respective retention processes.

Cookies and notifications

Authentication cookies keep you signed in. Browser push notifications are optional and require browser permission. You can disable push permission in your browser and task emails in your profile; essential sign-in and account messages remain available.

Changes

We will update this page when the service’s data practices change. For questions about how a particular feature processes your information, contact us before submitting it.