Privacy Policy

Last updated: 2026-07-17

1. What we collect

AgentBook is an AI-powered bookkeeping product. To run your books we collect:

• Account information you provide: email, name, business profile.
• Financial data you import or enter: expenses, invoices, vendor and client names, receipt images, bank-transaction history pulled via Plaid.
• Agent-conversation transcripts (web chat and Telegram) so the agent can recall context across sessions.
• Service-level logs (request timestamps, error stack traces) for reliability. These do not contain financial line items.

2. How we use it

We use your data only to operate AgentBook for you: classifying expenses, generating tax estimates, drafting invoices, surfacing proactive alerts, and improving the agent's accuracy on your account. We do not sell your data and do not share it with advertisers.

3. Third-party processors

• Plaid — bank-account connection. Access tokens are encrypted at rest with AES-256-GCM before being stored.
• Stripe — payment processing. Card data never touches our servers; we store only customer / subscription IDs.
• Telegram — bot delivery, if you connect Telegram.
• Google (Gemini) — LLM inference. Conversation excerpts are sent for classification; we do not opt into training data sharing.
• Vercel — application hosting and edge delivery.
• Supabase — primary database. All financial records, account information, and agent-conversation history are stored here.

4. Regional privacy rights

Depending on where you live, additional laws may apply to how we handle your data — for example, the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, and the Privacy Act 1988 in Australia. The rights described in the next section (export, deletion, and disconnecting a connected service) are available to every AgentBook user regardless of jurisdiction, and are intended to satisfy the access and deletion rights those laws provide.

5. Your rights

You can at any time:

• Export all your data as JSON via GET /api/v1/agentbook/me/export.
• Delete your account and all associated data via DELETE /api/v1/agentbook/me. Hard delete is final after a 30-day grace window.
• Disconnect Plaid, Telegram, or Stripe individually from Settings.

6. Retention

Active accounts retain data indefinitely so you can return to prior years for tax purposes. Deleted accounts have all rows hard-removed after 30 days. Anonymized aggregate metrics may persist for service reliability.

7. Security

Plaid and Stripe tokens are encrypted at rest (AES-256-GCM). All traffic is TLS-only. Tenant data is isolated at the database level — every row carries a tenant ID and queries are scoped to the authenticated tenant. Admin-only operations require an allowlisted email plus a server-side shared secret.

8. Children's privacy

AgentBook is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at the address below and we will delete it.

9. Contact

Email privacy@agentbook.io for any privacy question or to request a deletion outside the self-serve endpoint.