Privacy Policy

1. Who we are

AgentData is a product of DragApp.com Ltd, a company registered in England and Wales (company number 10835737), with its registered office at Building 18, Gateway 1000 Arlington Business Park, Whittle Way, Stevenage, England, SG1 2FP. DragApp.com Ltd is the data controller for the personal data described in this policy.

Data Protection Contact: privacy@agentdata.run

DragApp.com Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller.

In this policy, “AgentData”, “we”, “us”, and “our” refers to the service operated at agentdata.run and useagentdata.com.

2. What this policy covers

This policy applies to:

• The AgentData websites at agentdata.run and useagentdata.com
• The AgentData REST API
• The AgentData MCP server, including when you use it from an AI assistant such as Claude or ChatGPT
• Any related tools, integrations, or extensions

This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (EU GDPR) and the California Consumer Privacy Act (CCPA).

We process data relating to three groups of people:

• Visitors: people who browse agentdata.run or useagentdata.com without an account
• Users: people who create an AgentData account to use our services
• Business Profiles: individuals and companies whose publicly available professional information appears in our database

3. Data we collect from visitors

When you visit agentdata.run or useagentdata.com, we collect:

• Pages viewed and interactions, measured with Vercel Analytics (which uses no cookies) and Google Analytics 4 (which uses first-party cookies to count visits; Google Analytics 4 does not log or store IP addresses). See our Cookie Policy.
• IP address (processed by our hosting provider Vercel for security purposes, not stored by us)

We do not use advertising or remarketing cookies, social media tracking pixels, or cross-site tracking.

4. Data we collect from users

When you create an AgentData account, we collect:

• Account data: email address, name (if provided), authentication method (email/password or Google OAuth)
• Payment data: processed and stored by Stripe. We do not store card numbers or bank details. We store your Stripe customer ID for billing purposes.
• Usage data: lookups performed, API calls made, exports purchased, features used, timestamps
• Communication data: support emails, feedback you send us

How we use this data

• To provide and maintain your account and access to the service
• To process payments and manage subscriptions
• To send transactional emails (welcome, receipts, usage alerts, export delivery)
• To monitor and prevent abuse of the service
• To improve the service based on aggregate usage patterns

Legal basis (UK GDPR Article 6)

• Contract performance (Art. 6(1)(b)): processing your account data and payments is necessary to provide the service you signed up for
• Legitimate interest (Art. 6(1)(f)): usage analytics, abuse prevention, and service improvement
• Consent (Art. 6(1)(a)): marketing communications, if you opt in (we do not currently send marketing emails)

How long we keep it

• Account data: retained while your account is active. Deleted within 30 days of an account deletion request.
• Payment records: retained for 7 years as required by UK tax law.
• Usage logs: retained for 12 months, then anonymised.

5. AI assistants and the MCP server

AgentData offers an MCP server at https://mcp.agentdata.run/mcp that lets AI assistants such as Claude, ChatGPT and Cursor look up AgentData data for you. Using it is optional. If you never connect an AI assistant, this section does not apply to you.

What we receive

When an assistant uses one of our tools, we receive the tool's name and its inputs (for example a company domain, a technology name or a search filter), the network address of the server making the call (for Claude and ChatGPT this is the assistant provider's server, not your device), the name and version the assistant reports, and your AgentData API key if you added one. We do not receive your conversation with the assistant, your prompts, or anything else in your chat.

What we keep

• The MCP server keeps no copy of requests or results. For each call it records the tool name, the kind of assistant, whether a key was used, how long the call took and whether it failed, without the inputs or results. These server logs are deleted within 90 days.
• The API behind it records usage (lookups performed and the companies they touched) as described in Section 4, and keeps rate-limit counters by account, network address or assistant platform, used only to enforce limits.
• We store only a one-way hash of your API key. Keys are sent in a request header, never in a web address. You can regenerate your key at any time in Settings.

Where results go

Results are returned to the AI assistant you use. That assistant is run by a third party you have your own relationship with, and its privacy policy and terms govern what it does with them, including whether it keeps them. With an API key, results can include business contact data about other people (Section 6); you must use it lawfully, as set out in our Terms of Service.

6. Data we collect about business profiles

AgentData maintains a database of company intelligence sourced from publicly accessible web pages. This section also serves as our transparency notice under UK GDPR Article 14, as this data is not collected directly from the individuals concerned.

What we collect

• Company name, domain, and website metadata
• Technology stack (detected from publicly available technical signatures on web pages)
• Publicly listed professional email addresses (from contact pages, team pages, about pages, and other public content)
• Professional names and job titles, where publicly displayed
• Professional social media profile URLs (LinkedIn, Twitter/X, GitHub), where publicly linked
• Web signals (whether a company has a public pricing page, blog, careers page, API documentation, or free trial)
• Industry classification (generated by automated analysis from publicly available company descriptions; see Section 7)

What we do NOT collect

• Personal or consumer email addresses (e.g. personal Gmail, Hotmail)
• Personal phone numbers (for local businesses we show the business phone number published in public business listings)
• Physical or postal addresses of individuals
• Financial information
• Health or medical data
• Political opinions, religious beliefs, trade union membership, or other special category data under UK GDPR Article 9
• Any data from password-protected or login-required pages

Sources

Company data is collected from publicly accessible web pages, DNS records and HTTP headers. Local business listings (name, address, business phone number, website and opening hours) come from open datasets such as the Overture Maps Foundation's places data. We do not purchase data from third-party brokers. We do not access private databases or leaked data.

Legal basis

We process business profile data under legitimate interest (UK GDPR Article 6(1)(f)).

We have conducted a Legitimate Interest Assessment which concluded that:

• Purpose: the processing serves a specific and legitimate B2B intelligence purpose: enabling businesses to identify potential customers, partners, and technology trends using publicly available information
• Necessity: the processing is necessary for this purpose; the data cannot reasonably be obtained by other means at the scale required to provide a useful service
• Balancing: the processing does not override the interests, rights, or freedoms of the individuals concerned because:
  • The data is already publicly available on the open web
  • The data is limited to professional and business context only
  • We do not process sensitive or special category data
  • Individuals can object and request removal at any time, and we honour all such requests promptly
  • We provide clear information about our processing (this policy)
  • Our processing is proportionate and expected in a B2B context

This is the same legal basis used by established B2B data providers operating in the UK and EU.

A copy of our Legitimate Interest Assessment is available on request to privacy@agentdata.run.

How long we keep it

Business profile data is retained for as long as it remains publicly available and accurate. Data is removed:

• Immediately upon a valid removal request (see Section 10)
• When the source data is no longer publicly accessible
• When we detect the data is no longer accurate

How we inform data subjects (Article 14)

Where we hold professional contact information about an individual, we provide transparency through this publicly accessible privacy policy and our data removal page at agentdata.run/legal/data-removal. Any individual can check whether we hold data about them and request removal at any time.

7. Automated processing

AgentData uses automated technology to classify companies by industry sector and business model based on publicly available website descriptions. This automated processing:

• Applies only to company-level data, not to individual personal data
• Does not produce legal effects concerning any individual
• Does not significantly affect any individual
• Is used solely to organise and categorise company profiles within our database

This processing does not constitute automated individual decision-making under UK GDPR Article 22.

8. Third-party processors

We share data with the following service providers, each of which processes data on our behalf under appropriate data processing agreements:

We do not sell personal data to any third party. We do not share personal data with advertisers.

Anthropic is used for AI-powered industry classification. Only company names and publicly available website descriptions are sent for classification. No personal data, email addresses, or contact information is sent.

A full sub-processor list is available on request to privacy@agentdata.run.

9. Your rights

If you are in the UK or European Economic Area

Under the UK GDPR, EU GDPR, and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you (Article 15)
• Rectify inaccurate personal data (Article 16)
• Eraseyour personal data (Article 17, “right to be forgotten”)
• Restrict processing of your personal data (Article 18)
• Object to processing based on legitimate interest (Article 21)
• Data portability: receive your data in a structured, machine-readable format (Article 20)
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaintwith the Information Commissioner's Office (ICO) at ico.org.uk or your local data protection authority

To exercise any of these rights, contact us at privacy@agentdata.run. We will respond within 30 days. There is no fee for exercising your rights, except in cases of manifestly unfounded or excessive requests.

If you are in California

Under the California Consumer Privacy Act (CCPA):

• You have the right to know what personal information we collect and how we use it
• You have the right to request deletion of your personal information
• You have the right to opt out of the sale of your personal information. AgentData does not sell personal information
• We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact privacy@agentdata.run.

10. Data removal requests

Any individual or company can request removal of their data from our database at any time. We honour all removal requests regardless of your location.

To request removal:

• Email privacy@agentdata.run, or
• Use the form at agentdata.run/legal/data-removal

Upon receiving a valid request, we will:

1. Remove your data within 14 days (we aim for 48 hours)
2. Add your email address or domain to our suppression list to prevent re-collection
3. Send you a confirmation when the removal is complete

11. International data transfers

Our primary database is hosted in the EU (Supabase, Frankfurt). Some processors are based in the United States (Stripe, Vercel, Resend, Railway, Google).

For transfers from the UK/EEA to the US, we rely on:

• Standard Contractual Clauses (SCCs) as approved by the European Commission
• The UK International Data Transfer Agreement (IDTA) where applicable
• Processors' compliance with applicable data protection frameworks

12. Data security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest (database-level encryption via Supabase)
• Authentication and access controls
• Regular security reviews
• Minimal data collection principles

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay, as required by UK GDPR Articles 33 and 34.

If you discover a security vulnerability, please report it to security@agentdata.run.

13. Children

Our services are intended for business professionals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified via our website and, where practicable, by email. The “last updated” date at the top indicates the most recent revision.

15. Contact

For any privacy-related questions or requests:

Email: privacy@agentdata.run

Data Protection Contact: Nick Timms