Last updated: November 15, 2026
This policy explains what personal data Agorantis, LLC ("Agorantis", "we", "us") keeps when you use agorantis.com, the Agorantis app, its emails and its API (the "Service"), why we keep it, who helps us, how long we keep it, and your rights. It is part of our Terms of Service.
1. Who is responsible
Agorantis, LLC, a Delaware limited liability company, 2810 N Church St STE 91558, Wilmington, DE 19802, is the controller of the personal data described here. For any privacy question or request, write to privacy@agorantis.com.
2. What we collect
2.1 Your account: your email address and name, which sign-in methods you have linked (email code, passkey, and Google, Microsoft, Apple or GitHub where we offer them), and when you last signed in.
2.2 Your business and team: the business name, website, country and time zone, your plan, the people on your team and their roles, and team invites (the invited email and role).
2.3 What you ask us to check: your products, the stores you watch, alert settings, shared reports and the results of every check.
2.4 Credits and payments: your credit balance, every charge and grant of credits, your plan, payments and invoices, and, if an owner turns on auto-reload, its level, amount, monthly cap and each charge it made. Stripe holds your card details, including a card saved for auto-reload. We never see or store your full card number.
2.5 Agent and API use: your API keys (stored as a scrambled value, never in plain text), their spending caps and the requests made with them. When your agent uses a key, we treat its requests as yours.
2.5a Stablecoin payments (x402): the paying wallet address, the amount, the network and the transaction reference. These are recorded on a public blockchain by design. We cannot change or delete what is on the blockchain, and anyone can see it there.
2.6 The free check without an account: the store link you paste and a scrambled (keyed hash) form of your network address, used to limit free checks. We do not keep your IP address. If you ask us to email you the result, we keep that email address until the email is sent.
2.6a Price alerts without an account: your email address, the product, the price you want to hear about, the language of the page you set it on, and whether you confirmed the alert with the code we emailed. We use them only to send that alert, and an alert costs no credits. An alert you do not confirm is deleted after a day. Every alert email has a one-click link to stop it.
2.7 Help messages: what you write to us, the page you were on, your browser, and the reference of the last error report, so we can answer you.
2.8 Security and service records: sign-in codes and session tokens (stored as scrambled values), a random device id in a cookie (kept as a scrambled value) that limits free sign-ups per browser, daily limit counts, error reports and short server logs, with emails, codes, keys and phone numbers removed before they are stored.
2.9 Product numbers: which features are used, by account id only, without cookies, without your email or name and with IP addresses discarded. A small share of sessions may be recorded with all text and inputs masked, to see where people get stuck.
2.10 Public price data: the prices and stock that sellers publish for anyone to see. This is information about products, not about people. We do not collect shoppers' personal details from those pages. If a seller's public page names a person (for example a sole trader), we keep only what is needed to identify the seller.
2.11 Connected stores and price changes (switched off for now): the key for a store you connect (stored encrypted). If you allow it, that key is also used to update prices in your store, only when you approve a change or within limits you set. We keep a log of every price change (before, after, the reason, its proof and check time) until your business is deleted.
2.12 Browser extension (not offered yet): it reads only the page you click it on and sends that page's address and product details to answer you. Your sign-in is kept in your browser for 8 hours. We do not keep the page details.
2.13 Shops that opt out: if you write to support@agorantis.com to stop us reading your shop, we keep your shop's domain on our opt-out list, so we never read it again, and your email to answer you.
3. Why we use it, and our legal bases
Where the EU or UK GDPR applies, we rely on these legal bases:
- To give you the Service you signed up for: create your account, run your checks, send sign-in codes, alerts and the morning email, and bill you (performance of our contract with you).
- To keep the Service safe and fair: prevent fraud and abuse, limit free use, and fix errors (our legitimate interest in a secure, working service).
- To improve the Service: understand which features are used and where people get stuck, using product numbers by account id only (our legitimate interest; you can object at any time by writing to privacy@agorantis.com).
- To keep financial records and comply with the law (legal obligation).
- To send a price alert you set without an account (your consent, given when you confirm the alert; stop it at any time with the link in each alert email).
- To honor a shop's request to stop reading its site (our legitimate interest in respecting that request, and our legal obligation where one applies).
- To send occasional product news to account owners (legitimate interest, or your consent where the law requires it). Every such email has a one-click unsubscribe.
We never sell your personal data, never use it for advertising, and no seller pays to see it. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
4. Who helps us
These providers process personal data for us, only to do their part and under a data processing agreement:
| Provider | What it does | Where |
|---|---|---|
| Vercel | Runs the website and app; keeps short server logs | United States and EU |
| Supabase | Our database | EU |
| Hetzner | Runs the server that reads public pages and matches products; it reads the stores and products you ask about from our database | Germany |
| Amazon Web Services (Amazon SES) | Sends our emails | EU |
| Stripe | Takes payments and keeps invoices | United States and EU |
| Sentry | Error reports, scrubbed first | EU |
| PostHog | Product numbers, by account id only | United States |
| Cloudflare | Runs the agent service and API; Turnstile tells people from bots on forms | Worldwide |
| Coinbase (Coinbase Developer Platform) | Checks and settles x402 stablecoin payments; sees the paying wallet address and amount | United States |
| Google, Microsoft, Apple, GitHub | Sign-in with that account, if you choose it and we offer it | Worldwide |
| Anthropic (AI model provider) | Match items, read product photos and invoices you send, and answer your questions from our checked prices; given product data only, not your account details | United States |
We may also share personal data when the law requires it, to protect the rights and safety of people or of the Service, or with a buyer if Agorantis is sold or merged, under this same policy.
4a. When you add other people's data
If you put personal data about other people into the Service (for example teammates), we process it for you, only to run the Service. A data processing agreement is available on request at privacy@agorantis.com.
5. International transfers
We are a US company and some of our providers are in the United States or other countries. When personal data from the EU, UK or Switzerland moves to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum), or on the provider's certification under the EU-US Data Privacy Framework, and on extra safeguards such as encryption in transit and at rest.
6. How long we keep it
| What | How long |
|---|---|
| Your account | Until you delete your account; then it is deleted at once |
| Your business, team, watched stores, alerts and saved checks | Until the business is deleted by its owner |
| Credits, payments and invoices | As long as tax law requires, usually 7 years, even after deletion |
| x402 payment records | As long as tax law requires, usually 7 years; the blockchain record itself is permanent and not under our control |
| API keys | Until revoked or the business is deleted; a revoked key's scrambled value is kept to stop its reuse |
| Sign-in codes | 10 minutes to use; then kept as a scrambled value for up to 30 days to stop abuse |
| Signed-in sessions | Up to 30 days, or until you log out or delete your account; the record is removed 30 days after it ends |
| Team invites | 7 days to use; removed 90 days after they expire |
| A free check's request | Up to 90 days |
| A price alert without an account | Until you stop it with the link in any alert email; one you never confirmed, after 1 day |
| Auto-reload settings | Until an owner turns auto-reload off or the business is deleted; its charges are kept as payment records |
| The device id cookie | Up to 400 days in your browser |
| The opt-out list | Kept, so we never read that shop again |
| Email send log | Up to 1 year |
| Do-not-email list (addresses that bounced or complained) | Kept, so we never write to them again |
| Daily limit counts | 1 day |
| Error reports (Sentry) and server logs (Vercel) | Up to 90 days, and a few days for server logs |
| Product numbers (PostHog) | Up to 1 year |
| When you finished or skipped the welcome tour | With your account |
7. How we protect it
Sign-in needs no password, and you can use a passkey. Codes, session tokens and API keys are stored only as scrambled values, and a key is shown in full only once, when it is made. Each key can carry a spending cap, and payments and credit changes go through one ledger that charges a check once. Data is encrypted in transit and at rest. Every account we use to run Agorantis is protected by two-step sign-in. We test the parts that handle money and sign-in against known attacks before each release. Inside the company, only the people helping you can open your data, and every such access is for that purpose only. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.
8. Your rights
8.1 In the Service you can, at any time:
- Download my data: Settings, Your data. One file with everything we keep about you and your business, once a day.
- Delete my account: Settings. You are removed at once. If you are the only owner of your business, the business is deleted with you.
8.2 Depending on where you live, you may also have the right to access, correct, delete or port your data, to restrict or object to how we use it, to withdraw consent, and to complain to a data protection authority. In the EU and UK this is under the GDPR. If you are a California resident, the CCPA gives you the right to know, delete and correct personal information, and to opt out of its sale or sharing; we do not sell or share personal information as those terms are defined. We will not treat you differently for using any of these rights.
8.3 To use a right not in Settings, write to privacy@agorantis.com. We may need to confirm it is you. We answer within 30 days, most within a week.
8.4 If you are a member of a business's team, some requests about that business's data may need its owner. We will help you reach them.
8.5 Emails. You can stop product news at any time with the unsubscribe link in each one. We still send emails you need to use the Service, such as sign-in codes, receipts, alerts you set and changes to these policies. Each price alert email has its own link to stop that alert.
9. Children
The Service is for businesses and adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, write to privacy@agorantis.com and we will delete it.
10. Cookies
We use only the cookies needed to keep you signed in and safe, and to remember your language. We measure visits without cookies. Our Cookie Policy lists each cookie.
10a. Other websites and services
The Service links to sellers' pages and works with services run by others, such as Stripe, Google, wallets and your AI assistant. Their own privacy policies apply to them, not this one.
11. Changes to this policy
We may update this policy. For a material change, we will email account owners at least 30 days before it takes effect. The date at the top always shows the version in force.
12. Contact
Agorantis, LLC, 2810 N Church St STE 91558, Wilmington, DE 19802. Email: privacy@agorantis.com.
In more detail
The same facts as the app keeps them. The policy above is the text that counts.
Who helps us run Agorantis
| Cloudflare Workers | Runs the website and the app, connects it to our database, and keeps short server logs. (Worldwide) |
| Vercel | Ran the website and the app before Cloudflare, and keeps short server logs. (United States and EU) |
| Supabase | Our database: your account, team, the stores you watch, settings, checks and credits. (EU) |
| AWS (Amazon SES) | Sends our emails (sign-in codes, receipts, alerts and the morning email) and receives the price lists and invoices you forward to your Agorantis address. (EU) |
| Stripe | Takes card payments and keeps the invoices. We never see your card number. (United States and EU) |
| Sentry | Error reports, with emails, codes, keys and phone numbers removed first. (EU) |
| PostHog | Product numbers: which steps businesses take (sign up, first check, plan), by account id only, from our server, with no cookie and no IP address. (United States) |
| Cloudflare Turnstile | Tells people from bots on the free check, sign-in and help forms, with no cookie of its own for tracking. (Worldwide) |
| Anthropic | Only when you use them: reads the photos and invoices you send into products, and answers Ask from the prices we checked for you. It gets product data only, never your account details. (United States) |
| Shopify, Salla and Zid | Only when you connect your store: we read your product names and prices with the key you give us. That key updates a price only if you allow it, and only when you approve the change or within limits you set. (Canada (Shopify), Saudi Arabia (Salla and Zid)) |
| Google sign-in | Continue with Google: Google tells us your email and name. (Worldwide) |
| Apple and GitHub sign-in | Only where switched on and you choose them: each tells us your email and name (GitHub: to make agent keys). (Worldwide) |
How long we keep each thing
| Your account (email, name, sign-in ways) | Until you delete your account. Then it is gone at once. |
| Your business, team, the stores you watch, alert settings and saved checks | Until the business is deleted by its owner. |
| Credits and payments (the credit ledger, Stripe invoices) | As long as tax law asks, usually 7 years, even after deletion: a payment record is not removed. |
| Sign-in codes | 10 minutes to use, then kept as a scrambled value for up to 30 days to stop abuse. |
| Signed-in sessions | Up to 30 days, or until you log out or delete your account. |
| A free check's request (a scrambled form of your network, the store asked about) | Up to 90 days, to keep the free check fair. |
| Email send log and the do-not-email list | Send log up to 1 year; an address that bounced or complained stays on the do-not-email list so we never write to it again. |
| Error reports (Sentry) and server logs (Vercel) | Up to 90 days in Sentry, and a few days in Vercel's logs. Both are scrubbed of emails, codes and keys. |
| Product numbers (PostHog) | Up to 1 year, by account id only. |
| Daily limit counts (one row per data download or help message, with your account id or a scrambled visitor id, never your email or IP address) | 1 day, then deleted. |
| When you finished or skipped the welcome tour | With your account, until you delete it. |
| A connected store's key (sealed, so nobody can read it from our database), and each product's id in that store; the key may update prices only if an owner or admin allowed it | Until you disconnect the store or the business is deleted. Disconnecting deletes the key at once. |
| Price changes: your limits and rule, and a log of each change (the old and new price, who approved it or which limit allowed it, and the market price and proof it rested on) | Until the business is deleted by its owner. Forecasts are worked out when you look and are not kept. |
| The browser extension's sign-in, and the product details of a page you click it on (address, name, barcode, price) | The sign-in is kept only in the extension in your browser, for 8 hours, and ends when you log out here. The page details are used to answer you and are not kept. |
Cookies are listed on the Cookie Policy. Download my data and Delete my account are in Settings.