Agentic Automation Labs
    Back to home

    Privacy Policy

    Last updated: 1 November 2026

    1. Who we are

    This policy explains how Agentic Automation Labs LLP ("AAL", "we") handles personal data. It covers our website, our client dashboard, our own website chat agent, our sales outreach, and the AI agents we run for client businesses. Our contact details are in Section 14.

    2. Two roles we play

    • For our own business (website visitors, prospects, clients and their staff), we decide how personal data is used. This policy covers that use.
    • For our clients' customers (people who chat with an agent we run for a business), the business decides how the data is used, and we process it on its behalf. If you chatted with an agent on another business's website or channel, that business's privacy notice applies. Send your requests to them, and we will help them respond. If you contact us directly, we will pass your request to the business.

    3. What we collect

    • Contact and enquiry details: name, work email, phone, company, website, role and your message, when you fill in a form, book a call or chat with us.
    • Account details: for clients and their team members, name, email, role, login and security settings, and plan and usage records.
    • Billing details: billing contact, invoices and payment status. Card or bank details are handled by our payment provider, not stored by us.
    • Client content: documents, links, policies and catalog data that clients upload to configure their agent.
    • Calendar data: for clients who connect a calendar, the connected account's email address, its free and busy times, and the appointments our agent books. Section 6A explains how we handle Google user data.
    • Conversation data: messages exchanged with an AI agent, and any details shared in them, such as names, emails, order numbers or booking requests.
    • Technical data: a random visitor identifier stored in your browser by our chat widget, IP address, browser and device type, time zone (from your browser), pages visited, and security and error logs.
    • Business contact data from public and commercial sources: names, job titles and work emails of business contacts, obtained from public sources and B2B data providers, used for our sales outreach.

    4. How we use it

    • To provide, configure and support the service, including answering chats and showing dashboards.
    • To respond to enquiries, book demos and Automation Audits, and follow up with prospects.
    • To bill clients and manage accounts.
    • To keep the service secure, prevent abuse and fix errors.
    • To send service notices.
    • To send business marketing emails, which you can opt out of at any time.
    • To meet legal, tax and accounting obligations.

    We do not sell personal data. We do not use client content or conversations to train AI models, and our AI providers are not permitted to train their models on it (see Section 6).

    5. AI processing

    Our agents use large language models to understand messages and write replies. Every chat begins with a notice that you are talking to an AI. Replies may sometimes be inaccurate, so please check important details. You can ask to be contacted by a person at any time.

    6. Who we share it with

    We share personal data only with service providers that help us run the service. Each receives only what it needs:

    • AI providers: Anthropic (generates replies, conversation summaries and dashboard analytics) and Voyage AI (text search for the knowledge base). Both in the US. Our AI providers may keep inputs and outputs for a short period to deliver the service and prevent misuse (currently up to 30 days for Anthropic), and longer where the law or safety requires.
    • Hosting and infrastructure: Supabase (database and login, US), DigitalOcean (servers for our workflow automation and dashboard, US), Cloudflare (DNS, network security and content delivery).
    • Calendar connection: Nylas (calendar connection for appointment booking, US). See Section 6A.
    • Business tools: Google Workspace (email), HubSpot (our CRM), Cloudflare (website hosting), Apollo (business contact data) and Vonage (business calls).
    • Client-connected platforms, when a client turns them on: Meta (WhatsApp, Instagram, Facebook), Shopify, CRMs and calendars.
    • Authorities, where the law requires it, or to protect rights and safety.
    • A buyer or successor, if our business is reorganised or sold, subject to this policy.

    6A. Google user data (calendar connections)

    This section applies when a client business connects a Google Calendar to our appointment booking feature. It explains how we access, use, store and share Google user data.

    What we access. When the client's account owner connects a calendar, Google asks them to allow access. We request only:

    • the Google account's email address and basic profile, to show which account is connected;
    • permission to see calendar availability, so the agent offers only free times;
    • permission to create, change and cancel events, so the agent can book, reschedule and cancel the appointments the client's customers request.

    How we use it. Only to provide the booking feature: showing open times in the client's AI agent chat, and creating, moving or cancelling the appointments their customers book. We do not use Google user data for advertising, we do not sell it, and we do not use it to train or improve AI models.

    What we store. The connected account's email address, an encrypted reference to the connection, and the appointment records the agent creates (time, status, the customer's name and email, and the calendar event reference). The access tokens are held by our calendar connection provider, Nylas, not in our database. We do not copy the other events in your calendar; to find free times we read only busy and free periods.

    Who we share it with. Nylas (United States), which provides the calendar connection, and Anthropic (United States), which receives the open times and the booking details of the current conversation so the agent can write its reply (see Section 6 for Anthropic's limits). We do not transfer Google user data to anyone else, except where the law requires it or in a business sale or reorganisation as described in Section 6.

    Human access. Our staff do not read Google user data unless the client asks us for help with it, or where it is needed for security or to meet a legal obligation.

    Keeping and removing it. The connection stays until it is removed. The account owner can remove it at any time in the dashboard under Settings → Integrations, or by emailing support@agenticautomationlabs.com. You can also revoke our access from your Google Account at https://myaccount.google.com/permissions. When a calendar is removed, we revoke the connection at Nylas, which also revokes Google's access, and we delete our encrypted reference. Appointment records stay with the client's account and are deleted with it (Terms, Section 16.4); copies in backups are overwritten as the backups expire. Events already created in your calendar stay there until you delete them.

    Limited Use. Agentic Automation Labs LLP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

    7. Where data is stored

    We are based in India. Our main systems are hosted in the United States, so your data is transferred to and stored there. We use providers with appropriate security commitments, and we transfer data only where Indian law permits.

    8. How long we keep it

    • Conversation transcripts: visible to the client for 60 days, then moved to a restricted archive for 24 months, then deleted. Earlier deletion is available on the client's request. Summary analytics without message content may be kept longer.
    • Client accounts and content: for the life of the account. When an account ends, we delete it within 30 days after the export window in our Terms. If the account owner asks us to delete the organization, we delete all its data, including archived transcripts, within 30 days of confirming the request (Terms, Section 16.4). We keep only records the law requires. After an organization is deleted, we keep only the billing and usage records the law requires, without message content.
    • Calendar connections: until the client removes them or the account ends (Section 6A).
    • Appointment records: for the life of the client's account.
    • Prospect and enquiry data: while we have a business relationship or an active conversation, and no longer than 24 months after our last contact, unless you ask us to delete it sooner.
    • Billing and tax records: for as long as Indian tax and accounting law requires.
    • Backups and security logs: for a limited period, then overwritten.

    9. How we protect it

    We use reasonable security practices, including:

    • encrypted connections (HTTPS)
    • per-client data separation in our database
    • role-based access, limited to people who need it
    • two-factor authentication for dashboard users who change settings
    • credentials stored in an encrypted vault

    No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

    10. Your rights and choices

    You can ask us to:

    • give you access to the personal data we hold about you
    • correct or update it
    • delete it
    • withdraw consent where we rely on it

    Under India's Digital Personal Data Protection Act, 2023, you may also nominate someone to exercise your rights, and raise a grievance with us and then with the Data Protection Board of India.

    Clients: the account owner can ask us to delete the whole organization and all its data, and any team member can ask us to delete their own profile (Terms, Sections 16.4 and 16.5).

    To make a request, contact our Grievance Officer. We may need to verify your identity. We respond within 30 days.

    You can opt out of marketing emails using the unsubscribe link in any email, or by replying "unsubscribe". We honour opt-outs within 10 business days.

    11. California residents

    You can review and request correction of the personal data we collect through our website by emailing us.

    Do Not Track: our website does not currently respond to browser "Do Not Track" signals. We do not track you across other websites for advertising, and we do not allow third parties to do so on our website.

    12. Children

    Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.

    13. Changes to this policy

    We will post updates here and change the date above. For material changes, we will also email clients and registered users before the changes take effect.

    14. Contact and Grievance Officer

    Agentic Automation Labs LLP (LLPIN ADC-5596), UNIT 101 OXFORD TOWERS, 139/88 HAL OLD AIRPORT RD, H.A.L II Stage, Bengaluru- 560008, Karnataka, India.

    Grievance Officer: Arihant Bothra, arihant@agenticautomationlabs.com. Full details are on our Grievance Officer page.

    We acknowledge complaints within 48 hours and resolve them within 30 days.