Privacy Policy

AGNT ("we," "us," or "our") is operated by ICM Motion GmbH, a company registered in Germany. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the AGNT platform, including our web application, Telegram bot, WhatsApp integration, and related services (collectively, the "Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with any part of this policy, please discontinue use of the Service immediately.

We collect the following categories of personal data:

We use the information we collect to:

• Provide and operate the Service, including AI-powered venue discovery, booking management, calorie scanning, product comparison, transport booking, and social features.
• Process your requests and deliver responses through your chosen messaging channel (Telegram or WhatsApp).
• Process payments and manage subscriptions via Stripe.
• Send transactional communications such as booking confirmations, reminders, and account notifications.
• Generate nutritional breakdowns from food photos and maintain your food diary with daily summaries.
• Identify products from photos and find price alternatives across e-commerce platforms.
• Improve and personalize the Service, including training and refining recommendation quality (using aggregated, de-identified data only).
• Monitor for abuse, fraud, and technical issues using error tracking and logging.
• Comply with legal obligations and respond to lawful requests from authorities.

We share data with the following third-party service providers strictly to operate the Service. We do not sell your personal data.

Each third-party provider processes data under their own privacy policy. We encourage you to review their respective policies.

We take the security of your data seriously and employ industry-standard technical and organizational measures:

• Encryption at rest: Personal identifiers (name, email) are encrypted using Fernet symmetric encryption before storage.
• Phone number hashing: Phone numbers are stored as HMAC-SHA256 hashes. We cannot recover your phone number from the stored value.
• Chat encryption: Chat sessions are stored in encrypted Redis instances with automatic expiration.
• Photo processing: Food and product photos are processed in memory and not retained after analysis is complete.
• Payment isolation: All payment data is handled by Stripe in PCI-DSS compliant infrastructure. Card details never touch our servers.
• Access controls: Internal access to personal data is restricted to authorized personnel on a need-to-know basis.
• Infrastructure: Our backend services run on encrypted cloud infrastructure with TLS 1.2+ for all data in transit.

While we implement robust safeguards, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users and relevant authorities in the event of a data breach, in accordance with applicable law.

• Account data: Retained for as long as your account is active. Upon account deletion, personal data is purged within 30 days, except where retention is required by law.
• Chat sessions: Automatically expire from Redis. Typical session lifetime is 24 hours of inactivity.
• Photos: Deleted immediately after processing. Not stored in any database or file system.
• Booking history: Retained for the lifetime of your account to provide history, ratings, and recommendations.
• Transaction records: Retained for a minimum of 7 years as required by German tax and commercial law.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, email us at privacy@agnt.ai. We will respond within 30 days (or sooner where required by law). We may ask you to verify your identity before processing your request.

ICM Motion GmbH is based in Germany. Your data may be transferred to and processed in countries outside your country of residence, including countries in the European Economic Area (EEA) and Southeast Asia. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions.

We use a minimal set of cookies and local storage:

• Authentication cookie (agnt_token): An httpOnly, secure cookie used to maintain your login session. Strictly necessary for the Service to function.
• Service worker cache: As a Progressive Web App, we cache static assets locally for offline access and performance.
• Push notification subscription: If you opt in, we store a VAPID push subscription to deliver booking reminders and notifications.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not participate in cross-site tracking or real-time bidding.

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@agnt.ai and we will delete such data promptly.

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service you requested, including account management, bookings, and AI agent interactions.
• Consent (Art. 6(1)(a) GDPR): Where you explicitly opt in, such as location sharing and push notifications. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f) GDPR): Service improvement, security monitoring, and fraud prevention, balanced against your rights.
• Legal obligation (Art. 6(1)(c) GDPR): Retention of transaction records as required by German commercial and tax law.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the Service, email, or a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us:

You also have the right to lodge a complaint with your local data protection authority. For Germany, this is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).