Privacy Policy

1. Scope and controller

This Policy applies to the Agentale apps, websites, and cloud services. The controller is LuckyTech Inc., reachable at fuchitech@qq.com. A third-party model you configure may process data independently under its own policy.

2. Information we process

Account data includes username, display name, account and device identifiers, and login state. Creation data includes the latest runnable version automatically synced after sign-in, its files, descriptions, covers, permissions, age rating, publication, and remix relationships. Service records include request times, sync, review and publication state, storage usage, errors, security events, reports, appeals, and audit actions. Subscription data includes product, store, transaction identifiers, and entitlement state; we do not receive full payment-card numbers. Optional data includes analytics, creation-process data, or model-improvement data enabled through separate controls.

3. Local and cloud versions

Local creations, conversations, tasks, model settings, run history, and local version history remain on your device or in a workspace you select. After sign-in, the latest stable runnable version of each completed creation is automatically synced as a private cloud copy for cross-device access; drafts, conversations, tasks, and older local versions are not included in that automatic sync. Before uninstalling, confirm that the latest version has synced or export your own backup.

4. Purposes and legal bases

We process data to perform our contract by creating accounts, syncing and publishing creations, providing personalized recommendations, measuring basic usage, improving build reliability, generating links, restoring purchases, and providing support. Your choices govern experience-improvement data that can be turned off, and eligible QA and build-process data is used to train AI only after separate permission. When you create a share link, the server sends the minimum relevant parts of the frozen version you submitted—such as its name, description, creation request, code or text excerpts, permission list, age rating, and first preview image—to a contracted AI model for content-safety review. This identifies risks involving children, violence, hateful discrimination, privacy abuse, and other severe harms listed in the Content Standards; it does not authorize general-model training on the creation. If the result is ambiguous, or processing reaches its retry limit, the creation remains private and is escalated for human review. Legal obligations may require payment, complaint, child-safety, and regulatory records. Necessary security logs support fraud prevention, account protection, reliability, and service defense. Where applicable, we identify legitimate interests and provide a right to object.

5. Device permissions

Camera, microphone, photos/files, location, and notifications are requested in context only when a feature needs them. Refusing a non-essential permission does not block unrelated features, and you can withdraw permission in system settings. The creation runtime receives limited capabilities; your permission choices, contacts, and unrelated device data are not disclosed to a creation author.

6. Analytics, personalization, and model improvement

When you are signed in and product analytics is enabled, we record registration, login, activity, community views and runs, and creation and remix steps and outcomes. To identify real drop-off points, a creation journey may include the creation title, your idea, selected style, interview questions, displayed options, selected options, and custom answers. It excludes source code, full PRDs, AI system prompts, generated files, passwords, and tokens. Detailed journeys are retained for up to 180 days and then deleted or de-identified. You can turn product analytics off at any time; collection then stops and unsent analytics are cleared. Eligible QA, build steps, and check results may be used to train AI only when you separately enable AI training; analytics or experience-improvement choices never grant training permission.

7. Disclosures and processors

We disclose the minimum necessary data to processors bound by contract and confidentiality, potentially including cloud hosting, database, object-storage/CDN, security monitoring, support, app-store, purchase-verification, identity, and AI-model providers you select. Disclosure may also occur to comply with law, protect people or the Service, resolve rights claims, or support a corporate transaction. The launch notice will name actual production providers, purposes, and regions.

8. No sale of personal data

We do not sell personal data or share it for cross-context behavioral advertising. If the business model changes, we will update this Policy first and provide prominent notice, consent, or opt-out rights as required. Children’s data is never used for targeted advertising.

9. Sharing and public content

When you actively create a share link or publish to the community, we upload and host the runtime code, pages, text, images, and other resources in the frozen version, together with the creation name, description, author display name, version, creation code, permissions, and age rating. Runtime code is delivered to visitors’ browsers and may be inspected, saved, or re-shared. Do not include passwords, keys, identity documents, contacts, or personal data you are not authorized to disclose.

Link sharing lets anyone who obtains the link access the creation but does not automatically list it in the community. After review, community publication may make it publicly browsable, searchable, recommended, and re-shared. Remix permission is a separate choice and is not enabled merely by sharing or community publication. Disabling sharing or deleting the account stops content controlled by us from being served, but cannot recall copies visitors previously saved or re-shared. We process this information based on your choices, necessity to perform the Service, and consent or another lawful basis required by the law applicable where you live.

10. Retention

Accounts and cloud creations are normally retained until you delete the account or content. After confirmed deletion, associated data is generally deleted or de-identified from active systems within 30 days and expires from rotating backups within 90 days. Security, anti-abuse, and publication audit records are generally retained for up to 180 days; detailed creation analytics containing titles or interview fields for up to 180 days, and other optional product analytics for up to 13 months; User Memory behavior events for up to 365 days, with derived facts cleared on reset, consent withdrawal, or account deletion; and support and appeal records for up to 24 months. Transaction, tax, rights-claim, litigation-hold, or other legally required records are retained for the applicable period, then deleted or de-identified. Production configuration and this Policy must be aligned before launch if actual periods differ.

11. Security

We use reasonable measures such as encryption in transit, access controls, least privilege, key separation, signature verification, audit logs, backups, and vulnerability remediation. Passwords and sensitive credentials should use platform secure storage and are not written into creation files or web storage. No system can guarantee absolute security. We will notify affected users and authorities of a qualifying incident as required by law.

12. Your rights and choices

Depending on applicable law, you may request access, copies, export, correction, deletion, or restriction; withdraw consent; object to certain processing; turn off optional analytics; and complain to a regulator. Agentale provides cloud-data export, consent controls, User Memory inspection, individual removal and full reset, and account deletion. Requests can also be sent to the contact email. We may verify identity to protect the account. Exercising rights is not discriminatory, although deleting necessary data may make a cloud feature unavailable.

13. Account deletion

You can initiate deletion of the entire cloud account in the app, not merely deactivate it. Deletion signs out sessions, deletes or de-identifies associated cloud data, and disables public links controlled by us; it does not erase local workspace files. An auto-renewing subscription must also be canceled in Apple or Google subscription management. Required records and rotating backups follow the retention section.

14. Children

Agentale is not directed to children under 13 and does not seek a kids-category listing. People below their local digital-consent age may not independently use a cloud account. If a child-directed or mixed-audience service is offered later, we will implement age assurance, parental notice, and verifiable consent before collection, and let parents access, delete, and stop further collection. Child-safety reports follow an urgent escalation path.

15. International transfers

Providers and servers may be located outside your country or region. For international transfers, the operator will use the assessment, certification, standard contractual clauses, adequacy decision, or other mechanism required by applicable law, together with minimization, encryption, and access controls. Primary processing regions and the transfer mechanism will be published before launch.

16. Regional rights

People in the EEA, UK, or Switzerland may have portability, restriction, and legitimate-interest objection rights. California residents may have rights to know, delete, correct, limit sensitive-data use, opt out of sale or sharing, and receive non-discriminatory treatment where applicable. People in China may have rights to know, decide, restrict, refuse, access, copy, correct, and delete personal information. We do not use solely automated decisions that produce significant legal or similarly important effects.

17. Contact and updates

Operator: LuckyTech Inc.; privacy contact: fuchitech@qq.com. We identify each Policy version and effective date. Material changes to purposes, data categories, or disclosures receive prominent notice and renewed consent where required.