Effective 12 October 2026

Privacy policy

Who is responsible

Exponet · Via Nicolò Miretto 8, 35134 Padova, Italia
contact@exponet.tech

Exponet controls personal information processed by the AgentForge website, account service and hosted tools. Contact the email above for privacy questions and rights requests.

Information we process

• Account identity: email address, verified-email status, a stable provider identifier, account state and registration time.
• Login security: Keycloak manages passwords and sign-in verification. Passwords are hashed by Keycloak; AgentForge does not receive them. Opaque website session identifiers are hashed in the account database. Login verifiers and session protection values are encrypted.
• Subscription records: Stripe customer/subscription identifiers, currency, price, payment status and billing-period dates. Stripe handles payment-card data; Exponet does not store card numbers.
• Usage: successful-call counts, tool identifiers, random execution IDs, execution state and timestamps. No analysis history is stored.
• Support: your account identifier, subject and encrypted support message.

Analysis inputs and results

Supplied text and records are processed in memory and a short-lived worker process, then returned to you. AgentForge does not store analysis inputs or results, use them for model training, or send them to a model API. Do not include secrets or sensitive personal information. If you use ChatGPT, the data you share there is also subject to OpenAI’s own policies and settings.

Purpose and lawful basis

We process account, subscription and usage data to provide and administer the service under our contract with you. We process limited security records for the legitimate interest of protecting the service. We retain billing records where law requires it and process support requests to respond to you. We do not run advertising analytics or sell personal information.

Cookies and service providers

The account website uses secure, HttpOnly session and login-flow cookies necessary for authentication. Keycloak uses necessary authentication cookies. Keycloak is self-hosted on Exponet-operated infrastructure. PostgreSQL stores account data on that infrastructure. Verification and password-reset emails use Google Gmail SMTP, which processes recipient addresses and email contents for delivery. Stripe processes billing data under its own service terms and privacy policy; OpenAI processes your ChatGPT activity under its own terms. Payment-provider processing may involve international transfers under the provider’s published safeguards.

Google privacy policy · Stripe privacy policy · OpenAI privacy policy

Retention

Website sessions expire after one hour and login flows after ten minutes. Expired records are removed by periodic cleanup. Detailed tool-usage events and processed webhook IDs are kept for up to 90 days; aggregate usage counters for up to 400 days; support tickets for up to 180 days. Account and subscription records remain while the account is needed, subject to deletion requests and lawful billing retention. Necessary provider billing records may remain with Stripe after account deletion. Operational application logs contain random request IDs, status and duration, and rotate by file size (three files of up to 10 MB per container); there is no guaranteed fixed time window. Identity-provider security logs may include account identifiers, authentication outcomes and network addresses. Existing static-site hosting logs can include IP addresses and request metadata. Account, OAuth and MCP proxy access logs are disabled.

Your rights

You may request access, correction, deletion, restriction or portability of your personal information and object where processing relies on legitimate interests. Contact support from your account email; we will verify ownership where necessary and handle requests within applicable legal time limits. You may complain to Italy’s Garante per la protezione dei dati personali or your competent supervisory authority. No automated decision with a legal or similarly significant effect is intended by these analysis tools.

Security and updates

We use HTTPS, limited access, encrypted support records and entitlement checks. No system can guarantee absolute security. We will update this page when processing changes and notify account holders where required.