Privacy policy

Last updated: 25 September 2026

AgentGunes is a platform that issues personal agent identities. The agent does not decide; it briefly carries the permission you gave. This policy applies to account holders, agents, and registered companies. Registration does not prove that the account belongs to a natural person.

1. Data controller

The platform operator processes identity, permission, token and deletion requests on a server in Turkey. A company may be a separate controller for records it keeps on its own site (listings, sessions, carts, orders). Company apps such as Pano publish their own privacy notice on their own address. KVKK requests: selahattin.gunes.5@gmail.com.

2. Data we collect

• Account: first name, last name, email, password (hash). Email verification is currently off; you sign in with the address you gave.
• Agent: display name, Ed25519 public key, MCP token hash, working hours, daily limit, allowed company list, stopped state.
• Permission: which scopes you approved for which company, revoke records, and the account-wide approval behavior (every time / important actions / allow fully).
• Token record: jti, lifetime, result (success/replay/invalid). The raw JWT is not stored.
• Activity: the agent’s token request and result; company name and time. The raw request body is not kept.
• Company block: a record that the account or a single agent blocked a company (user_id/agent_id + company_id).
• Company account block: a record that the company blocked an incoming account (company_id + user_id). The block stops new requests from every agent on that account and fires the company’s deletion URLs.
• Company: legal name, domain, contact email, customer support email, password hash, tax number, deletion URLs.
• Message: text that lands in the owner panel; the agent only reads what you pass through.
• Deletion requests: type, status, company note.

3. Purpose and legal basis

Performance of the contract (identity and permission), legitimate interest (security, replay prevention, audit, company block), and explicit consent (optional remembered grants). We do not build marketing profiles.

4. Sharing

An approved company only receives the result of that JWT verification: agent_id and scope list. The company does not get your email from the platform. The MCP token and company password are not given to the company. The required support email on the company record appears in the panel if a deletion request fails; the platform does not write to that address on your behalf.

The API docs page (/docs/api) loads interface files from this site. We recommend not opening docs while your panel session is open; the session cookie is on the same site.

If the optional message filter is on and a model key is set, text written by the company may go to that model for classification. If there is no key, only the local rule runs.

5. Retention

Identity, permissions, blocks, and activity are kept while the account exists. A JWT lives 60 seconds; used jtis stay in the audit. When an agent is deleted its identity goes; audit rows may remain under the agent id (transaction record). When an account is deleted, agents cascade; the company owner field is cleared and the company record may remain. The erasure policy is a separate page.

6. Your rights

Access, correction, deletion, restriction of processing, and withdrawing consent:

• Profile (name, email, password) and account deletion: My profile. An account is not deleted while an agent exists.
• Revoking a remembered grant: Permissions.
• Company block: Activity.
• Company copy: deletion requests.
• Approval behavior: Personal settings.

For a KVKK request use your account email or the contact address above. Data export (single-file download) is not in the panel yet; it is provided on request.

7. Security

Passwords are one-way hashed, API/MCP secrets are SHA-256 hashed, JWTs are Ed25519. Details: Security and JWKS, cookies.

This text explains how AgentGunes works; it is not legal advice. Questions go through the contact email on your panel account.