Privacy Policy

AGOS is an AI-assisted marketing operations platform built for e-commerce brands. We are operated by Parabolic Growth Pty Ltd (ACN 623 842 080, ABN 39 623 842 080), incorporated in Australia. This policy explains what data we collect, how we use it, and what rights you have over it.

We do not sell your data. We do not use your brand content or customer records to train AI models. Every piece of data we hold exists solely to operate the AGOS service for your brand.

We collect three categories of data, depending on how you interact with AGOS:

We use the data we collect for one purpose: to operate the AGOS service for your brand. Specifically:

• Authenticating your account and enforcing brand-level access control
• Passing relevant brand context (product info, tone rules, compliance rules) to AI agents when generating content
• Populating dashboards with your commerce, email, and financial data
• Routing content through human approval queues before any customer-facing action is taken
• Maintaining the audit trail required for your own compliance records
• Detecting errors and improving system reliability

We do not use your data for advertising, cross-customer benchmarking, model training, or any purpose beyond operating AGOS for your brand.

Advertising data: When a merchant connects Meta (Facebook, Instagram) to AGOS, AGOS reads ad account configuration and creates ad campaigns in PAUSED status on behalf of the merchant. All campaigns require explicit merchant approval in Meta Ads Manager before any ad spend occurs. AGOS does not directly spend on advertising or activate campaigns autonomously.

AGOS integrates with and depends on the following third-party services. Each processes data subject to their own privacy policies:

Some of these providers process data outside Australia, including in India and the United States.

We do not sell data to or share data with any third party not listed above.

If you connect Google Search Console, AGOS requests read-only access (https://www.googleapis.com/auth/webmasters.readonly) to the Search Console properties you choose. We read search performance data (search queries, page URLs, country, date, clicks, impressions, click-through rate and average position) and the list of properties you can access.

We use this data only to show you search performance inside AGOS and to suggest content for your brand. We do not use it for advertising and do not sell it. We share it only with the service providers listed under Third-party services that operate AGOS, including Anthropic for AI content generation. We do not use it to train generalised AI models.

AGOS staff do not read your Search Console data, except with your permission to help with a support request, where necessary for security purposes such as investigating abuse, or to comply with the law.

We keep detailed search data for up to 120 days. When you disconnect Google Search Console in AGOS Settings we revoke our access and delete your stored search data. You can also remove access from your Google Account permissions page.

AGOS's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We retain data for as long as your account is active and for a reasonable period thereafter to meet legal and operational obligations:

• Account data: Retained while your account is active. Deleted within 30 days of account closure.
• Commerce data (Shopify sync): Retained while your Shopify connection is active. Deleted on your instruction or within 48 days of receiving a shop/redact webhook from Shopify (per Shopify Partner requirements).
• Search Console data: Detailed search data retained for up to 120 days. Deleted when you disconnect Google Search Console.
• Generated content: Retained indefinitely unless you delete it from the approval queue or request workspace deletion.
• Audit log: Retained for 7 years for compliance and operational audit purposes.
• Error logs: 90 days.

You can request deletion of your workspace data at any time. We will complete deletion within 30 days and confirm in writing.

Depending on your location, you may have the following rights over your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate data.
• Deletion: Request erasure of your personal data. We will comply within 30 days except where we are required to retain data by law.
• Portability: Request your data in a structured, machine-readable format (JSON export available from Settings → Data).
• Restriction: Ask us to restrict how we process your data while a complaint is being investigated.
• Objection: Object to processing for purposes other than operating the AGOS service.

These rights apply to EU residents under the GDPR, to Australian residents under the Privacy Act 1988 (Cth), and to UK residents under UK GDPR. We extend them practically to all users regardless of location.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

We apply reasonable technical and organisational measures to protect your data:

• All data in transit is encrypted using TLS (version 1.2 or higher).
• Data at rest is encrypted using AES-256 at the storage layer (Supabase / AWS).
• Row-level security enforces brand isolation in the database — no AGOS query can return data from a brand you are not authorised for.
• Access tokens for connected platforms (Shopify, Xero, Klaviyo) are protected by row-level security and never sent to the browser by AGOS.
• The AI providers we use state in their API terms that they do not train on data sent through their APIs, so your prompts and responses are not used for model training.

AGOS runs on enterprise infrastructure providers (Vercel, Supabase and our AI providers) that maintain their own compliance certifications. AGOS itself enforces multi-tenant isolation via row-level security, encryption-in-transit, audit logging, and least-privilege access controls. We are committed to pursuing formal compliance certifications relevant to our customer base as we scale. For current security details, contact legal@agos-app.com.

The AGOS dashboard uses session cookies managed by Supabase Auth for authentication. We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural analytics on the dashboard.

This marketing site (agos-app.com) does not currently use analytics or advertising tracking.

We will update this policy as the service evolves. Material changes will be notified by email to registered account holders at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the current version.

For privacy enquiries, data access requests, or deletion requests: