Agytomo
Privacy Policy
Last updated: July 2026
This Privacy Policy explains how Agytomo collects, uses, stores and protects personal data in accordance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), during the private beta.
Data controller
The company operating Agytomo acts as the data controller for account, workspace and beta access data described in this policy. Contact details for data protection requests are provided in the Contact section below.
Data we collect
We collect account data (name, email, company, role), workspace content you create (project specs, operating plans, memory scopes), execution metadata (cost, model routing decisions, review outcomes), and technical data such as IP address and access logs needed for security.
Purposes of processing
Personal data is processed to provide and operate the service, review beta access requests, authenticate users, secure the platform, generate execution evidence and cost visibility, and communicate service updates.
Legal bases under the LGPD
Processing relies on: execution of a contract or preliminary procedures at your request (art. 7, V), legitimate interest to operate and secure the service (art. 7, IX), and, where applicable, consent for optional communications (art. 7, I). We do not process sensitive personal data categories as part of the core service.
Subprocessors and service providers
Agytomo relies on the following subprocessors to operate the service: the VPS/hosting provider running the application and database through Dokploy, GitHub for source code integration and pull request automation, Resend for transactional email delivery, and the AI model provider you connect under BYOK, which processes only the content you submit to that provider. Each subprocessor is bound by its own terms and, where applicable, its own data processing agreement.
Data retention
Account and workspace data is retained while the workspace remains active. Beta leads not converted to an active workspace are retained for a reasonable review period. Database backups are retained for up to 7 days on a rolling basis for disaster recovery. Data is deleted or anonymized after the retention period, except where longer retention is required by law.
Your rights as a data subject
Under the LGPD you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, data portability, information about entities with whom data is shared, and revocation of consent. Requests can be sent to the contact below and will be answered within a reasonable time.
Security measures
We apply technical and organizational measures such as encrypted connections, workspace-scoped access control, and server-side storage of provider credentials, so raw API keys never return to the browser after being saved.
International data transfers
Some subprocessors, such as GitHub, Resend and certain AI model providers, may process data outside Brazil. When this occurs, we rely on the safeguards recognized by the LGPD for international transfers, such as standard contractual clauses or the subprocessor's own compliance certifications.
Changes to this policy
This policy may be updated as the product and its subprocessors evolve. Material changes will be communicated to workspace owners before taking effect.
Contact and DPO
For questions about this policy or to exercise your LGPD rights, contact the address published in the workspace or on the Agytomo website.