Privacy Policy — AgentticCRM

1. Who we are and the scope of this policy

AgentticCRM is an operating platform for service organizations, operated by Global Agenttic, based in Panama.

This policy covers:

• The agentticcrm.com public website.
• Public forms and communications.
• The AgentticCRM platform.
• Authorized connections to Google services.
• Authorized connections to Meta and WhatsApp Business services.
• The AgentticVault browser extension.

When an organization uses AgentticCRM to process information about its clients, contacts, employees, or other individuals, that organization determines the purpose of the processing and acts as the data controller. Global Agenttic processes that information under the organization’s instructions and acts as its processor, except when we process information for our own legal obligations, security, account administration, or operation of the service.

2. Information we collect and process

Information provided directly

We may process:

• Name, work email, organization, team size, and other information submitted through our forms.
• Account, profile, organization, membership, permission, and preference information.
• Support requests and communications a person chooses to send us.
• Information entered into AgentticCRM by an organization or its authorized users.

Technical and usage information

We may collect technical information necessary to operate, protect, and diagnose our services, including:

• IP address.
• Browser and device type.
• Operating system.
• Access dates and times.
• Pages viewed and interaction events on the public website.
• Security, authentication, audit, and error records.
• Session and device identifiers.

Public website analytics are also described in our Cookies Policy.

Protection against abuse

We use Cloudflare Turnstile and other technical controls to protect forms, accounts, and services against abusive automation, fraud, spam, and unauthorized access.

3. Data processed on behalf of organizations

Organizations may use AgentticCRM to store and manage information related to their clients and operations, including contacts, projects, meetings, documents, requests, communications, proposals, invoices, and payments.

The relevant organization controls this information and determines who may access it. Global Agenttic processes it only to provide, secure, and maintain AgentticCRM under the applicable agreement and the organization’s instructions.

4. Google user data obtained through OAuth and Google APIs

When a person chooses to connect their Google Account to use Google Calendar and Google Meet within AgentticCRM, we request only the permissions necessary to provide that user-facing functionality.

AgentticCRM requests the openid, email, https://www.googleapis.com/auth/calendar.events, and https://www.googleapis.com/auth/meetings.space.created permissions.

Through these permissions, we may process:

• The email address of the connected Google Account, to identify the account that will organize the meeting.
• Access and refresh tokens required to maintain the authorized connection.
• Google Calendar events that AgentticCRM creates or manages at the user’s request.
• The meeting title, start and end dates and times, time zone, attendee email addresses, iCalendar identifier, event identifier, and video-meeting link or location.
• Google Meet rooms created by AgentticCRM, including the access link, room identifier, and status required to manage the room.

How we use Google data

AgentticCRM uses this data exclusively to provide the Google Calendar and Google Meet functionality that the person chose to connect. This includes:

• Verifying the connected account.
• Maintaining the authorized connection.
• Creating a Google Meet room.
• Creating or importing an AgentticCRM-originated event into the user’s calendar.
• Updating the event when the meeting is rescheduled.
• Deleting the event when the meeting is canceled.
• Maintaining the link and status needed to manage the meeting in AgentticCRM.

AgentticCRM does not list, read, analyze, or use the user’s other calendar events.

AgentticCRM does not access the user’s email messages, contacts, Google Drive files, photographs, or other Google products that are not necessary for this functionality.

Google user data is not used for:

• Website analytics.
• Advertising or retargeting.
• Marketing or lead generation.
• Profiling.
• Credit decisions or lending.
• Market research.
• Artificial-intelligence model training.
• Improving features unrelated to Google Calendar and Google Meet.

The purposes described for the public website and its forms do not apply to data obtained through Google APIs.

Storage and protection of Google data

Access and refresh tokens are stored as credentials sealed with AES-256-GCM. Plaintext exists only transiently in memory while an authorized operation is being performed.

The account email, connection status, event and room identifiers, links, and other required metadata are retained only to the extent necessary to provide the functionality.

The information is associated with the organization and the person who authorized the connection. It is protected through access controls and organization isolation using Row-Level Security.

Transfers and human access

Data required to perform a requested action is transmitted to Google APIs.

We do not send Google Calendar or Google Meet data to Google Analytics, Resend, advertising networks, data brokers, or artificial-intelligence services.

We do not permit employees or contractors to read Google user data unless:

• The person has given affirmative consent to receive support involving specific data.
• Access is necessary to investigate a security incident or abuse.
• Access is required by law.
• The data has been aggregated and anonymized for a permitted internal operation.

We do not sell Google user data. We do not transfer or use it for personalized advertising, retargeting, credit decisions, lending, or training general artificial-intelligence or machine-learning models.

AgentticCRM’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Disconnection and deletion

A person may withdraw access at any time by disconnecting Google Meet from AgentticCRM’s calendar settings.

Disconnecting the account:

• Deletes the stored tokens.
• Deletes the connection record.
• Stops future requests to Google APIs.

The person may also revoke access from the third-party connections section of their Google Account.

Events or rooms already created in Google are not automatically deleted when the account is disconnected. Existing AgentticCRM meeting records may also retain the meeting details and Meet link as part of the organization’s operational history.

5. AgentticVault browser extension

AgentticVault is a browser extension whose single purpose is to allow an authenticated person to securely access, search, manage, copy, and fill records from their personal vault while browsing.

Information handled by AgentticVault

Depending on the records a person chooses to store, AgentticVault may handle:

• Usernames and email addresses.
• Passwords.
• TOTP codes and secrets.
• Secure notes.
• Identity information.
• Card and payment information.
• API keys and tokens.
• SSH keys and passphrases.
• Database credentials.
• Certificates.
• Custom fields.
• Encrypted attachments.
• Data imported from other password managers.

The extension may also handle:

• The active page address or domain.
• Recognized login fields.
• The username and password entered into a form when new-login detection is enabled.
• Extension settings and preferences.
• Device identifier and authorization status.
• Synchronization state and version.
• Limited metadata about actions such as copying or filling a field.

How AgentticVault uses this information

The page address is processed to find records associated with the website and show relevant suggestions.

Recognized login fields are used to fill the username, password, or TOTP code selected by the person. AgentticVault never submits the form automatically.

When login detection is enabled, the extension may detect a form submission and temporarily hold the page address, username, and password in memory.

AgentticVault never silently saves this information. Only when the person expressly chooses to save or update the record is the information encrypted in the browser and synchronized with AgentticCRM.

Record searches are performed locally after the vault is unlocked. Search terms are not sent to AgentticCRM.

Encryption and storage

AgentticVault records are encrypted in the browser before transmission.

The server receives ciphertext and only the minimum metadata required for ownership, synchronization, integrity, revisions, storage, and deletion. Global Agenttic does not possess the vault password or the keys required to decrypt stored records.

In the browser, AgentticVault may retain:

• Settings and preferences.
• Device-pairing information.
• A sealed device authorization.
• An encrypted vault cache.
• Encrypted pending operations.
• An encrypted session envelope.

Decrypted values exist in memory only while the vault is unlocked. The person may lock it manually, and the extension enforces the configured lock timeout.

All executable JavaScript and WebAssembly, including the Argon2id implementation, is included in the submitted extension package. AgentticVault does not download or execute remote code.

Clipboard

When the person uses the Copy function, the selected value is written to the system clipboard.

AgentticVault does not read existing clipboard contents. After a value is copied, the extension cannot control how long the operating system or another application retains it.

Auditing and security

Audit events sent to AgentticCRM contain only:

• The record identifier.
• The action type.
• The type of field used.

These events do not contain passwords, usernames, web addresses, notes, card numbers, keys, tokens, or other secret values.

Prohibited uses

AgentticVault does not use data for:

• Advertising or retargeting.
• Selling or commercializing data.
• Commercial profiling.
• Credit decisions or lending.
• Browsing analytics unrelated to its functionality.
• Artificial-intelligence model training.
• Purposes unrelated to the personal vault.

We do not permit employees or contractors to read information handled by the extension except with the person’s affirmative consent for support involving specific data, when necessary to investigate a security incident, or when required by law.

Encrypted vault records remain technically inaccessible to Global Agenttic without the keys controlled by the person.

AgentticVault’s use and transfer of information received through Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

AgentticVault retention and deletion

The encrypted cache and pairing information remain in the browser until the person:

• Disconnects the extension.
• Clears the extension’s data.
• Uninstalls the extension.

Encrypted records synchronized with AgentticCRM remain while the vault or account is active.

Records moved to trash may be recovered for up to 30 days. They are then permanently deleted. The person may also permanently delete a record before that period or request complete erasure of their vault.

6. How we use each category of data

Public website and form data is used to:

• Respond to requests.
• Arrange demonstrations.
• Deliver requested communications.
• Measure public website operation.
• Improve public website content, performance, and navigation.
• Maintain security.
• Prevent fraud, spam, and abuse.

Google user data is used exclusively to provide the requested Google Calendar and Google Meet connection described in section 4.

Meta Platform Data is used exclusively to provide and protect the authorized Meta and WhatsApp Business connection described in section 14.

Data handled by AgentticVault is used exclusively to provide its visible functionality: browser pairing, local unlocking, searching, current-site matching, copying, filling, authorized saving, synchronization, recovery, security, and deletion.

Website analytics, marketing, and website-improvement purposes do not apply to Google user data or content handled by AgentticVault.

7. Who we share data with

We use providers to operate the service and external services involved when a person or organization connects them. Some act on our behalf; others may have their own obligations or act under the organization’s contract. Scope depends on the service used.

• Cloudflare, for hosting, content delivery, network security, and Turnstile.
• Google Analytics, exclusively to measure public website usage.
• Resend, to deliver communications related to forms and operation of the service.
• Google, when a person asks AgentticCRM to create or manage Google Calendar events or Google Meet rooms in their account.
• Meta Platforms, when an organization connects Meta Business or WhatsApp Business and asks AgentticCRM to receive, send, or manage information through those services.
• Hetzner Online GmbH, for the infrastructure that hosts the AgentticCRM application, its database, and file storage.
• AgentticAI, our assistant service, which carries the chat offered on the public pages of this website.

Google Analytics and Resend do not receive Google Calendar data, Google Meet data, or AgentticVault content.

Google Analytics and Resend do not receive WhatsApp message content or Meta connection credentials.

We may also disclose information when necessary to comply with a legal obligation, protect the security of the service, or respond to a valid request from a competent authority.

Requests from public authorities

Before disclosing personal data in response to a government or public-authority request, we apply our data-protection controls and review the request. Subject to applicable law, the process includes:

• Verifying the identity and authority of the requester, the legal basis, jurisdiction, scope, and binding nature of the request.
• Rejecting or challenging requests we reasonably consider unlawful, invalid, or overbroad, when the law allows us to do so.
• Limiting any disclosure to the minimum information legally required and protecting information outside the valid scope.
• Documenting the request, the review, the decision, the data disclosed, and the responsible personnel, subject to legal restrictions.

We do not provide public authorities with voluntary, unrestricted, or direct access to our systems. When legally permitted, we seek to notify the affected organization before disclosure.

We do not sell personal data. We do not share data with advertising networks, data brokers, lenders, or information resellers.

8. International transfers

Some providers may operate infrastructure outside the person’s country. In those cases, information may be processed internationally under the applicable contractual, technical, and legal safeguards.

AgentticCRM platform data is hosted in Hetzner data centers in Germany, in the European Union. Some providers — email delivery, content delivery network, payments and site analytics — may process data in the United States or other countries, as listed on Providers. The support we provide from Panama also means accessing the data from there.

We protect each transfer with what the law of the country the data leaves requires. The European Union, where it is hosted, is an adequate destination under the laws of Argentina, Colombia and Uruguay. Each provider that processes data in another country does so under its data processing agreement, with contractual data protection clauses, on top of the security measures in section 10. You can ask for a copy of the safeguards that apply to your data by writing to soporte@globalagenttic.com.

9. Retention

We retain requests submitted through forms for as long as necessary to handle and follow up on them, and afterwards when required to meet legal obligations.

Analytics data is retained according to the applicable provider configuration.

Google connection tokens and data are retained while the connection remains active. When the connection is removed, we delete the tokens and connection record.

Meta and WhatsApp connection credentials are retained while the authorized connection remains active. When an administrator disconnects it, we remove or revoke those credentials. Conversation records are retained according to the organization’s instructions, the applicable agreement, security requirements, and legal obligations.

Encrypted AgentticVault data is retained while the vault or account remains active. Items moved to trash are retained for up to 30 days unless the person permanently deletes them sooner.

Other platform data is retained according to the applicable agreement, the organization’s instructions, security requirements, and legal obligations.

10. Security

We apply technical and organizational measures designed to protect information against unauthorized access, alteration, loss, destruction, or disclosure.

Depending on the data and feature, these measures include:

• Encryption in transit.
• Encryption or sealing of sensitive credentials.
• Access controls.
• Organization isolation.
• Authentication and additional verification for sensitive actions.
• Audit records without secret content.
• Session and device revocation.
• Backup and recovery procedures.

No system is completely infallible, but we reasonably review and improve these measures based on the risks associated with the service.

Security incidents

If we confirm a security incident affecting personal data that we process on behalf of an organization, we will notify its administrators by email without undue delay and no later than 24 hours after confirming it. The notice describes what happened, the data and people that may be affected, the measures taken, and a contact, so that the organization can meet its own notification obligations.

When an incident affects data that we process as a controller, we will notify the competent authority and the affected people within each country’s legal deadline, summarized in section 17; the shortest is Peru’s, 48 hours. In Panama we notify ANTAI immediately and the affected people within 72 hours. We keep a record of every incident, whether notified or not, for at least five years.

11. Privacy rights and requests

Subject to applicable law, a person may request:

• Access to their personal data.
• Correction of inaccurate information.
• Deletion of information.
• Objection to or restriction of certain processing.
• Export or portability where applicable.
• Withdrawal of previously granted consent.

We answer each request within the deadline of the law of the person’s country, set out country by country in section 17. In Panama, Law 81 of 2019 sets 10 business days for access and 5 business days for rectification, and we apply the same 5 days to deletion, objection, portability and withdrawal of consent. Exercising these rights is free of charge.

When the data was entered by an organization that uses AgentticCRM, that organization is the controller and decides on the request. If we receive it, we forward it to the organization no later than the next business day and assist it so that it can respond within the legal deadline. Our obligations to those organizations are set out in the Data Processing Agreement.

To exercise these rights or ask a privacy question, write to soporte@globalagenttic.com with the subject “Privacy request” and state which right you are exercising and which data it concerns.

We may request reasonable information to verify identity and prevent unauthorized disclosure or deletion.

If you are not satisfied with our answer, or we do not answer in time, you can complain to your country’s data protection authority; section 17 says which one it is.

12. Minors

AgentticCRM is intended for professionals and organizations. It is not designed for minors, and we do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy to reflect changes in our services, integrations, data-handling practices, or legal requirements.

We will publish the current version on this page and identify its last-updated date. When a change materially alters a previously authorized use of data, we will provide any additional notice or consent required before applying the new use.

14. Meta and WhatsApp Business Platform Data

When an authorized administrator connects an organization’s Meta Business and WhatsApp Business accounts to AgentticCRM, we request only the permissions needed to complete onboarding, validate the connection, and provide the messaging features the organization chooses to use.

Depending on the connected features, AgentticCRM may process the following Meta Platform Data:

• Identifiers and configuration for the connected Meta business, WhatsApp Business Account, business phone number, message templates, and webhook subscriptions.
• Access tokens and technical credentials required to maintain the authorized connection. These credentials are protected and are not shown to organization users.
• WhatsApp contact identifiers, profile information made available through the service, messages and media exchanged with the organization, and the conversation context needed to display and answer them in the shared inbox.
• Message, delivery, read, failure, connection, security, and diagnostic events needed to operate, protect, audit, and support the integration.

We use this data only to connect the accounts selected by the organization, validate and maintain the integration, receive customer messages, display them to authorized team members, send replies or other messages permitted by WhatsApp, manage approved templates, show delivery status, prevent abuse, and provide requested support.

The organization keeps ownership and administrative control of its Meta Business and WhatsApp Business assets, phone numbers, templates, contacts, and messages. It also controls team access in AgentticCRM and remains responsible for its relationship with contacts, its lawful basis and permissions for messaging, and charges imposed by Meta.

We do not sell Meta Platform Data or use it for advertising, data brokerage, credit decisions, unrelated profiling, or training general artificial-intelligence models. Google Analytics and Resend do not receive WhatsApp message content or connection credentials.

An authorized administrator may disconnect the integration from AgentticCRM. Disconnecting revokes or removes the stored connection credentials and stops new requests through that connection. Existing conversation records may remain according to the organization’s instructions, the applicable agreement, security requirements, and legal obligations.

15. The chat on this website

The public pages offer a chat for asking about AgentticCRM. It waits for the same yes the optional statistics wait for: allow them and the chat appears, choose to use only what is necessary and it never loads.

The conversation happens in AgentticAI, our assistant service, and what you write there is processed by it in order to answer you. It is a public channel for questions about the product, so do not send passwords, your clients’ data or anything confidential through it. If you are already a customer and need to talk about your account, write to us from inside your organization.

16. Billing, payments, and providers

Global Agenttic processes billing and payment data needed to manage the contract, collect subscription payments, issue records, reconcile transactions, handle requests, and meet its legal obligations. This may include billing identity and contact details, address, country, tax identification where applicable, amount, currency, and transaction references.

Card payments are processed through Stripe or NMI, the latter via Credicorp Bank, S.A., Panama. Providers receive the data needed to process, authorize, and verify payment and may handle information to prevent fraud or meet their own obligations. Their roles and policies are explained in Payment gateways and services.

In card subscription payment flows, card details are captured on pages or fields hosted by the gateway. AgentticCRM uses tokenized references and keeps identifiers and limited payment method details, along with billing, result, and reconciliation records. This description applies to subscription collection; it does not change the separate handling of cards a person chooses to store encrypted in AgentticVault.

Financial records are retained for as long as necessary to manage the contract, reconcile payments, and meet applicable legal obligations. Deleting an account does not require deleting records we must legally retain. See the list of providers and third-party services for purposes, involvement, and policies.

17. Data protection in each country

AgentticCRM is offered to organizations in Panama and the rest of the Americas. We comply with the data protection law of each country where we provide the service, in the role we play: as controller of account, website and billing data, and as processor of the data each organization records on the platform (section 3). This section summarizes what each law adds to the rest of this policy.

Deadlines to answer a request and to report an incident affecting data we process as a controller. Where the law allows extending a deadline, we do it only once and tell the person beforehand. Requests about the data an organization records in AgentticCRM are answered by that organization, under its own deadlines (section 11).

In countries without a general data protection law — such as Guatemala, Honduras, Bolivia or Venezuela — we apply this same policy and answer within 5 business days. Paraguay passed a law in 2025 that becomes enforceable around 2027; we will add it to this table before then.

Argentina

The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown under article 14(3) of Law No. 25.326. The Agency for Access to Public Information, as the Supervisory Body of Law No. 25.326, is empowered to handle the complaints and claims filed by anyone whose rights are affected by a breach of the personal data protection rules in force.

Canada and Quebec

The person in charge of the protection of personal information is Global Agenttic’s management; you can write to them at soporte@globalagenttic.com. This site’s optional statistics and chat are off until you say yes, and we honor your browser’s Global Privacy Control signal. Commercial emails are only sent with your consent, identify the sender, and unsubscribes are processed within 10 business days at most. If an organization in Quebec communicates data outside the province through AgentticCRM, we give it the information it needs for its privacy impact assessment.

Chile

From 1 December 2026, Law 21.719 applies, including to anyone processing data on behalf of an organization established in Chile and to anyone offering services to people in Chile. This policy states its version and date at the top, the legal basis of each processing activity in section 6 and the retention period in section 9. You can complain to the Personal Data Protection Agency, and we will give the Agency a contact email as soon as it opens its register.

Colombia

This policy is our information processing policy. Controller: Global Agenttic (Negocios Virtuales, S.A.), Betania, Panama City, Panama; phone +507 310-9722; email soporte@globalagenttic.com, which is also the area that handles queries and claims under the procedure in section 11. We process your data with the prior, express and informed authorization you give us when you sign up or submit a form, and we keep proof of it. This policy applies from the date shown at the top, and the databases are kept for as long as the purpose and the periods in section 9 last.

United States

Notice for residents of California and of the other states with privacy laws. In the last 12 months we collected these categories: identifiers and contact details, professional information, commercial and billing information, and internet activity on this site and on the platform. We obtain them from you, from the organization that registers you and from your use of the service, for the purposes in section 6, and disclose them only to the providers in section 7. We do not sell personal data, do not share it for advertising based on your activity on other sites, do not use it to train artificial intelligence models and do not process sensitive data to infer characteristics about you. We honor the Global Privacy Control signal.

You can ask to know what data we hold and get a copy, to correct it, to delete it, and to opt out of its sale or of targeted advertising; we will not treat you differently for doing so. You can act through an authorized agent, and we will verify your identity and their authorization. We answer within 45 days, extendable once by another 45 with notice. If we deny your request, you can appeal by writing to soporte@globalagenttic.com with the subject “Appeal”; we answer the appeal within 45 days and, if we uphold the denial, tell you how to complain to your state attorney general. We keep each category for the periods in section 9, and review this policy at least once a year.

Mexico

This policy is our comprehensive privacy notice. Controller: Global Agenttic (Negocios Virtuales, S.A.), domiciled in Betania, Panama City, Panama. Our personal data department handles access, rectification, cancellation and objection rights, and the revocation of consent, at soporte@globalagenttic.com, under the procedure in section 11. The providers in section 7 receive data as processors and therefore do not require your consent; we do not transfer your data to third parties for their own purposes except when the law requires it. We will tell you about any change to this notice as described in section 13. You can turn to the Ministry of Anti-Corruption and Good Governance.

Peru

The Regulation of Law 29733 also applies to anyone offering services to people in Peru. Representative for Peru (article VII of the Regulation): Global Agenttic (Negocios Virtuales, S.A.), at soporte@globalagenttic.com; it is the point of contact with the National Personal Data Protection Authority and handles your communications, requests and complaints. The companies we subcontract to provide the service are listed on Providers, and we will give notice before any change. If a security incident affects your data, we notify the National Personal Data Protection Authority and you within 48 hours. We answer access within 20 business days and rectification, cancellation or objection within 10, extendable once by the same period with notice.

Uruguay

Your data is hosted in the European Union, which Uruguay considers adequate. The United States providers that take part do so under the Data Privacy Framework or contractual clauses. We notify the Personal Data Regulatory and Control Unit of a security incident within 72 hours, and answer your requests within 5 business days.