AgentTrunk · Aadi Labs

Privacy notice

Last updated September 7, 2026

AgentTrunk is provided by Aadi Labs. This notice describes personal information handled through AgentTrunk, not through other Aadi Labs products. Contact privacy@agenttrunk.ai with privacy questions or requests.

Information we handle

• Account and organization information: sign-in identity, contact details, memberships, and permissions.
• Content you or your authorized agents provide: files, skills, prompts, instructions, revisions, notes, and related metadata. Other organization members may provide information about you in this content.
• Service records: requests, IP addresses and technical connection information, usage, audit events, errors, and security records.
• Billing and support records: subscription and transaction references, billing details, correspondence, and privacy-request status. Payment details submitted to hosted checkout are handled by our payment provider.

Why information is used

We use information to authenticate users and agents, enforce permissions, store and deliver context, administer accounts and billing, respond to requests, investigate errors and abuse, and meet legal obligations. Sign-in uses cookies or similar session storage needed to maintain your session. Connected services may have their own notices and cookie behavior.

Your organization and our role

For account administration, billing, and our own service operations, Aadi Labs determines how information is used. For personal information an organization places in its context, the organization generally determines the purpose and authorized recipients, and AgentTrunk handles it to provide the service under its instructions. Contact your organization about its policies and sharing decisions. A data processing agreement may be needed before you upload regulated personal information; using the service alone does not establish one.

Who receives information

Information is available to users and agents authorized by your organization and to integrations you configure. Service providers support authentication and authorization (WorkOS), hosting and context storage (Cloudflare and Vercel), database services (PlanetScale), payments (Stripe), and webhook delivery where enabled (Svix). They receive the information needed for their respective functions. This list describes service functions, not a certification of contractual coverage or a guarantee that every provider receives every data category.

Information may also be disclosed when required by law or reasonably necessary to protect people, rights, or the service, or in connection with a business transfer subject to applicable protections. Third-party agents and webhook recipients may keep copies under their own policies.

Retention and deletion

Version history is part of the product: replacing context or changing a release pointer does not remove earlier content. Retention depends on the active service relationship, the need to provide requested revision history, security investigations, outstanding requests and disputes, and applicable accounting or legal requirements. Provider backups and logs may have separate retention periods.

Privacy and erasure requests currently require manual review. A request receipt is not confirmation of deletion. Complete erasure must consider stored versions, notes, metadata, caches, backups, and downstream copies; we do not promise instantaneous global deletion. Contact us for information about your specific data and request.

Processing locations and security

Our providers may process information in the United States and other countries. Do not assume a storage location setting confines all processing: delivery caches, authentication, billing, logs, and integrations may operate elsewhere. If you require a particular location or transfer arrangement, confirm contractual coverage before uploading. Access controls and integrity checks help protect information, but no system is completely secure.

Do not upload protected health information or secrets. AgentTrunk is not approved for HIPAA-regulated data, and this notice does not claim GDPR compliance, a HIPAA business associate agreement, or completed data processing agreements.

Your choices and rights

Depending on applicable law and our role, you may request access, correction, deletion, portability, restriction, or object to processing. Where processing depends on consent, you may withdraw it. You may also complain to the relevant data protection authority. Rights may be subject to identity verification, authority checks, and legal exceptions.

Send requests to privacy@agenttrunk.ai, whether or not you have an account. Include only enough information to identify the relevant account or organization; do not send sensitive files or credentials. Workspace managers can also submit a review request in Settings. We may need to coordinate with the organization responsible for the content. A revision download is not a complete personal-data export.

Children

AgentTrunk is intended for professional use, not for children. If you believe a child has provided personal information, contact us so we can review it.

Updates

We will publish updates here with a revised date and communicate material changes as appropriate. See also our terms of service and data handling guidance.