Privacy policy

This is a translation of our German privacy policy; if the two versions differ, the German version applies. As at November 2026. This policy applies to the website agentnow.io and the AgentNow! application (app.agentnow.io).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

LittVest GmbH
Hallesche Str. 5a, 10963 Berlin, Germany
Represented by: Ron Littmann
Email: info@agentnow.io

We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG, the German Federal Data Protection Act. You can reach us at the address above with any questions about data protection.

2. Hosting

The website and the application run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Helsinki (Finland, European Union). The database and backups are kept there as well. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

3. Visiting the website (server logs)

When you visit the website, technically necessary data is processed without which the page could not be delivered: IP address, time of access, address requested, amount of data transferred, status code, and information about the browser and operating system.

Purpose

Delivering the page, operational security, defence against attacks.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service).

Retention period

Server logs are deleted after five weeks at the latest, unless they are needed to investigate a specific incident.

4. Cookies and storage in your browser

We only set cookies that are needed for the service, and none for advertising or analytics:

Signing in

The cookie __Host-bot_sitzung keeps you signed in. It contains a random identifier; on the server we store only its hash. It is valid for 30 days from last use and is deleted when you sign out.

Language

The cookie sprache remembers whether you want to see the pages in German or English, for up to 400 days.

In your browser

Your browser’s local storage (localStorage) holds the workspace you last chose and whether you have closed the hint about installing the app. This information is not sent to our server.

Legal basis

§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act (strictly necessary for the service requested), and Art. 6(1)(b) or (f) GDPR.

5. No external content

Fonts, icons and images are served exclusively from our own server; the drawn portraits are generated there too. No third-party services are embedded – no Google Fonts, no video services, no social media embeds, no chat tools. Your IP address is not transmitted to any third party merely by visiting the website.

6. Sign-up and account

If you sign up, we process your name, whether you use AgentNow! privately or for a business, for businesses the company name, your email address and the language of the form. We do not store your password in plain text, only as a cryptographic hash (scrypt); we cannot see it.

Your account and workspace are only created when you open and confirm the link in our confirmation email. We store the time of confirmation as evidence – without it, any address at all could be used to create an account. An unconfirmed entry lapses after 7 days and is deleted. If there is already an account for the address, we send a note about signing in instead of the link. We send the confirmation email through a mail server in the EU.

If a customer invites you to their team, you create your account through the invitation link; we then process the same details except the company.

Purpose

Setting up and running your account and workspace, signing in, contacting you about it.

Legal basis

Art. 6(1)(b) GDPR; for the confirmation of the address, additionally Art. 6(1)(f) GDPR (evidence and protection against other people’s addresses being registered).

Usage

For each workspace we record which model used how many tokens and web searches, when, and what that cost – as the basis for the free allowance, the monthly cap and billing.

Orders

If you buy token packages, we store the package, the time, the wording of your declarations (terms, and for private customers the immediate start) and the identifiers of the payment at Stripe (section 8), as evidence and to perform the contract (Art. 6(1)(b) and (c) GDPR). We send the confirmation by email. For the invoice we store the billing details you enter (name or company, address, country, for businesses the VAT ID, the email address for invoices) and every invoice as a PDF and e-invoice (section 14 of the German VAT Act). If a business from another EU member state enters a VAT ID, we have it confirmed together with name and address by the German Federal Central Tax Office (section 18e of the German VAT Act) and store the response as evidence. If you cancel via “Cancel contracts here”, we store the details from the form and the time of receipt as evidence.

Retention period

For as long as the account exists. On request we delete the account and workspace with all content; statutory retention obligations remain unaffected – we keep orders and invoices for eight or ten years (section 147 of the German Fiscal Code, section 14b of the German VAT Act).

7. Content in the application

With AgentNow!, customers set up agents that write with people over WhatsApp, Signal, Telegram, Slack and other channels, read mailboxes and calendars, keep tasks and organise polls. This involves content data: conversations, contacts and their numbers, the agents’ notes, tasks, emails, appointments, polls. Who is responsible for it depends on what a workspace was set up for:

For a business

If a business or a self-employed person uses AgentNow! professionally, the customer is the controller and we are their processor under Art. 28 GDPR. The customer concludes theagreement for this in the app.

Privately

If you use AgentNow! for yourself privately, we process your content data as the controller – solely to provide the service to you (Art. 6(1)(b) GDPR), not for advertising and not for our own analyses. Data of other people your team deals with on your behalf (such as friends in a poll) is processed only for this purpose (Art. 6(1)(f) GDPR – your and our interest in providing the service you asked for).

If you write to an agent

If you write to a company’s agent or vote through a link an agent sent you, we process your messages and details on behalf of that company. You can obtain access and erasure from the company; we support it in this. If the link came from a private individual, contact us.

Credentials

We store credentials for channels, mailboxes, calendars and other services in encrypted form.

The customer’s services

The channels and connections a customer sets up – such as WhatsApp (Meta), Telegram, Slack, their mail or calendar provider, Google, social media accounts or their own webhooks – are the customer’s service providers, not ours. Data only goes there insofar as the customer has connected them and the agent needs them for the task.

Retention period

Determined by the customer; when the workspace is deleted, its content is deleted.

Health data from wearables

The agents “Personal trainer” and “Sleep & health coach” can read values from your wearable. This is health data (Art. 9 GDPR). For it, we are the controller – also in business workspaces – because you only connect your own wearable and give your consent yourself.

Which data

Sleep duration, sleep stages and sleep times, heart rate variability (HRV), resting or overnight heart rate, breathing rate, steps, active calories and workouts (type, duration, distance, heart rate, load). Other health data an app sends along (such as medication, ECG, cycle, blood glucose, routes) is neither evaluated nor stored.

Purpose and legal basis

So that the agent can support you with training, sleep and recovery – based on your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give when connecting. We store which version you accepted and when. The agent makes no diagnoses and is not a medical device.

Source

Polar: through Polar’s interface (Polar Electro Oy, Finland) after you have agreed there. Apple Health: the iPhone app “Health Auto Export” sends the values to an address only you know; the app is a service you use yourself. Garmin: the Garmin Connect app passes the values to Apple Health, from where they reach us the same way; we exchange no data with Garmin itself.

Recipients

For replies and the daily check, the values needed go to Anthropic (section 8). Replies reach you through your messenger; with WhatsApp, Meta processes the messages, Signal is end-to-end encrypted. The agent shows the values only to you – your number and your own test chat – not to other people in the workspace; conversations in which it used them can only be opened by your account in the application.

Retention period

Polar: we only store the access (encrypted) and fetch the values when needed. Apple Health: we keep the daily values sent to us for at most 90 days. What the agent writes to you stays in the conversation history until you delete it or the workspace.

Withdrawal

You can withdraw your consent at any time without giving reasons by deleting the connection under “Connections”. We then immediately delete the access and all stored daily values and deregister you at Polar. Processing up to then remains lawful.

Food diary

The “Nutrition coach” agent can estimate calories and nutrients from photos or descriptions of your meals and keep a food diary. Because information about what you eat can reveal something about your health, we treat it like health data (Art. 9 GDPR); for it, we are the controller – also in business workspaces – because only you yourself agree.

Which data

Date and time, type of meal, a short description of what can be seen and the estimated values (calories, protein, carbohydrates, sugar, fat, fibre, portions of vegetables and fruit). We don’t store the photos themselves; they only go to Anthropic for that one reply.

Purpose and legal basis

So that the agent can help you eat better – based on your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). The agent asks you first in the chat; the diary only starts with your “yes” in a message of its own, and we store which version you agreed to and when. The values are estimates; the agent makes no diagnoses and does not replace advice from a doctor or dietitian.

Recipients

For replies and the daily check, the entries needed go to Anthropic (section 8); replies reach you through your messenger. The agent shows the diary only to you – the number you write from – not to other people in the workspace; conversations in which it used the diary can only be opened in the application by your own test chat or the account that confirmed this number as its own. When you look for restaurants, only the search term goes to Google Maps, never diary entries.

Retention period

Entries for at most 90 days. What the agent writes to you stays in the conversation history until you delete it or the workspace.

Withdrawal

Write “delete diary” to the agent: we then immediately delete all entries and your consent. It also deletes single entries on request. Processing up to then remains lawful.

8. AI and other service providers

Claude (Anthropic)

The agents’ replies are written by the Claude language model of Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. For each reply, the agent’s instructions and knowledge, the conversation so far, the notes on the contact and the results of the tools (such as appointments or emails found) go to Anthropic. The agents’ web search also runs through Anthropic. Anthropic processes this data as our sub-processor, does not use it to train its models and deletes it within the periods set out in its data processing terms.

Transfers to third countries

Anthropic processes the data in the USA. The transfer is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Google Maps

If an agent uses maps through our access (“Google Maps included”), the addresses and search terms of the request – such as the start, destination and stops of a route – go to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process them in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Voice messages

We convert voice messages into text on our own server, and spoken replies are produced there as well. Nothing goes to third parties for this.

Sending email

We send confirmation emails and account notices through a mail server in the EU.

Payment (Stripe)

You pay for token packages via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details directly with Stripe; they never reach our server. We transmit to Stripe the name of the workspace, the email address of the ordering account, the package and the amount. For a subscription Stripe stores your card so that we can charge the monthly amounts. We store Stripe’s identifiers for customer, payment and card as well as the card brand, last four digits and expiry date; we issue the invoice ourselves. Stripe processes some data as a controller in its own right, for example to prevent fraud and for its own legal obligations. Stripe may also process data in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). The legal basis is Art. 6(1)(b) and (c) GDPR.

9. Contact by email

If you write to us, we process your details in order to deal with your enquiry (Art. 6(1)(b) or (f) GDPR). We delete this data once the enquiry has been dealt with and no retention periods under commercial or tax law prevent this.

10. Protection against misuse

To fend off automated sign-ups, we check an additional field that is invisible to humans and the time taken before submission, and we limit the number of attempts per IP address, per email address and in total. When you sign in, we count failed attempts per email and IP address to slow down password guessing. These counters are held only in memory and expire after 24 hours at most. No third-party services are used for this – in particular no reCAPTCHA. The legal basis is Art. 6(1)(f) GDPR.

11. Your rights

You have the following rights with respect to us:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise them, contact us informally at info@agentnow.io. If it concerns data that a customer processes with their agents (section 7), we forward your request to them.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin.

13. Encryption

Data is transmitted over TLS. You can tell whether a connection is encrypted by the padlock symbol in your browser’s address bar.

14. Changes to this policy

We update this policy when the processing changes – for example if we add another service. The version available here applies at any given time.

Legal notice