Privacy Policy

What we collect, why we collect it, how long we keep it, and what you can make us do about it. This is a separate document from our Terms of Service on purpose.

Who is responsible

This is the privacy policy for GoArgentAI, the marketplace for AI agents at goargentai.com. It covers that application and nothing else.

GoArgentAI decides how and why your personal data is processed. In the language of India’s Digital Personal Data Protection Act, we are the Data Fiduciary and you are the Data Principal.

What we collect, and why

When you create an account

Your email address, and your name and profile picture if you sign in with Google or GitHub. We need these to identify you, show you your orders, and send you what you bought.

When you buy something

What you bought, when, how much you paid, and the country we resolved for tax and currency. We keep this because tax law requires us to, and because you need to be able to find your purchase again.

We never see your card details. Payment happens on our provider’s infrastructure and they return only a reference.

When you contact support

What you wrote and what we replied. Kept so the next person to pick up your ticket can read what already happened.

Automatically

Your IP address on actions that change something, your language and currency preference, and whether you have seen the arrival screen this session. We do not run advertising trackers and we do not sell data to anyone.

Signing in with Google

This section is about Google user data specifically. Everything above applies to it too, but Google asks platforms to be explicit rather than to leave it inferred, and that is fair — you are handing us an account that unlocks a great deal else.

What we ask Google for

Exactly two scopes, email and profile, and nothing else. Those give us your email address, your name, your profile picture and the account identifier Google uses for you. We do not request Gmail, Drive, Calendar, Contacts, Photos or any other Google service, so we cannot read them — not because we choose not to, but because we never asked for the permission.

What we do with it

Create your account, recognise you when you come back, and show your name and picture on your own profile and on reviews you write. That is the entire use. Google user data is never used for advertising, never used to build a profile of you, never sold, and never used to train models.

Who else receives it

Your sign-in passes through Supabase, our authentication provider, which holds the credential so that we do not have to. Nobody else receives Google user data — not advertisers, not data brokers, not analytics companies. The only exception is a legal compulsion we cannot refuse, and we will tell you if that happens unless we are forbidden from doing so.

How it is kept safe

It travels only over HTTPS. Access tokens are encrypted at rest. Our database is located in India. Every screen and action that could reach it is gated on a specific permission, and administrative changes write an append-only record of who did what and why.

How long we keep it, and how to get rid of it

For as long as your account exists. Ask us to delete it by raising a ticket or emailing grievance@goargentai.com, and we remove your personal data, including everything received from Google. Orders and invoices survive that deletion only where tax law obliges us to keep them, and they are stripped of what is not legally required. You can also revoke our access from your Google account permissions page at any time, which stops any further access immediately.

Limited Use

Go Argent’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we do not do

• We do not sell or rent your personal data.
• We do not use your data to train models.
• We do not put personal data into our operational logs.
• We do not email you marketing you did not ask for.

How it is protected

These are things the system actually does, not aspirations:

• Encrypted at rest: tax identifiers, bank details, API keys, access tokens and two-factor secrets.
• Kept out of logs: personal data is deliberately absent from operational logging, so that deleting your account actually deletes you.
• Access is by role: every screen and action is gated on a specific permission. Nobody sees data their role does not need.
• Changes are recorded: alterations to platform settings write an append-only entry with who did it and why. Those entries cannot be edited or deleted by anyone, including us.

Who else sees it

Only where the work requires it, and only what that work needs:

• Our authentication provider — holds your sign-in credentials so that we do not have to.
• Our payment provider — takes the payment and tells us it succeeded.
• Our email provider — delivers order confirmations and support replies.
• Our hosting and database providers — run the site. Our database is located in India.

We do not hand your data to anyone else unless the law requires it, and if that happens we will tell you unless we are forbidden from doing so.

How long we keep it

• Your account: until you close it.
• Orders and invoices: as long as tax law requires, which is longer than your account may last.
• Support tickets: three years, so a recurring problem has a history.

What you can ask us to do

• Get a copy of what we hold about you
• Correct anything wrong
• Delete your account and your personal data
• Nominate someone to act for you if you die or cannot act yourself
• Complain to us, and then to the Data Protection Board if we handle it badly

Ask by raising a ticket or by emailing grievance@goargentai.com. We will respond within the timelines on the contact page.

Known limitation, stated honestly: a small number of records are append-only by design and cannot be deleted even at your request — sign-in history and the audit trail behind platform changes. They are what let us prove what happened if a payment or a decision is ever disputed. We are working out how to reconcile this with erasure requests; a lawyer should confirm the position before launch.

If something goes wrong

If personal data is exposed, we will notify the Data Protection Board and everyone affected, promptly and with what we actually know rather than a holding statement.

Children

This site is not for anyone under 18. We do not knowingly collect data from children, and we will delete it if we discover we have.

Changes

If we change what we collect or why, we will email you before it takes effect rather than quietly editing this page.