Privacy

What we store

• Account — email, name, an optional avatar URL, your role, and a scrypt hash of your password. Passwords are never stored in a recoverable form.
• Sessions — a SHA-256 hash of your session token, plus the IP address and user agent that created it. The token itself exists only in your browser cookie.
• Workspace — the agents you own, the workflows you create, and the input and output of every execution you run.
• Integration credentials — encrypted with AES-256-GCM before storage. They are decrypted only inside the agent runtime on the server and are never returned to a browser.
• Usage — agent runs, workflow runs, token counts and API calls, recorded per execution for billing and limit enforcement.
• Audit log — who performed which administrative action on which resource, and when.

What we do not store

• Card numbers or any payment instrument. Our payment provider handles all of that.
• Your plaintext password, at any point after registration.
• Raw API keys. Only a SHA-256 hash and a non-secret display prefix are kept.

Where your data goes

• AI providers — when you run an agent, the input you supply and the agent system prompt are sent to the configured model provider (Anthropic or OpenAI) to produce the output. The request is always made against your own credentials and billed to you by that provider — an agent does not run without them, so this never happens on a PROMIVO key.
• Our payment provider — your email, your billing country and the amount, when you make a purchase or hold a subscription. It is the merchant of record: it takes the payment, issues the invoice and handles the tax, and it holds the card details PROMIVO never sees.
• Your email provider — transactional messages such as verification and receipts.
• Analytics — a page view and its loading measurements, for each visit. This runs on Vercel, which already hosts the site, and the script is served from this domain rather than a third party’s. No cookie is set, nothing you type is included, and no identifier follows you between visits or to any other site.
• Endpoints you configure — a workflow HTTP or webhook node sends exactly the payload you defined, to the URL you defined.

We do not sell data, and we do not share workspace content with other customers.

Logging

Server logs are structured JSON and pass through a redaction filter that strips any field whose name looks like a credential — password, secret, token, key, authorization, cookie, signature or hash. Stack traces are never returned to a browser.

Retention and deletion

Workspace data lives for as long as your account does. Deleting your account cascades to your sessions, agents purchases, workflows, executions, integration credentials and API keys. Audit entries are retained with the actor detached, because an audit trail that can be erased by the person it records is not an audit trail.

Your controls

• Revoke any integration connection from the dashboard, which deletes its stored credentials.
• Revoke any API key, immediately and irreversibly.
• End every active session from your security settings.
• Request account deletion by contacting support.