Effective July 26, 2026
Agent Boss Privacy Policy
Data we process
A demo request includes name, work email, company, job title, company size, use case, language, and consent, with optional phone, message, and limited attribution. Private accounts process sign-in identity, membership and role, agent settings and instructions, runs, outputs, approvals, usage, audit records, support requests, and billing status. Intake data is not stored in D1, and raw IP addresses are not retained.
Purposes and basis
We use data to respond, prepare a demo, create an account and workspace, provide the requested service, protect against abuse, manage support and billing, evidence actions, and meet legal duties. Demo intake relies on consent and requested pre-contract steps; private service processing relies on contract performance and other lawful bases applicable to the context.
Processing and location
Demo and account data is processed in dedicated agent-boss PostgreSQL on Wafi, with Cloudflare providing protection, Turnstile, TLS, and a governed AI Gateway path. A service provider may process technical data or run content outside Saudi Arabia; no Saudi-residency claim is made. A customer is not activated until the required transfer scope, safeguards, and assessment are documented in the service order or data-processing addendum.
Retention and deletion
Abuse, closed records, and abuse-control data are deleted within 30 days; unconverted requests within 180 days; and the converted intake copy within 30 days after transfer to a customer record. Account data and Customer Content are retained for the service term; the service order or data-processing addendum defines return and deletion after termination, and activation requires that schedule to match operational controls. Limited retention may continue where law or a documented legal hold requires it.
Security and minimization
The path is designed for least privilege, transport encryption, separated runtime secrets, PII-free admin audit records, and a retention-limited HMAC abuse fingerprint. Application logs will not record request bodies, Turnstile tokens, or raw IP addresses.
Disclosure and processors
Disclosure is limited to personnel and service providers needed to operate, protect, support, and bill the service, or when a legal duty applies. The service order or data-processing addendum identifies processors relevant to the customer use case before activation.
Your rights and contact
You may request information, access, a copy, correction, destruction, or withdrawal of consent where applicable by contacting support@wdeftksa.com. Legal operator: Alayna Electronic Services Office, Kingdom of Saudi Arabia. You may also complain to the Saudi Data and Artificial Intelligence Authority.