Who this policy applies to
Morphologic AI Inc. ("we", "us") operates Agentzia at agentzia.dev (the "Service"), an AI-agent landing-page testing service. This Privacy Policy explains how we handle personal information when you visit, create an account, submit a page or content for analysis, connect through MCP, subscribe, buy credits, or contact us.
We are based in British Columbia, Canada and handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).
The Service is offered only to adults in the United States and Canada, excluding the Province of Quebec. It is not directed to individuals in Quebec, the European Union, European Economic Area, United Kingdom, or Switzerland.
Information we collect
Information you provide
- Account and identity. Your email address, authentication identifiers, account creation time, credit balance, and hashed token metadata if you create a manual MCP token.
- Analysis input. A submitted public URL or supplied page content, optional competitor information, the source of the request, and instructions needed to run the analysis.
- Analysis output. Participant decisions, citations, search and navigation traces, page inventories, observer synthesis, reports, model-usage records, status, timestamps, and error details.
- Billing. Credit events, checkout and transaction identifiers, payment status, and billing details made available by Stripe. Stripe processes card details; we do not store full card numbers.
- Support. Information you include when you contact us.
Information collected automatically
- Technical data. IP address, request metadata, timestamps, browser or device information available in standard logs, and security or rate-limit events.
- Authentication data. Strictly necessary cookies and OAuth session data used to sign you in and connect an MCP client.
- Guest-run data. A browser claim token and an IP-derived rate-limit value used to protect and later attach a guest analysis to a verified account.
How an analysis is processed
Agentzia is in the inference path. Unlike a tool that merely transports messages, Agentzia sends the submitted URL or content and related research context to third-party AI and research providers so the requested study can run.
Participant models may search the public web, open pages, and produce decisions. A separate observer model processes the participant records and available page inventory to build the report. Firecrawl receives the public URL for a separate crawl, search-visibility, and page-inventory track.
Provider configurations and the model roster can change. Each completed report identifies the models, providers, trace fidelity, and limitations used for that run. The providers' own terms and privacy practices also apply to their processing.
Do not submit secrets, personal data, confidential drafts, authenticated pages, or regulated information. Content supplied directly through MCP becomes part of the stored run and is processed by external providers.
How we use information
We use personal information to:
- create and authenticate accounts and MCP connections;
- run participant research, page inventory, observer analysis, and report generation;
- save reports and make them available to the account that owns them;
- manage subscriptions, credits, checkout, payment fulfillment, and transaction records;
- protect the Service through access controls, abuse prevention, rate limiting, and troubleshooting;
- provide support and send essential account, security, and billing communications;
- understand and improve Service reliability and product behavior; and
- comply with legal obligations and enforce our Terms and Acceptable Use Policy.
Our handling is based on your consent and on what is necessary to provide the Service you request, consistent with PIPEDA and PIPA.
Email and anti-spam
We send transactional emails needed to provide the Service, including one-time sign-in codes, account and security notices, billing receipts, and replies to support requests. You cannot opt out of essential transactional messages while maintaining an active account.
If we send commercial electronic messages, we will do so in accordance with Canada's Anti-Spam Legislation (CASL), identify Morphologic AI Inc. as the sender, include a working unsubscribe method where required, and honor unsubscribe requests within 10 business days. Unsubscribing from commercial messages does not stop essential account, security, billing, or service communications.
How we share information
We share information only as needed to operate the Service:
- With service providers. Providers process data on our behalf or as part of the analysis you request, as described below.
- For legal and safety reasons. We may disclose information to comply with law or lawful requests, protect rights or safety, investigate abuse, or preserve the integrity of the Service.
- In a business transfer. Information may transfer in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to this policy and applicable law.
Reports are private to their owning account, except that a guest report is accessible using its unguessable claim token until attached to an account. We do not sell personal information or share it for cross-context behavioral advertising.
Providers and subprocessors
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Authentication and database | Accounts, sessions, credits, runs, and reports |
| Vercel | Application hosting and delivery | Web requests and application traffic |
| OpenRouter | Model routing, observer processing, and model-directed research | Run input, research context, traces, and generated output |
| OpenAI | Participant and observer models when configured | Run input, research context, traces, and generated output |
| Gemini participant models | Run input, research context, and generated output | |
| Anthropic | Claude participant models when configured | Run input, research context, and generated output |
| Firecrawl | Public-page crawl, search visibility, and page inventory | Submitted public URL and public page content |
| Stripe | Checkout, payments, and billing | Billing and transaction information |
Providers may process information in the United States and other locations where they operate. Their service-specific terms, data locations, and retention practices can differ. We update this list when the production provider set materially changes.
Cross-border processing
Our infrastructure and providers process information outside your province or country, including in the United States. Information stored or processed abroad may be accessible to courts, law enforcement, and authorities under the laws of those jurisdictions. This disclosure is provided under PIPA and PIPEDA.
Retention and deletion
- Account and reports. There is currently no automatic expiry. Account records, submitted inputs, traces, and reports remain stored during the beta until manually deleted.
- Guest runs. Guest-run records and claim tokens are retained so the run can complete and be attached to a verified account.
- Billing and security. We retain transaction, tax, fraud-prevention, and security records as required by law or for legitimate business purposes.
- Deletion requests. Self-serve deletion is not yet available. Email us to request deletion. We will delete or de-identify information unless retention is required by law, needed to resolve a dispute, or necessary for security and fraud prevention.
Provider copies and backups may remain for a limited period under provider retention schedules. Deleting an Agentzia record does not necessarily delete information independently retained by a third-party provider under its own terms.
Your privacy rights
Subject to legal limits, you may ask to access personal information we hold about you, understand how it has been used and disclosed, correct inaccurate information, or withdraw consent for non-essential processing. Withdrawal may prevent us from providing parts of the Service.
To exercise a right or make a complaint, email agentziadev@gmail.com. We may need to verify your identity. You may also contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
Security
We use measures including encryption in transit, account-scoped access controls, database row-level security, OAuth 2.1 for interactive MCP clients, short-lived access tokens, and hashed storage for manual MCP tokens. No transmission or storage method is perfectly secure, and we cannot guarantee absolute security.
If a breach of security safeguards creates a real risk of significant harm, we will provide the notifications and keep the records required by applicable law.
Cookies and children
Cookies
We use strictly necessary cookies for authentication, session refresh, guest-run protection, and security. We do not currently use advertising cookies or cross-site behavioral tracking. If that changes, we will update this policy and provide any consent controls required by law.
Children
The Service is intended for adults and is not directed to minors. You must be the age of majority in your province or state, and in every case at least 13 years old. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided information so we can investigate and delete it where required.
Changes and contact
We may update this policy. Material changes will be posted here with a new effective or last-updated date and, where appropriate, notified through the Service or account email. Continued use after changes take effect means the updated policy applies.
Privacy Officer and support: agentziadev@gmail.com