Skip to content
Small Business Activation by AgentX, home

DRAFT FOR ATTORNEY REVIEW. NOT LEGAL ADVICE. NOT YET IN EFFECT. Version: [VERSION, e.g. 0.1-draft] | Effective date: [EFFECTIVE DATE]

Privacy Policy

AgentX, LLC ("AgentX", "we", "us") operates smallbusinessactivation.com (the "Service"). This policy explains what personal information we collect, why, how we protect it, and the choices you have. It is part of our Terms of Service. Our contact details are in Section 14.

1. What we collect and why

Category What Why
Account information Your email address and, if you sign in with Google, your name and email verified by Google (see Section 6) To create and secure your account, send sign-in links, and send order and service emails
Business intake Business name, description, services, contact details you choose to publish, domain preferences, style choices To build your website or video
Uploads Logos, product photos and other files you upload To use in your site or video. (Real people in photos or video are not permitted.)
Generated content Previews, sites, videos, comments and edit requests To provide and improve your own deliverables for you, and to let you review and download them
Orders and billing What you bought, amounts, tax, dates, payment status and references from our payment processors To process payments, refunds, renewals, taxes and records
Domain registration data Registrant contact details that the registry or registrar requires To register a domain in your name
Technical data Hashed IP address (we store a keyed hash, not the raw address, for abuse control), browser user agent, session identifiers, security logs To keep the Service secure, limit abuse such as repeated free-item claims, and diagnose problems
Communications Messages you send us, and "Report a problem" reports To respond and fix issues
Cookies Essential cookies only. See our Cookie Policy To keep you signed in and protect forms

Payments. Payments are handled by Stripe and PayPal. Your full card number and security code go to them, not to us, and we never store card data on our systems. We receive limited details such as card brand, last four digits, expiry and a token that lets us charge a saved payment method you authorize.

Sensitive data. The Service is not for health, HIPAA-regulated or other sensitive personal information, and our Terms prohibit submitting it. Please do not submit it.

2. No training on your data

We do not use your inputs, uploads or generated content to train or fine-tune any AI model. We do not allow our AI vendors to do so either: we use vendor products and settings that exclude customer data from model training, and we only use vendors whose terms do so. This applies to our AI model providers and to the other vendors that handle your content in the chain.

3. How we use information

To provide, secure and support the Service; to process payments and send transactional emails (order confirmations, delivery notices, renewal reminders); to comply with law and enforce our terms; and to prevent fraud and abuse. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. How we share information

We share information only with service providers who process it for us under contract, as listed in Section 5, and in these cases: to comply with law or legal process; to protect rights, safety and the security of the Service; with your direction (for example, registrar submissions you request); and in a merger, acquisition or sale of assets, subject to this policy.

5. Processors and subprocessors

We use the following categories of providers, with named examples. This list may change; we update it here when it does. [BUSINESS: KEEP IN SYNC WITH infra/VENDORS.md.]

Category Examples Purpose
AI model providers Anthropic [ADD ANY AUDIO/VOICE/MUSIC/VIDEO VENDORS ONCE CHOSEN] Generating sites, videos and screening content
Infrastructure, hosting, storage, domains and security Cloudflare Running the Service, storing files, hosting sites, DNS, domain registration, bot protection on sign-in (Cloudflare Turnstile, which checks your browser without tracking cookies), cookieless analytics
Payment processors Stripe, PayPal Payments, saved payment methods, tax calculation and reporting
Email delivery AgentX's own mail server (operated by AgentX, LLC) Sign-in links and service emails

6. Google sign-in and Google user data

If you choose "Sign in with Google", we use Google OAuth with these scopes only: openid, email and profile. These are Google's basic, non-sensitive scopes.

  • What we receive: your Google account identifier, your email address (and whether Google has verified it), and your name. We may also receive your profile picture URL but do not require it.
  • How we use it: only to sign you in, create and secure your account, link it to the same email-based account, and contact you about your orders and the Service. We do not use Google user data for advertising.
  • No sale or transfer: we do not sell Google user data. We do not transfer it to third parties except as needed to provide the features you use, to comply with law, or as part of a merger or acquisition with notice to you, and never for personalized, retargeted or interest-based advertising. We do not allow people to read Google user data except with your consent, for security or abuse investigation, to comply with law, or when the data is aggregated and anonymized for internal operations.
  • No AI training: we do not use Google user data to develop, improve or train generalized AI or machine-learning models.
  • We do not access your Gmail, Drive, Calendar, contacts or any other Google service data.
  • Storage and protection: stored in our database with access controls and encryption in transit and at rest.
  • Deletion and revocation: you can delete your account and the data it holds from your dashboard, or ask us at [PRIVACY EMAIL]. You can also revoke our access at any time at https://myaccount.google.com/permissions. Revoking access stops sign-in with Google but does not by itself delete our account records.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. [ATTORNEY/BUSINESS: CONFIRM AGAINST THE CURRENT GOOGLE POLICY AND OAUTH VERIFICATION REQUIREMENTS BEFORE SUBMITTING THE CONSENT SCREEN.]

7. Deletion, export and your controls

  • Self-service deletion. From your dashboard you can delete any upload, preview, site version, video, comment or project, and delete your account. Deleted items become inaccessible immediately. We then purge stored files and database records and remove copies at vendors where applicable. This normally completes within minutes and in any event within [30] days, apart from items we must keep (Section 8). Before you delete your account, we show how to transfer out any domain registered in your name.
  • Export. You can download a copy of the sites, videos and uploads in your account.
  • Request channel. For anything you cannot do yourself, email [PRIVACY EMAIL] and we will respond within [45] days.
  • Reports and abuse. To report content or send a DMCA notice, use support@smallbusinessactivation.com or the contact in our Terms.

8. Retention

We keep account and content data while your account is active. After you delete content or your account, we purge it as described above. We keep:

  • Financial and tax records (amounts, dates, taxes, payment-processor references) for [7] years or as long as tax and other laws require, with personal identifiers such as your email address removed or replaced by a non-reversible token when you delete your account;
  • Security and audit logs for [PERIOD] to protect the Service;
  • A non-reversible token of your email address (a keyed hash, from which your address can't be recovered) recording that your account used its free preview and free video allowance, so deleting and re-creating an account can't be used to claim the free allowance again. It contains no other information;
  • Sales inquiries from our high-touch contact form until the inquiry is closed plus [1 year];
  • Backups and files of lapsed hosting for up to the periods stated in our Hosting Terms unless you delete them sooner.

9. Security

We use encryption in transit and at rest, access controls, least-privilege credentials and audit logging. We do not store passwords (sign-in is by email link or Google) or card data. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach affecting your information, we will notify you and regulators as required by law.

10. Cookies and analytics

We use essential cookies only, and cookieless analytics. See the Cookie Policy (cookies.md).

11. Children

The Service is for businesses and is not directed to children. You must be 18 or older to use it. We do not knowingly collect personal information from anyone under 18 (or under 13 where a lower threshold applies). If you believe a child has given us information, contact [PRIVACY EMAIL] and we will delete it.

12. US state privacy rights

This section is written to apply generically and can be updated state by state. [ATTORNEY: CONFIRM WHICH STATE LAWS APPLY TO AGENTX BASED ON THRESHOLDS, AND WHETHER BUSINESS-TO-BUSINESS DATA IS EXEMPT UNDER EACH.]

Depending on where you live, you may have the right to: know and access the personal information we hold about you; correct inaccurate information; delete your information; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising or profiling; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

  • What we do: we do not sell personal information or share it for targeted advertising, and we do not use it for profiling that has legal or similarly significant effects. We do not knowingly collect sensitive personal information (the Terms prohibit submitting it).
  • How to exercise: use the self-service tools in your dashboard, or email [PRIVACY EMAIL]. We may need to verify your identity, typically by confirming control of your account email. An authorized agent may submit a request with your written permission.
  • Appeals: if we decline a request, you may appeal by replying to our decision with the word "Appeal". We will respond within the time required by law. If your appeal is denied, you may contact your state attorney general.
  • Categories collected in the last 12 months: identifiers (email, hashed IP), commercial information (orders), internet activity (security logs), and the content you provide. Sources are you and your devices. Disclosures are to the service-provider categories in Section 5.

[STATE-SPECIFIC ADDENDA PLACEHOLDER: e.g. California, Colorado, Connecticut, Virginia, Texas, New Jersey. Add as needed.]

13. Changes to this policy

We will post updates here with a new effective date and notify you of material changes by email or in the product before they take effect.

14. Contact