Privacy Policy

Atroxabot is a service of Luvarly, a company registered in the Netherlands. Luvarly is the controller of the personal data in this policy: we decide why and how it is processed.

• Company: Luvarly, Verdronkenoord 104-C, 1811 BH Alkmaar, The Netherlands
• Chamber of Commerce (KVK): 97726702
• VAT number: NL868203956B01
• Privacy questions and support: support@atroxabot.com

We have not appointed a data protection officer. Privacy questions go to the address above and reach the people responsible. More company details are on our legal information page.

We collect what you give us, what your agents produce and a small amount of technical data. You need to give a name and an email address to create an account; without them we cannot provide Atroxabot. Everything else depends on how you use it.

• Account data: your name, your email address, whether and when you confirmed it, and when you created your account. If you sign up with a password, we store only a salted hash of it. If you sign in with Google, Google gives us your name, email address and Google account ID.
• Sign-in data: the sessions that keep you signed in and the links we email you to confirm your address or reset your password. We store these only as hashes, with their expiry times.
• Agents, skills and connectors: what you set up, such as an agent's name, instructions, model, effort setting and monthly credit budget, the skills you write, and which skills and connectors each agent may use.
• Conversations: the messages you and others send your agents, their replies and when each was sent. This includes anything an agent reads through a skill or connector while it works.
• Files: what you upload to your Library, the files you send your agents in the chat or on Telegram and the files your agents save, with their names, types and sizes.
• Connection data: what an agent needs to reach a service or messaging app you connect, such as an access token, and the identifiers that service gives us, such as a chat or account ID.
• Usage and billing data: the credits each agent uses each month, your plan and your purchases. Payments go through Stripe. We receive a customer reference, what you bought and whether the payment succeeded, never your full card number.
• Technical data: your IP address, the country it belongs to and standard request details such as your browser type, in short-lived logs.
• Messages to us: what you write when you email our support or privacy address.

We do not ask for sensitive data such as health information. If you give it to an agent, it is processed like any other message, so think before you share it.

An agent works by sending requests to an AI model. A request contains the agent's instructions and skills, recent turns of its conversation, the new message with any files sent along, and anything it fetched through a connector or opened from your Library. The model provider processes the request and returns the reply. An agent cannot answer without this step, so it is part of the service you sign up for.

The model you choose for an agent decides which provider receives its requests. Today every model on Atroxabot is a Claude model from Anthropic, listed on our models page. We may add models from other providers. When we do, we add the provider to this policy before any of your content goes to it.

On a voice call with an agent, your browser records what you say one utterance at a time and we send each recording to Fish Audio, which turns it into text. Your agent's reply goes to Fish Audio to be spoken. The text of the call stays in the agent's conversation like any other message; we do not keep the recordings. Voice notes you send an agent on Telegram go to Fish Audio the same way, and on Pro and Ultra its reply comes back as a voice note made by Fish Audio; the voice notes you send are kept in your Library.

• No training: we do not use your messages, agents or skills to train AI models. Anthropic's commercial terms (opens in a new tab) say it does not train its models on content sent through its API.
• Conversations at Anthropic: an agent runs on Anthropic's agent platform, which keeps each of its conversations, with what the agent read and did in it, for as long as the conversation lasts. When you clear a conversation, or delete the agent or your account, we delete it there too: at once, or as soon as Anthropic can be reached.
• Provider retention: beyond that, Anthropic keeps API content for a limited period, and longer when it flags content for breaking its usage policies or when the law requires it. Its privacy policy (opens in a new tab) applies to that.
• Our access: people at Luvarly look at your conversations only when you ask us to, for example in a support request, when we must investigate abuse or a security problem, or when the law requires it.

Your messages may contain personal data about other people, such as the people in a group chat or in an email an agent reads. Only share what you have the right to share. We process it only to run your agent.

These features let an agent work beyond the Atroxabot app. Each one runs only when you set it up.

• Connectors: when you connect a service, such as your calendar or email, we store the access that service grants us. An agent uses a connector only if you assigned it to that agent, and only to do the work you set it up for. What it reads from the service becomes part of its conversation, so it goes to the model provider and into the agent's history like any other message.
• Messaging apps: when you add an agent to a messaging app, it receives the messages sent to it there, with the identifiers the app shares, such as a chat ID and display name, and it replies through the app. If other people write in that chat, the agent processes their messages too.
• Schedules: a scheduled run is a task you set up in advance. The agent runs at the times you chose, with the same instructions, skills and connectors, and its work is handled like any other message.

You can disconnect a service or messaging app at any time. We then delete the access we stored for it. You can also revoke our access in that service's own settings. Each connected service and messaging app is run by its own company, and its own privacy policy covers what happens there.

We use personal data only for the purposes below, each on a legal basis from Article 6(1) of the GDPR.

Our legitimate interests are keeping Atroxabot and its users safe, showing visitors prices they can pay in, and protecting our rights. We have weighed them against your interests and rights, and you can object to them. We do not ask for consent for any processing today; if we do later, you can withdraw it at any time. We do not use your data for advertising or to build profiles of you.

We use only cookies that Atroxabot needs to work, plus one that remembers a choice you made. We do not use analytics, advertising or tracking cookies, and no other company sets cookies on our pages. Because these cookies are strictly necessary or store a setting you chose, the law does not require your consent for them, so you will not see a cookie banner.

We do not sell your personal data and do not share it for advertising. We use a small number of services to run Atroxabot.

Cloudflare, Anthropic and Stripe process data for us under data processing agreements that bind them to our instructions. Google, for sign-in, and Stripe, for its own fraud prevention and legal duties, decide themselves how they use the data they receive, under their own policies.

Beyond these, your data goes only to the services and messaging apps you connect yourself, and to authorities when the law requires us to disclose it.

Luvarly is based in the Netherlands, but several of the services above are based in the United States or process data there. Cloudflare runs a global network, and the data center that stores your account or an agent may be outside the European Economic Area (EEA).

We transfer personal data outside the EEA only with a safeguard the GDPR recognises. Where the recipient is certified under the EU-U.S. Data Privacy Framework, we rely on the European Commission's adequacy decision for it (Article 45 GDPR). Otherwise we rely on the European Commission's Standard Contractual Clauses (Article 46 GDPR), which are part of our agreements with these providers.

You can ask us for a copy of the safeguard for a specific transfer at support@atroxabot.com.

We keep personal data only as long as we need it for the purposes above.

• Account data: until your account is deleted.
• Agents, skills, connections and conversations: until you delete them or your account is deleted. The copy of a conversation at Anthropic goes with it.
• Files: until you delete them or your account is deleted. When you delete an agent, its folder stays in your Library until you delete it.
• Sign-in sessions: up to 30 days. Logging out ends a session at once.
• Email links: a confirmation link works for 7 days, a password reset link for one hour and only once.
• Billing records: seven years, as Dutch tax law requires, also after your account is deleted.
• Logs: a short period, to fix errors and investigate abuse. They are then deleted automatically.
• Rate limiting: the count of attempts from your IP address lasts about a minute. Your country is used to pick a currency and is not stored.
• Emails with us: as long as we need them to handle your request.

When your account is deleted, we delete your account data, agents, skills, connections, conversations and files. Copies in our backups expire within 30 days. The services above keep data under their own retention periods, set out in their policies.

• Passwords are hashed with PBKDF2 and a unique salt. We never store them in readable form.
• Sessions and emailed links are stored only as hashes, so a copy of our database would not let anyone sign in.
• The session cookie cannot be read by scripts on the page and is sent only over HTTPS.
• All traffic to Atroxabot is encrypted with TLS, and Cloudflare encrypts stored data at rest.
• The sign-in, sign-up and password reset forms are rate limited to stop guessing attacks.
• Keys for model providers and Google are kept as encrypted secrets on our servers and never reach your browser.
• Only people who need it to run Atroxabot can access production data.

No system is perfectly secure. If a breach affects your personal data, we report it to the Autoriteit Persoonsgegevens and, where it puts you at high risk, tell you without undue delay, as the GDPR requires.

Under the GDPR you have these rights over your personal data:

• Access: ask what personal data we hold about you and get a copy (Article 15).
• Rectification: have incorrect or incomplete data corrected (Article 16).
• Erasure: have your account and data deleted (Article 17). We keep only what the law requires, such as billing records.
• Restriction: have us pause processing while a complaint about it is resolved (Article 18).
• Portability: receive the data you gave us in a common, machine-readable format, or have it sent to another service (Article 20).
• Objection: object to processing based on our legitimate interests (Article 21). We then stop, unless we have compelling grounds that override yours or need the data for a legal claim.
• Withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect processing that happened before.

You can correct your name and email address and delete your account yourself, in account settings.

To use any other right, email support@atroxabot.com, from the address on your account if you have one. We may ask you to confirm your identity first. It is free, and we answer within one month. If a request is complex, we may take up to two more months; if so, we tell you within the first month.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

If you think we handle your data wrongly, tell us first at support@atroxabot.com and we will try to put it right. You also have the right to complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (opens in a new tab). You can also go to the authority in the EU country where you live or work, or where the problem happened.

Atroxabot is for adults. You must be at least 18, or the age of majority where you live if that is higher, as our Terms of Service set out. We do not knowingly collect personal data from anyone younger. If we learn that we have, we delete the account and its data. If you believe a child is using Atroxabot, email support@atroxabot.com.

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose, to have it deleted or corrected, and to opt out of its sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising.

We collect the categories described in this policy: identifiers such as your name, email address and IP address; commercial information such as your plan and purchases; internet activity in our technical logs; and the content you give your agents. We use and disclose them only for the purposes in this policy and keep them for the periods above.

To use your rights, email support@atroxabot.com. Someone you authorize may also ask for you. We verify each request before we act on it, and we will not treat you differently for using your rights.

We update this policy when Atroxabot or the law changes. The date at the top shows the last change. If a change matters to you, for example a new kind of data or a new provider that receives your content, we tell you by email or in the app before it takes effect.

For questions about this policy or your data, email support@atroxabot.com or write to Luvarly, Verdronkenoord 104-C, 1811 BH Alkmaar, The Netherlands.