GaragentPrivacy Policy
Last updated: October 10, 2026
Effective date: [Insert publication date]
ZAD Creation LLC (“we,” “us,” or “our”) operates Garagent, including https://www.getgaragent.com and https://app.getgaragent.com (the “Service”). This policy explains how we collect, use, disclose, and retain personal information and the choices available to you. Garagent is currently an invite-only beta.
This policy is a privacy notice, not blanket consent to every use of personal information. Where consent or another authorization is required, we obtain it separately.
1. Information we collect
Account and sign-in information
When you sign in with Google, we receive information used to identify and authenticate your account, such as your name, email address, Google account identifier, and email-verification status. [Confirm the actual Google scopes and returned fields.]
Google sign-in alone does not give us your Google password or access to Gmail messages or Google Drive files. Separately connecting an integration may require additional permissions.
We collect profile details, invitation information, and beta-access requests you provide.
Content, agents, and integrations
We process chat messages, task instructions, project details, uploaded and generated files, agent configurations, skills, memories, AI responses, and task results. These materials may contain personal information about you or other people.
Connected tools can supply additional information, including messages, files, contacts, task records, and other data available through the permissions you authorize. We may store access or refresh tokens, connection settings, or other credentials needed to maintain an authorized connection. [Identify the integrations actually available, data accessed, permissions requested, and credential types stored.]
An agent’s memory may store information derived from earlier conversations or tasks and make it available in later work. [Describe actual memory controls and whether deleting a conversation also removes related memories, indexes, and derived records.]
Only submit information you are authorized to provide. As described in our Terms of Use, do not submit protected health information, complete payment-card details, government identification numbers, passwords, private keys, or other data requiring special safeguards unless we have expressly agreed to support that use. Use designated integration controls for connection credentials where available. This restriction does not mean that sensitive information submitted accidentally is outside our privacy responsibilities.
Usage and technical information
We collect IP addresses, timestamps, requested URLs, response status codes, error information, and account activity to operate and secure the Service. We record model requests, token consumption, credit balances, and task activity to manage usage and access.
[Confirm whether logs contain prompts, responses, file contents, headers, identifiers, or credentials; identify browser/device fields, analytics, error-monitoring services, and any approximate location inferred from IP addresses. Disclose actual content logging here and minimize unnecessary sensitive information.]
Communications and payments
We collect information you send when requesting beta access, contacting support, submitting feedback, or communicating with us.
The current beta does not offer public paid-plan checkout. Before introducing payments, we will update this notice to describe the information and providers involved.
2. How we use information
We use personal information to authenticate users; manage invitations and accounts; run agents, tasks, projects, and connected tools; store and retrieve content; calculate usage and credits; provide support and operational notices; troubleshoot errors; prevent abuse; protect accounts; comply with law; and establish, exercise, or defend legal claims.
We also use feedback and operational information to improve the Service. [Specify whether improvement or evaluation involves human review of private content, automated analysis of content, de-identified statistics, or only voluntary feedback and usage metrics. Do not use “improve the Service” as a substitute for disclosing materially different uses.]
[If marketing emails are sent: describe the subscription/consent process and unsubscribe control. Otherwise remove this note.] Opting out of marketing does not stop necessary account, security, or legal communications.
Model training
[Confirm and adopt this wording only if true for Garagent and every enabled provider route:]
We do not use your private chats, tasks, uploaded files, agent memories, or outputs to train our own AI models. We do not opt this content into third-party providers’ optional general-purpose model-training or data-sharing programs.
AI processing, abuse monitoring, task-specific memory, and model training are different activities. Provider processing and retention are explained below. [Disclose any actual exceptions, including feedback submissions that permit training. Verify API contracts, account settings, free-provider routes, and user-supplied provider credentials before making the statement above.]
3. AI processing, automated actions, and human access
To complete work, we send relevant information to the AI provider used by the agent. This can include instructions, conversation history, files, memories, and tool results. Information sent depends on the task, model, and features enabled; it may include context beyond the latest message.
Providers may retain information for service operation, abuse prevention, or other purposes permitted by the applicable agreements. Practices differ between API products, consumer products, features, and account settings. We do not promise zero provider retention unless that arrangement has been verified for the feature concerned.
Connected tools may send information to external services and recipients as part of your requested action. Scheduled tasks may process information while you are not signed in. Review permissions, destinations, and schedules carefully.
[Describe actual staff and contractor access before publication: who can access private content, for what purposes, whether support access needs user authorization, and what restrictions and logging are implemented. Do not promise that “only you can see your content” if administrators or providers can access it.]
[If accounts can belong to organizations or shared workspaces: identify what administrators and other members can access. Remove this note if those features are unavailable.]
4. Who receives information
We disclose information to providers supporting the Service and to connected services or recipients involved in your authorized actions.
| Provider | Purpose | Confirmation needed |
|---|---|---|
| DigitalOcean | Application hosting and stored data | Confirm services, storage, backups, and region |
| Account authentication | Confirm scopes; list additional Google integrations separately | |
| Anthropic | Claude AI processing | Confirm API/product route and data controls |
| OpenAI, if enabled | AI processing | Confirm enabled endpoints and data controls |
| [Email provider] | Account and support communications | Identify actual provider |
| [Contact-form provider, if enabled] | Website inquiries | Identify provider or remove row |
| [Other enabled providers] | Analytics, error monitoring, search, or other features | Identify actual services and purposes |
| Services and recipients you connect or select | Authorized integration and communication actions | Describe available integrations |
Remove inactive providers and complete this table before publication. Provider information: DigitalOcean, Google, Anthropic commercial-product privacy information, and OpenAI business data privacy.
Our service providers’ handling of information is governed by the applicable agreements and law. Separately connected services and recipients may handle information under their own policies. Linking to another policy does not remove our responsibilities for our own disclosures or processing.
We may disclose information to professional advisers where necessary for legal, accounting, or business advice, subject to appropriate confidentiality obligations. We may disclose information where reasonably necessary to comply with law or valid legal process, investigate abuse, protect rights or safety, or establish, exercise, or defend legal claims.
If we undergo a merger, acquisition, reorganization, or business sale, information may be disclosed during the transaction and transferred to a successor, subject to appropriate confidentiality protections and applicable law. Any materially different use requires the notice and consent required by law.
[Confirm before adopting: We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising. Check advertising pixels, analytics arrangements, and legally defined “sale” or “sharing”; not receiving money does not by itself resolve this question.]
5. Cookies and browser storage
[Describe the actual cookies, local storage, session storage, or other technologies used to maintain sessions, security, preferences, and account functions. Identify purpose and duration.]
[Identify optional analytics, advertising, embedded media, and contact-form technologies, or state their absence only after verification. Describe consent and withdrawal controls where required. Explain handling of legally recognized opt-out preference signals if applicable; do not claim a control is supported unless implemented.]
Google sign-in and external content may involve third-party technologies. You can manage browser storage through your browser settings, but blocking necessary technologies may prevent sign-in or other functions. Browser controls do not replace consent controls where those are required.
6. Retention and deletion
We retain personal information for the disclosed purposes for no longer than reasonably necessary, subject to applicable legal requirements. Retention depends on the type of information, account status, operational need, security requirements, and legal obligations.
[Confirm and implement these periods or describe sufficiently specific retention criteria before publication. Do not promise a deletion deadline that the application and backup process cannot meet.]
| Information | Retention |
|---|---|
| Account information and stored content | While needed to provide the account; after closure, [period/criteria] |
| Content deleted from active systems | [Deletion period and treatment of derived memories/indexes] |
| Integration credentials | [Period after disconnection/closure and revocation procedure] |
| Operational and security logs | [Period/criteria] |
| Support and beta-access correspondence | [Period/criteria] |
| Backups | [Expiry/overwrite period and handling of restored backups] |
Deletion may not immediately remove backup copies. [Confirm whether retained backups are isolated from routine use and how deletion requests are reapplied if backups are restored.]
We may retain limited information where necessary for legal compliance, fraud prevention, security investigations, or legal claims. Such exceptions are limited to the relevant information and purpose.
Information already sent to AI providers, connected services, or recipients may remain subject to their retention practices and applicable law. Disconnecting an integration does not recall sent messages, undo actions, or automatically delete previously imported content. We remain responsible for directing deletion by our processors where required.
Request account closure or deletion at hello@getgaragent.com.
7. Your choices and privacy rights
You may stop using the Service and request account closure. [Describe available profile-editing, content-deletion, memory-management, export, integration-disconnection, and schedule controls.]
You can also revoke an integration’s permissions directly with the external provider. Work already submitted externally may continue. Removing access does not reverse completed actions.
Depending on your location and the laws applicable to us, you may have rights to access, correct, delete, or obtain a portable copy of personal information; object to or restrict processing; withdraw consent; opt out of certain uses; or appeal a denied request. Where required, you may use an authorized representative and exercise rights without unlawful discrimination.
Contact hello@getgaragent.com. We may request information reasonably necessary to verify your identity or representative’s authority. We will respond within applicable legal deadlines. If we cannot fulfill a request, we will explain the reason and available appeal options where required. You may also complain to the relevant privacy regulator.
Withdrawing consent does not affect earlier lawful processing or processing supported by another valid legal basis. These Terms do not require you to waive mandatory privacy rights.
8. International processing and legal bases
[Identify ZAD Creation LLC’s business location, hosting region, and relevant provider processing locations.]
Information may be processed outside your country, where privacy laws may differ. Where applicable law requires safeguards for transfers, we use the arrangements required by that law. [Identify the actual arrangements before publishing; do not imply that provider contracts or certification automatically cover every transfer.]
[If EU/UK data protection law applies: explain when ZAD Creation LLC acts as controller and when it processes customer data on instructions; map actual processing purposes to contractual necessity, legitimate interests and the interests pursued, legal obligations, or consent; identify applicable transfer safeguards, how to obtain a copy, and any required representative/contact. Execute necessary processor agreements. Do not include a generic GDPR-compliance claim.]
9. Security
We use safeguards intended to protect personal information against unauthorized access, loss, or misuse. No system can guarantee complete security. This limitation does not remove our legal security obligations.
Our Security page describes protections we have verified and implemented. [Confirm that this page is accurate and available before linking.]
We will notify affected individuals and authorities of security incidents where required by applicable law. Keep your sign-in account secure, review integration permissions, and report suspected unauthorized access to hello@getgaragent.com.
10. Children
The Service is intended for adults aged 18 or older and is not directed to children. We do not knowingly collect personal information from children under 18. If we learn that a child has provided personal information, we will investigate, restrict access as appropriate, and delete information unless retention is legally required. Contact us to report a concern.
11. Changes
We may update this policy as the Service or our practices change. We will revise the date and give notice of material changes through appropriate channels, such as the Service or your registered email, where required. Where law requires consent for a new use, we obtain it before that use. Posting an updated policy alone does not authorize retroactive uses that require consent.
12. Contact
ZAD Creation LLC
[Business mailing address]
Privacy questions, requests, and appeals: hello@getgaragent.com.