Privacy Policy
Last updated: October 2, 2026
This Privacy Policy explains how Ovk Consulting ("we", "us", "our") collects, uses, stores, and protects your personal data when you use Agent One at agent-one.org and through connected messaging platforms. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and applicable Danish data protection law.
1. Who We Are
Agent One is operated by Ovk Consulting (CVR 38284282), Lyngbyvej 438, 2820 Gentofte, Denmark. For the purposes of GDPR, Ovk Consulting is the data controller -- meaning we decide how and why your personal data is processed.
Contact for data requests:
Ovk Consulting
CVR: 38284282
Lyngbyvej 438, 2820 Gentofte, Denmark
Email: [email protected]
Website: agent-one.org
2. What Data We Collect
We collect only the data necessary to provide and improve Agent One. Here is what we collect and why:
| Data | Purpose | Legal Basis |
|---|---|---|
| Email address | Account creation, billing communication, service updates | Contract performance |
| Messaging platform user ID (Telegram or Discord) | Connecting your agent to your Telegram or Discord account | Contract performance |
| Conversation messages | Providing AI responses and the agent memory feature | Contract performance |
| Usage metrics (message counts per day) | Service monitoring, fair use enforcement, billing | Legitimate interest |
| Payment information | Processing payments via Stripe (we never see or store your card number) | Contract performance |
| Website usage data (page views, referrer URLs, UTM parameters, scroll/click events, device type, country) | Product improvement and marketing attribution. No cookies used, no personal identifiers stored. Retained for 90 days. | Legitimate interest |
| OpenRouter API keys (when provided by user) | Authenticating AI model requests on behalf of the user. Encrypted on server, never shared. Users are responsible for API key costs. | Contract performance |
We do not collect special category data (health, biometric, political, or religious data). We do not buy data from third parties or build advertising profiles.
3. How We Use Your Data
Your data is used for the following purposes:
- Providing the service -- delivering AI agent responses in your messaging app, maintaining conversation memory, and managing your account.
- AI processing -- your messages are sent to third-party large language model (LLM) providers through OpenRouter to generate AI responses. See Section 5 for details.
- Team features -- if you use a team agent, conversation context is shared between team members to enable collaborative use of the agent.
- Billing -- processing payments, managing subscriptions, and enforcing fair use.
- Service improvement -- aggregate, anonymized usage metrics help us improve performance and reliability. We do not use your messages to train AI models.
4. Legal Basis for Processing
Under GDPR Article 6, we process your personal data based on the following legal grounds:
- Performance of a contract (Article 6(1)(b)) -- most of the data we process is necessary to deliver the service you signed up for. This covers your email, messaging platform user ID (Telegram or Discord), conversation messages, and payment processing.
- Legitimate interests (Article 6(1)(f)) -- we collect usage metrics to monitor service health, prevent abuse, and improve Agent One. We have assessed that this does not override your rights, as the data is minimal and non-sensitive.
We do not rely on consent as a legal basis for core service functionality. If we ever need consent for a specific purpose (such as marketing emails), we will ask for it separately and you can withdraw it at any time.
5. Third-Party Services
We share data with the following third parties, only to the extent necessary to operate the service:
Stripe (Payments)
Stripe processes your payment information. We never receive or store your credit card number. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
OpenRouter / Anthropic (AI Processing)
Your messages are sent to AI model providers through OpenRouter to generate agent responses. These providers process messages as data processors on our behalf. Messages are sent for inference only and are not used to train AI models. See OpenRouter's Privacy Policy.
Telegram (Messaging)
Agent One connects to your Telegram account through Telegram's Bot API. Telegram acts as an independent platform. Your messages pass through Telegram's infrastructure before reaching us. See Telegram's Privacy Policy.
Discord (Messaging)
Agent One connects to your Discord account through Discord's OAuth2 and bot APIs. Discord acts as an independent platform. When you connect Discord, we store your Discord user ID and, if you add the agent to a server, the server and channel IDs so the agent can reply there. Your messages pass through Discord's infrastructure before reaching us. See Discord's Privacy Policy.
Groq (Voice Transcription)
When you send voice messages, audio is processed by Groq Inc. for transcription (converting speech to text). Audio data is sent for transcription only and is not retained by Groq after processing. Groq operates in the United States. Legal basis: contract performance. See Groq's Privacy Policy.
Deepgram (Voice Synthesis)
When your assistant replies with a voice note, the reply text is processed by Deepgram for speech synthesis (text-to-speech) to produce the audio. The reply text is sent for synthesis only. Deepgram operates in the United States. Legal basis: contract performance. See Deepgram's Privacy Policy.
OpenRouter (Voice Synthesis)
When a group selects one of the additional voice options, the reply text is sent to OpenRouter for speech synthesis (text-to-speech) to produce the audio. OpenRouter forwards the text to the upstream speech provider that serves the selected voice — Deepgram, ElevenLabs or Microsoft, depending on the voice. The reply text is sent for synthesis only. These providers operate in the United States. Legal basis: contract performance. See OpenRouter's Privacy Policy.
Cloudflare (Infrastructure)
We use Cloudflare, Inc. for CDN, DDoS protection, and SSL/TLS tunneling. Cloudflare processes IP addresses, request headers, and traffic data as part of routing and protecting requests to our service. Cloudflare operates a global edge network. Legal basis: legitimate interest (security and performance). See Cloudflare's Privacy Policy.
We do not sell your personal data to anyone. We do not share your data with advertisers.
Newsletter Emails (Draft for Legal Review)
Draft for legal review.
This section is a plain description of how the newsletter works in our systems. It is still a draft and has not been through legal review, so the wording may change after that review.
The signup IP is kept as consent evidence for [retention period — to be decided by the owner; proposal: 12 months].
When you ask for the Agent One newsletter on the signup form at agent-one.org, we collect and store:
- Your email address -- the address you type into the signup form.
- Your consent record -- the exact signup text you agreed to, its version, where you signed up (for example the landing page), and the time you signed up.
- The IP address we see when you sign up -- kept only as evidence that the signup happened.
- Subscription state -- whether the address is waiting for confirmation, confirmed, unsubscribed, or suppressed (blocked from further sending), together with the confirmation, bounce and complaint events we record for it.
Why we hold it: only to send you the newsletter you asked for, to honour your unsubscribe, and to keep a record of the consent you gave. We do not sell your email address, and we do not share it with anyone except the sending processor below.
Double opt-in: after you sign up we send one confirmation email. You are only added to the sending list once you click the link in that email. If you never confirm, we do not send you the newsletter.
Unsubscribing: every email includes a one-click unsubscribe link, and you can unsubscribe at any time from any email we send. No account or password is needed. Unsubscribing withdraws the consent you gave at signup, and we stop sending to that address.
AI assistance: This newsletter is written with the help of AI.
Sending processor: our newsletter emails are delivered through AgentMail, which processes your email address on our behalf so the email can be sent. We do not enable open tracking or click tracking in the emails we send.
Retention: we keep the subscription and its consent record while you are subscribed. If you unsubscribe we stop sending immediately and keep the record needed to make sure the address is not mailed again. We delete newsletter data when you ask us to, using the request route in Section 8, except for the record we must keep to show that consent was given or that you opted out.
Earlier signups (legacy re-confirmation): addresses collected through the earlier signup form were not confirmed by email at the time. We will ask those subscribers to confirm once by email; only addresses that confirm will keep receiving the newsletter, and addresses that do not confirm are not mailed again.
6. Data Storage and Security
Your conversation data is stored in isolated SQLite databases within individual Docker containers -- one per agent. This means your data is architecturally separated from other users' data.
We take the following measures to protect your data:
- Each agent runs in its own isolated container environment
- Access to production systems is restricted to authorized personnel
- Data is transmitted over encrypted connections (TLS)
- We regularly review and update our security practices
Server location: Our servers are located in the European Union.
If our servers are located outside the EU/EEA, we ensure that appropriate safeguards are in place for international data transfers, such as Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Data Retention
We retain your data only for as long as necessary:
| Data | Retention Period |
|---|---|
| Raw conversation messages | 30 days by default, then automatically deleted. Durable memories your assistant saves about you are kept separately and are not covered by this 30-day window -- see the Agent memory row below. |
| Agent memory (the facts your assistant keeps for you, and that /forget shows you) | Kept until you remove it -- say /forget in your chat, or ask your assistant to forget it (clear_memories) -- or until you delete your account. There is no age-based expiry for this memory: it is never deleted for being old. It is kept separately for each chat, and it can include facts derived from your conversations, so it can outlive the 30-day raw-message window above. Your assistant tells you whenever it saves something. This memory is deleted when you delete your account. |
| Short-term working memory | Your assistant also uses a short-term working memory while chatting: it is automatically cleared after 30 days. It is separate from the agent memory above, and /forget does not control it. |
| Account data (email, Telegram/Discord ID) | Until you request account deletion |
| Usage metrics | Retained for billing and service monitoring purposes, deleted when no longer needed |
| Payment records | As required by Danish tax and accounting law (typically 5 years) |
When data that has a retention period reaches the end of it, that data is permanently deleted from our systems.
8. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. You can exercise any of them by emailing [email protected].
- Right of access (Article 15) -- you can request a copy of all personal data we hold about you.
- Right to rectification (Article 16) -- you can ask us to correct inaccurate or incomplete data.
- Right to erasure (Article 17) -- you can ask us to delete your personal data. We will comply unless we have a legal obligation to retain it.
- Right to restrict processing (Article 18) -- you can ask us to limit how we process your data in certain circumstances.
- Right to data portability (Article 20) -- you can request your data in a structured, machine-readable format (JSON).
- Right to object (Article 21) -- you can object to processing based on legitimate interests. We will stop unless we have compelling grounds.
- Right to withdraw consent (Article 7(3)) -- where processing is based on consent, you can withdraw it at any time without affecting earlier processing.
How to make a request: Email [email protected] with "Data Request" in the subject line. We will verify your identity and respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk. If you reside in another EU/EEA member state, you may also lodge a complaint with your local supervisory authority.
9. International Data Transfers
Some of our third-party service providers (Stripe, OpenRouter) operate in the United States. When your data is transferred outside the EU/EEA, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Provider-specific data processing agreements with appropriate safeguards
You can request a copy of the relevant safeguards by contacting us at [email protected].
10. Team Agents and Shared Data
If you use a team agent, be aware that:
- Conversation context is shared between all team members connected to the same agent.
- Other team members may see information you share with the team agent as part of the shared context.
- The team administrator is responsible for managing team membership.
Do not share sensitive personal information with a team agent if you do not want other team members to have access to it.
11. Contact Form Data (Website Builder)
When users deploy websites through Agent One that include contact forms, third-party visitors may submit personal data (such as name, email, and message content) through our infrastructure.
- The site owner (the Agent One user who deployed the website) is the data controller for form submission data.
- We act as a data processor on behalf of the site owner for form submissions.
- Form submission data is stored for 90 days and forwarded to the site owner via Telegram.
- Site owners are responsible for informing their visitors about how submitted data is processed.
12. Cookies
The Agent One website (agent-one.org) uses only essential cookies required for the site to function (such as session management during signup). We do not use tracking cookies, analytics cookies, or advertising cookies.
Since we only use strictly necessary cookies, consent is not required under GDPR. If this changes in the future, we will update this policy and implement a cookie consent mechanism.
13. Children's Privacy
Agent One is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
14. Data Breach Notification
In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you without undue delay via Telegram, Discord, or email.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify you by email if the changes significantly affect how we process your data
We encourage you to review this page periodically. Continued use of Agent One after changes are posted constitutes acceptance of the updated policy.
16. Contact Us
If you have any questions about this Privacy Policy, your personal data, or want to exercise your rights, contact us:
Ovk Consulting
CVR: 38284282
Lyngbyvej 438, 2820 Gentofte, Denmark
Email: [email protected]
Website: agent-one.org
For complaints about data protection, you can also contact the Danish Data Protection Agency (Datatilsynet):