Privacy Policy

Effective date: February 27, 2026

1. Who We Are

AgentBridge is a platform that makes APIs agent-ready. We provide a hosted web app, CLI, and MCP tooling so users can connect APIs, authenticate where required, and interact using natural language.

2. Data We Collect

We collect data in the following categories:

  • Account data: if authentication is enabled, your account identifier and login metadata.
  • API registry data: API names, descriptions, manifests, OpenAPI specs, ownership, visibility settings.
  • OAuth session data: temporary OAuth state, PKCE verifier, redirect URI, and expiry during OAuth flows.
  • Credential vault data: encrypted API credentials/tokens stored per user and API when vault is configured.
  • Usage analytics: API event telemetry such as manifest fetches, chat usage, action calls, timestamps, user agent, and optional hashed IP.
  • Operational logs: service health and error logs required to run and secure the platform.

3. Data We Do Not Collect by Default

  • We do not require users to store LLM API keys server-side; users can bring their own key in session.
  • We do not claim ownership of third-party API data returned through connected APIs.

4. How We Use Data

  • To provide core functionality: API registration, discovery, chat execution, OAuth connection, and tool calling.
  • To secure and operate the service: fraud prevention, abuse detection, troubleshooting, and reliability improvements.
  • To provide product analytics: aggregate usage stats and API-level performance insights.
  • To comply with legal obligations and enforce our terms.

5. Credential Security

When credential vault is enabled, credentials are encrypted at rest using AES-256-GCM with a server-side encryption key. Decryption is performed only as needed to execute user-requested calls. Operators are responsible for managing and rotating encryption keys safely.

6. OAuth and Connected Services

If you connect services such as Spotify, Gmail, or Google Calendar, AgentBridge processes OAuth tokens/scopes needed to perform authorized actions on your behalf. Your use of those services is also governed by the respective provider’s terms and privacy policies.

7. Third-Party Processors

Depending on user configuration, requests may be sent to third-party providers including LLM vendors and API providers selected by the user. We only forward data necessary to complete the requested operation.

8. Data Retention

  • OAuth sessions are short-lived and automatically expire.
  • Credential records remain until user deletion, owner removal, or key mismatch cleanup.
  • Analytics and operational logs are retained as needed for operations, security, and product improvement.

9. User Controls

  • You can disconnect integrations by removing stored credentials.
  • You can delete APIs you own and control their visibility where ownership rules apply.
  • You can choose whether to provide credentials in-session or store them in the vault (when available).

10. International Data Transfers

AgentBridge may process data in regions where hosting providers or integrated services operate. By using AgentBridge, you acknowledge that connected service data may cross borders depending on provider infrastructure.

11. Children’s Privacy

AgentBridge is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

12. Changes to This Policy

We may update this policy to reflect product, legal, or operational changes. The effective date above indicates the current version.

13. Contact

For privacy inquiries, contact: [email protected] or join our support channel on Discord.