Chapter I — General provisions
This Privacy Policy covers the processing of personal data in connection with Agent Barn, operated by UAB "Taikomasis dirbtinis intelektas" (company code 304845429, registered office at Architektų g. 9, Lazdijų k., Lazdijų r., Republic of Lithuania) ("AAI Labs", "we"). It supplements the AAI Labs company Privacy Policy at www.aai-labs.com/en/privacy-policy. Where the two differ on a matter specific to Agent Barn, this policy prevails. We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Lithuanian law.
Agent Barn comes in several forms, and this policy covers each of them:
- The website at agentbarn.dev, including the documentation, blog and Agent Readiness Benchmark.
- Agent Barn Cloud, a hosted control plane we operate at cloud.agentbarn.dev. A company (the "Customer") uses it to run AI agents that work in its chat tools and business systems.
- The Personal Agent, an individual subscription for a personal agent on Telegram.
- Supervised pilots, in which our team scopes one workflow with a Customer and deploys an agent for it.
- The open-source software, which anyone can run on their own infrastructure (Chapter VIII).
Chapter II — Controller and processor roles
Different people's data is processed under different roles. Which role applies to you determines how you exercise your rights.
- Website visitors, people who contact us, Cloud account holders and Personal Agent subscribers. AAI Labs is the controller of website, enquiry, account, billing and platform-security data. For the Personal Agent, we are also controller of the content the agent processes for you.
- People whose data is processed by a Customer's agents. This covers the Customer's staff, and the colleagues, clients and correspondents whose messages, emails, documents or records an agent handles. The Customer is the controller and AAI Labs acts as processor, acting only on the Customer's documented instructions under a data processing agreement ("DPA"). The Customer decides which agents run, which channels and systems they can reach, and on what lawful basis. The same applies to pilots.
- Self-hosted installations. The operator of the installation is the controller. AAI Labs neither receives nor processes that data (Chapter VIII).
Chapter III — Website and enquiries
Forms. When you use the forms to join a pilot, join the Cloud pilot, book a call or request your benchmark report, we collect what you enter: name, company, role and work email. If you arrived through the Agent Readiness Benchmark, the form also sends your benchmark answers and the links to your report. Form submissions are delivered to us through Formspree. We use them to answer your enquiry and to discuss a possible engagement. The legal basis is taking steps at your request before entering a contract, or our legitimate interest in responding to business enquiries (Article 6(1)(b) and 6(1)(f) GDPR).
Agent Readiness Benchmark. Your answers are scored in your browser. A results link encodes your answers in its address, so anyone you share the link with can see that result. We receive your answers only if you submit a form or, with your consent, as part of analytics (Chapter IX).
Retention. We keep enquiries for as long as the commercial conversation is active and for up to 24 months after our last contact, unless they become part of a contract. Contracts follow the retention periods for contractual and accounting records.
Chapter IV — Agent Barn Cloud: account and platform data
What is processed.
- Account data: name, email address, a bcrypt hash of your password, email verification status, and your organisation memberships and roles.
- Session data: refresh tokens, personal API keys (we store only a hash), and records of when tokens and keys were last used.
- Operational emails we send you, such as invitations, password resets, verification, agent lifecycle notices and budget alerts.
- Security audit records of significant actions, such as changes to access, credentials, agents and organisations. These record who acted, what changed and when.
Basis. We process account data to provide the service you or your organisation signed up for (Article 6(1)(b) GDPR). We process session and security data in our legitimate interest in keeping the platform secure and accountable (Article 6(1)(f)).
Retention. Account data is kept while your account exists and deleted when an organisation administrator or we remove it. Security audit records are kept after the related user, agent or organisation is deleted, because their purpose is to show what happened afterwards. They keep only the identifiers and display names needed for that purpose.
Chapter V — Agent Barn Cloud: agent data (processor)
What is processed. Depending on how the Customer configures its agents:
- Conversation data. Messages exchanged with an agent in the channels the Customer connects (Slack, Microsoft Teams, Discord, Telegram, email and web chat), including the sender's name and identifier, the channel or thread, and timestamps.
- Tool activity. A record of each action an agent takes in a connected system, including the arguments sent and the result returned.
- Connected-system data. Content an agent reads or writes in systems the Customer authorises. Examples include Google Workspace (Gmail, Calendar, Drive, Sheets), Microsoft SharePoint, Jira, Confluence, GitHub, Bitbucket, Pipedrive, HubSpot and Zoho. An agent can reach only the accounts, scopes and resources the Customer connects to it.
- Agent workspace. Files an agent keeps in its own workspace volume, and any restore points the Customer takes of that workspace.
- Usage and cost records. Model, token counts and spend for each agent and organisation. We do not keep the content of model requests in these records.
Role and basis. The Customer is controller. It determines the purpose and lawful basis, including any notice owed to its staff and to third parties whose messages its agents handle. AAI Labs processes this data only to run the Customer's agents and provide the platform. We do not use it to train models, and we do not use it for our own purposes.
Credentials. Credentials for connected systems are encrypted at rest. Each one is released only to the agent it belongs to, and only while that agent runs.
Incidental special-category data. People may share information covered by Article 9 GDPR in conversations with an agent. The Customer is responsible for the lawful basis of that processing and for configuring its agents appropriately.
Retention. Agent data is kept while the Customer's organisation is active, or for a shorter period the Customer instructs. Deleting an agent stops it and erases its workspace, restore points and credentials. Its conversation and activity history remains available to the organisation until the Customer asks for it to be erased or the organisation is closed. At the end of the service, we delete or return agent data on the Customer's instruction, as set out in the DPA.
Chapter VI — The Personal Agent
The Personal Agent works for you through Telegram and the accounts you connect, such as your email. It processes your Telegram messages with the agent, the content of the emails and other sources it triages or researches for you, and your subscription and payment records.
AAI Labs is controller. We process this data to provide the service you subscribed to (Article 6(1)(b) GDPR) and for no other purpose. Your mailbox may contain other people's personal data. We process it only to perform the triage you asked for. The agent reads only the accounts you connect, and you can disconnect them at any time. When you cancel, we delete your agent's data within 30 days, except billing records we must keep by law.
Chapter VII — AI models and sub-processors
Agents use third-party large language models. Model traffic passes through a gateway we operate, which routes each request to OpenRouter. OpenRouter forwards it to the provider of the model the Customer selects. The content of a request, which may include personal data from conversations and connected systems, is sent to those providers so the model can answer it. The Customer chooses which models its organisation may use.
We rely on the following categories of sub-processor:
- Hosting: Agent Barn Cloud runs on servers we operate in data centres provided by Hetzner Online GmbH in Germany.
- Network, security and email: Cloudflare, for DNS, website hosting, traffic protection, and inbound and outbound email.
- AI models: OpenRouter and the model providers it routes to.
- Chat platforms and business systems: the services the Customer chooses to connect, each under that service's own terms with the Customer.
- Website forms and analytics: Formspree and PostHog.
- Payments: the payment service provider used for a given purchase, where one is used (Chapter X).
We keep a current list of named sub-processors in our processing records. It is available on request.
Chapter VIII — Self-hosted Agent Barn
Agent Barn is open-source software under the Apache License 2.0. When you run it on your own infrastructure, you are the controller of everything it processes. The software does not send usage telemetry, conversations or other content to AAI Labs.
When your installation downloads container images from our registries, our servers receive the standard request data (such as IP address and the image requested). We use it only to deliver and secure those downloads. Your installation's model traffic and integrations go to the providers you configure, not to us.
Chapter IX — Cookies and analytics
Cookies are small text files a website stores on your device. Similar technologies, such as browser local storage, work the same way. This chapter describes what agentbarn.dev and cloud.agentbarn.dev use. We do not use advertising or marketing cookies, and we do not sell personal data.
Website: strictly necessary
These are needed for the site to work and stay secure. They do not require consent.
| Name | Purpose | Provider | Duration |
|---|---|---|---|
__cf_bm | Bot detection to protect the site. Set only when Cloudflare's protections apply. | Cloudflare | ~30 minutes |
cf_clearance | Records that a visitor passed a security challenge. Set only if a visitor is challenged. | Cloudflare | Up to 24 hours |
agent-barn-cookie-consent-v1 | Remembers your analytics choice. | Agent Barn (local storage) | Until cleared |
agent-barn-benchmark-lead-v1 | Remembers your benchmark visit so a form you submit can include your report link. | Agent Barn (local storage) | 30 days |
Website: analytics
We use PostHog, hosted in the EU, to understand how the site is used. It runs in one of two modes, depending on your choice in the cookie banner.
Without consent (the default). PostHog runs in cookieless mode and stores nothing on your device. It records page views and page exits, and a small set of named events: opening or submitting a pilot form, starting or completing the readiness benchmark (with the score, level and workflow), and documentation searches. Visits are counted with a short-lived identifier derived on PostHog's servers, which cannot be used to recognise you across days. Automatic click capture is switched off. The basis is our legitimate interest in measuring and improving the site (Article 6(1)(f) GDPR). Information on your device is neither stored nor read.
With consent. If you choose "Accept analytics", PostHog stores the identifiers below so it can recognise you across visits, and session replay is enabled. Session replay records how you move through and interact with pages. If you then submit a form, your email address, name, company and role are linked to your analytics record, so we can connect an enquiry to the visit it came from. The basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with Cookie settings in the site footer. Withdrawing deletes the identifiers and returns the site to cookieless mode.
| Name | Purpose | Provider | Type | Duration |
|---|---|---|---|---|
ph_phc_…_posthog | Anonymous device ID, session ID and feature-flag state. | PostHog | Cookie | ~12 months |
ph_phc_…_posthog | The same values, held in browser storage. | PostHog | Local storage | Until cleared |
In both modes, PostHog receives standard technical data, from which it derives your approximate location (country, region, city), browser, operating system, device type, referring page, page address and any campaign tags in the link you followed.
Agent Barn Cloud
The Cloud application uses only strictly necessary storage. It has no analytics or advertising cookies.
| Name | Purpose | Type | Duration |
|---|---|---|---|
refresh_token | Keeps you signed in. HttpOnly and Secure. | Cookie | 15 days |
sidebar_state | Remembers whether the navigation sidebar is open. | Cookie | 7 days |
org-storage | Remembers the organisation you last selected. | Local storage | Until cleared |
Chapter X — Payments
Supervised pilots are invoiced directly. Personal Agent subscriptions are charged through the payment service provider shown at checkout. That provider processes your card or bank details under its own terms and privacy policy. We do not receive or store full card numbers. We keep transaction records (amount, date, plan, billing name and address, and invoice details) to provide the service and to meet accounting and tax obligations (Article 6(1)(b) and 6(1)(c) GDPR). We keep them for the period Lithuanian accounting law requires.
Chapter XI — Transfers outside the EU
Some of our sub-processors, including model providers reached through OpenRouter, Formspree and some services a Customer connects, may process data outside the European Economic Area. Where they do, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on standard contractual clauses with supplementary measures where needed, in line with Articles 44–49 GDPR.
Chapter XII — Disclosure to third parties
We share personal data only with:
- sub-processors, under written agreements and only as far as needed to provide the service;
- the Customer, for data we process on its behalf as processor;
- payment service providers, for purchases they process;
- professional advisers, or a successor in a merger or acquisition, under confidentiality obligations;
- competent authorities, courts or law enforcement, where the law requires it.
Chapter XIII — Security
We protect personal data with measures that include encryption in transit, encrypted storage of integration credentials, hashed passwords and API keys, role-based access within organisations, per-agent isolation, and audit records of administrative actions. Platform administrators can manage organisations without being able to read their conversations unless granted access. You can report a vulnerability as described in the Agent Barn security policy.
Chapter XIV — Your rights
Under the GDPR you have the right to be informed, and the rights of access, rectification, erasure, restriction, objection and portability. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.
Where to send a request depends on our role. If we are the controller (website, enquiries, Cloud accounts, the Personal Agent, billing), contact us directly. If your data is processed by a Customer's agent, contact that organisation, as it is the controller. We will help it respond, and we will forward to it any request we receive about its data.
We respond within one month. For complex or numerous requests, we may extend this by two further months. You may complain to the State Data Protection Inspectorate of the Republic of Lithuania, to your local supervisory authority, or to a court.
Chapter XV — Changes to this policy
When this policy changes, we publish the new version here and update the date at the top. If a change materially affects Cloud Customers or Personal Agent subscribers, we notify them by email before it takes effect.
Chapter XVI — Contact
Send questions or requests about personal data in connection with Agent Barn to [email protected]. So we can identify you, please send email requests with an electronic signature, or from the email address linked to your account. If you have questions about why an organisation's agent processed your data, contact that organisation.