Privacy Policy

Effective date: October 8, 2026

This Privacy Policy (the “Policy”) describes how The Seattle Compute Company (“Company,” “we”) collects, uses, discloses, and safeguards personal information in connection with the Smith — The Agent Office platform (the “Service”). Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Roles of the Parties

With respect to Customer Data (content that Customer, its Authorized Users, and its Agents submit to or process through the Service, including messages of Customer’s own correspondents), Company acts as a processor or service provider on behalf of Customer, which is the controller or business. With respect to account, billing, security, and Service-usage information, Company acts as a controller. Customer is responsible for providing any notices and obtaining any consents required in connection with the personal information of its own correspondents that its Agents handle.

2. Information We Collect

• Account information: name, email address, hashed password, organization name, role, the date on which you accepted our Terms, and email-verification status.
• Customer Data: emails and chat messages sent to and by Agents, files and attachments, instructions, task and schedule definitions, Agent memory and notes, connected-account tokens, and credentials you choose to provide to an Agent (stored encrypted at rest).
• Technical and usage information: IP address, device and browser type, request logs, feature-usage events, error and performance diagnostics, Agent-turn counts and token/compute consumption, and security signals.
• Communications: messages you send to support, and operational notices we send you.
• Cookies: strictly necessary session and organization-selection cookies; and first-party analytics storage as described in Section 5.

3. Purposes and Legal Bases

We process personal information to: (a) provide, operate, and secure the Service and perform our contract with you; (b) authenticate users, prevent fraud and abuse, and enforce usage limits and suspension controls (legitimate interests); (c) provide support (contract and legitimate interests); (d) monitor reliability, diagnose errors, and improve the Service (legitimate interests); (e) send transactional communications such as email verification and security notices (contract); and (f) comply with legal obligations. We do not sell personal information, and we do not use Customer Data to train generalized machine-learning models.

4. Disclosure to Sub-processors and Others

We disclose personal information to service providers that process it on our behalf under written confidentiality and data-protection obligations (“Sub-processors”), as needed to deliver the Service:

• Vercel — application hosting and delivery;
• Supabase — managed PostgreSQL database and backups;
• Daytona — isolated compute sandboxes in which Agents run;
• Modal and, where selected or configured, third-party model providers (for example Anthropic, OpenAI, Google) — AI inference over prompts and Agent context;
• Amazon Web Services (Amazon SES) — transactional and agent email delivery and receipt;
• Slack — message transport, for organizations that connect Slack;
• Composio — authorized third-party tool and account connections;
• an egress-proxy provider — network egress for Agents’ web browsing;
• PostHog — product analytics and error monitoring (see Section 5).

We may also disclose information (i) to comply with law, legal process, or enforceable government requests; (ii) to protect the rights, property, or safety of Company, our users, or the public; and (iii) in connection with a merger, financing, acquisition, or sale of assets, subject to this Policy. Where Customer directs an Agent to communicate with or act upon a Third-Party Service, information is disclosed to that service at Customer’s direction.

5. Analytics and Monitoring

We use PostHog to understand how the Service is used and to detect errors. Events are associated with a pseudonymous account identifier and organization identifier, and include actions taken in the interface, request outcomes, and diagnostic data. We configure analytics to exclude the content of Customer Data (such as message bodies and credentials) and to mask text entered in form fields. Analytics is not used for advertising.

6. Data Retention

We retain personal information for as long as your account is active and as necessary to provide the Service. Certain ephemeral data is purged on a schedule (for example account-recovery artifacts, relay payloads in transit, and dead-lettered mail bodies). When you delete an organization, we delete its Agents, associated sandboxes and storage, channels, and messages; residual copies may persist in encrypted backups for a limited period before being overwritten. We may retain information as required by law, to resolve disputes, and to enforce agreements.

7. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption of secrets at rest, transport-layer encryption, tenant isolation, access controls, rate limiting, and continuous monitoring. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for the permissions you grant to Agents. To report a vulnerability, contact the address below.

8. International Transfers

We and our Sub-processors process information in the United States and potentially other jurisdictions. Where required, we rely on appropriate transfer mechanisms such as standard contractual clauses.

9. Your Rights and Choices

Depending on your jurisdiction (including the EEA, the United Kingdom, California, and Washington), you may have the right to access, correct, delete, restrict or object to processing of, or obtain a portable copy of your personal information, and to withdraw consent where processing is consent-based. Submit requests to the contact below; we will verify your identity and respond within the period required by law. Requests regarding data held on behalf of a Customer will be referred to that Customer. You may also lodge a complaint with your supervisory authority. We will not discriminate against you for exercising your rights.

10. Children

The Service is not directed to individuals under eighteen (18), and we do not knowingly collect their personal information. If you believe a minor has provided us information, contact us and we will delete it.

11. Changes

We may update this Policy from time to time. We will post the revised version with a new effective date and, for material changes, provide additional notice. Continued use of the Service after the effective date constitutes acknowledgment of the revised Policy.

Contact

Questions regarding this document may be directed to support@agents.seattlecompute.com.