What we hold, where it goes, and who sees it.

What we hold

• Your accountThe email address you sign in with, and which teams you belong to.
• The governance you authorPlaybooks, rules, allowed actions and the parameters they take, with the history of who changed them.
• The work you send inRequests, their content, and the classification the engine produced for each.
• DecisionsProposals, approvals, declines, and the receipts and audit records that record them.
• ConnectionsThe endpoint URL you register and its signing secret, so requests to your system can be signed, or the MCP server address and the access token you give us.
• QuickBooks Online, if you connect itThe access granted when someone authorises a QuickBooks company, and the bills and vendors read from it for a review. What that covers is set out below.
• Microsoft 365, if you connect itWhich Microsoft 365 organisation an administrator connected and who connected it, and the users, licences and groups an agent reads to do its work. What that covers is set out below.
• Shopify, if you connect itThe access granted when an owner installs conxtagents on a store, and the order and product details an agent reads to cancel or refund an order. What that covers is set out below.

If you ask us to act on your own system, whatever you put in a request reaches us: a customer’s email address, an account reference, a plan name. We hold it because the agent has to classify it and the receipt has to be checkable afterwards.

Where it is held, and who processes it

These are the services your content actually passes through.

• SupabaseThe database, in the US West region. Accounts, teams, playbooks, requests, proposals and audit records live here.
• RailwayHosts the engine that classifies, proposes and executes.
• VercelHosts this site and the dashboard.
• OpenAIEmbeds your content for search and, where it is turned on, classifies incoming requests.
• AnthropicRuns the agent: the agent chat, planning and choosing a playbook’s steps, and extracting structure from what you import. And, only for a client whose owner turns it on, two things in QuickBooks: suggesting and checking expense categories, and reading bills and vendors so the agent can answer and work in the chat (both below).
• ResendSends and receives email: requests that arrive by email, approval notices, replies to requesters, and the pricing-page form.
• ElevenLabsOnly for an agent whose owner sets up its voice: hearing what you say and speaking what the agent answers. What that covers
• IntuitOnly if you connect QuickBooks Online: the authorisation happens on Intuit’s own sign-in page, and the records we read come from Intuit’s API.
• MicrosoftOnly if you connect Microsoft 365: an administrator grants access on Microsoft’s own page, and what we read and change goes through Microsoft Graph.
• ShopifyOnly if you connect a store: the install happens on Shopify’s own page, and orders and products are read through Shopify’s API.

When content is embedded, extracted or answered, it is sent to the provider named above for that purpose. We do not train models on your content, and we have no arrangement that would let us.

If you talk to an agent

An agent has no voice until an owner sets one up for it, and we record who did and when. From then on a signed-in member can press Talk and speak to that agent. This is what happens.

• ElevenLabs hears and speaksThe audio of what you say, and the words the agent answers with, pass through ElevenLabs, which turns speech into text and text into speech. The answers themselves come from conxtagents: ElevenLabs is not given access to your connected systems and decides nothing.
• What is in the agent’s answersWhatever it would have typed in the chat, said aloud. That can include what it looked up for you in a connected system, such as a colleague’s name or which licences are free.
• Only the person signed inA voice conversation is opened for the member who pressed Talk. The agent is not given anything to look up, and cannot start work, for a voice it cannot tie to a signed-in member.
• If you call by phoneWhere an agent has a phone line, a member can list the phone they call from. We keep that number. When a call comes from it, we text the phone a one-time code through Twilio and the agent helps only once the code is read back, because a caller’s number alone can be faked. We keep a scrambled form of the code, never the code. A call from a number nobody listed is told nothing about your company.
• If an agent calls someone for youAn owner can give an agent a script, and a person can then have it call one number. Each call is approved by a person before it is dialled, and it opens by saying it is an AI agent and who it is calling for. The call is placed through ElevenLabs and Twilio. We keep the number called, the script used, who approved it, and, once the call ends, the text of what was said and a short summary. We do not keep a recording. On the call the agent knows the script and nothing else about your company. Deciding who may be called is yours: we do not check consent or do-not-call lists.
• Nothing is approved by voiceSaying yes approves nothing. A change the agent puts in waits under Approvals for a person, as it does when typed.
• What we keepThe text of what was asked and answered, in the conversation on your screen, and the ordinary record of any request the agent started. We do not keep a recording. ElevenLabs may keep its own records of a conversation under its terms; ask us and we will tell you how that is currently set.

If you connect QuickBooks Online

QuickBooks is in a limited pilot. A person with the right to do so authorises one QuickBooks company on Intuit’s own page; we never see their Intuit password. From then on this is what happens.

• We read, and make six kinds of changeDuring the pilot we read the company’s details, its bills, its vendors, its accounts and its expenses, to review them. We can make six changes, each only when the client’s playbook allows it and a person approves that change. On a bill a review flagged: a note, such as “possible duplicate of bill 1043”: written by conxtagents from the finding and appended to the bill’s memo with what was there kept. Or a fixed miscoded bill: one line’s expense category, changed to the one that vendor’s other bills use, after we check in QuickBooks that the line is still as the review saw it. Nothing else on the bill changes. And a new bill entered from a vendor’s invoice, from the details a person types in: one expense line, after we check that the vendor is active and that this invoice is not already in QuickBooks. And a payment already made, recorded against one bill by an owner of the agent: from a bank or credit card account, for no more than the bill owes, and only if its balance has not changed since it was approved. Recording a payment moves no money. And an expense sitting in Uncategorized Expense or Ask My Accountant, moved into a category: the one that payee’s other expenses use, or one a person chooses, after we check it is still uncategorized. And one deletion: a bill a review found as a possible duplicate, deleted when an owner of the agent confirms it by typing its number, only if it is wholly unpaid and still matches the bill kept. QuickBooks cannot restore a deleted bill, so we keep the bill as it was with the record of the deletion. We read every change back afterwards to prove it. We delete nothing else, void nothing, and do not read invoices with an AI model. Intuit’s accounting permission is broader than that; the limit is ours, enforced in our code.
• Rules, not a model, unless you turn AI onThe pilot’s bill checks are fixed rules, such as the same vendor and amount appearing twice. Bill and vendor records are not sent to OpenAI, and are not sent to Anthropic unless an owner turns on one of the two switches described here, for one client at a time. An owner can turn on AI suggestions for one client, for expenses with no clear history and to check a category a person picks: then, for that client only, Anthropic is sent each such expense’s payee name, line description, amount and date, and the company’s expense category names. Never bank or card details or balances. The AI only suggests; a person approves every change, and turning it off stops it.
• The agent reading the books in the chat, if you turn it onAn owner can let the agent read one client’s QuickBooks records so it can answer questions and do work in the chat, such as which of a vendor’s bills are unpaid. It is off for every client until an owner turns it on, and we record who did and when. Then, for that client only, when someone asks, Anthropic is sent each matching bill’s number, vendor, dates, total, balance owed and the start of its memo, and each matching vendor’s name and what is owed to it, what a review found about them, and each uncategorized expense’s payee, description, amount and date, with your expense category names. Never bank or card details, account numbers, tax ids or addresses. The agent only reads this way. It can suggest a category for an uncategorized expense, which a person then approves or changes; it never makes a change itself. Each look is written to the audit trail, and turning the switch off stops it.
• What a review keepsEach review keeps the fields it checked, such as vendor, amount, dates and bill number, with what it found and what a reviewer decided. That is how a finding can be checked later against what QuickBooks said at the time.
• The access itselfIntuit’s access tokens are encrypted before they are stored, are never sent to a browser, and are never written to a log.
• DisconnectingYou can disconnect from conxtagents or from QuickBooks itself. Either way we revoke the access with Intuit and delete the stored tokens, so nothing more is read.
• Deleting what was readAsk at the address below and we delete the bills and vendors we hold for that company. The review records follow the audit-trail rule further down this page: we will tell you which ones hold which fields before you decide.

If you connect Microsoft 365

An administrator of the organisation grants conxtagents a fixed set of permissions on Microsoft’s own page, and then signs in so we know who connected it and that they are allowed to. We never see a Microsoft password.

• What we can reachUsers, licences, group membership and a user’s sign-in methods. We ask for nothing that reaches mail, files, calendars or chats, so we cannot read them.
• What an agent readsWhether a user exists, which licences the organisation has free, which groups a user is in, and which sign-in methods they have.
• What an agent can changeCreate a user, assign or remove a licence, add a user to a group or remove them from one, set up a first sign-in pass, remove sign-in methods, and block sign-in. Each only when the client’s playbook allows it and a person approves it, or an owner has let that action run on its own. Nothing deletes a user. We read every change back from Microsoft 365 before the receipt says it happened.
• The first passwordA new user’s first password is random and must be changed at first sign-in. It is never returned to us, stored or logged.
• What we keepThe organisation’s id and who connected it. No secret is stored for each organisation. Each change’s receipt keeps what was approved, such as a name and a sign-in address, and what Microsoft 365 showed afterwards.
• DisconnectingAn owner can disconnect in conxtagents, and every agent stops acting in that organisation at once. To withdraw the permissions themselves, an administrator removes conxtagents under enterprise applications in Microsoft Entra.

If you connect Shopify

An owner of the agent installs conxtagents on one store, on Shopify’s own page; we never see a Shopify password. We ask Shopify for two permissions only: to read products, and to manage orders.

• We read orders and products, and make two kinds of changeAn agent reads an order’s number, status, totals, payments, refunds and line items, and a product’s title, status, stock and variants. It can cancel an order that has not been fulfilled, and refund an amount of an order to how it was paid, each only when the agent’s playbook allows it and a person approves that change. A cancellation’s approval says whether it refunds, restocks and tells the customer. We read every change back from Shopify afterwards before the receipt says it happened, and a refund is never sent twice.
• No customer detailsWe do not ask Shopify for a customer’s name, address, email address or phone number, so we never hold them.
• What we keepFor each refund: the order’s id, the amount, the currency, Shopify’s refund id and what became of the payment, so that no refund can be made twice. Each change’s receipt keeps what was approved and what Shopify showed afterwards.
• The access itselfShopify’s access tokens expire and are replaced as they are used. They are encrypted before they are stored, are never sent to a browser, and are never written to a log.
• Disconnecting or uninstallingDisconnecting in conxtagents, or uninstalling the app in Shopify, stops every agent acting in the store and deletes its stored tokens at once.
• Erasure requestsWhen Shopify passes on a customer’s request to see or erase their data, or a store’s request to erase its data, we record it and complete it within 30 days. A store’s request erases its refund records. Ask at the address below to know exactly which records hold which details before anything is deleted.

What we refuse to store

Content is scanned before it is written. If it contains something that looks like a live credential, the capture is blocked outright rather than stored and cleaned up afterwards. A signing secret you register is held so requests to your endpoint can be signed, and it is never returned to a browser or written to a log.

No analytics, no tracking

This site loads no analytics, no third-party scripts and no tracking cookies. Nothing here measures you. The only cookie is the session that keeps you signed in after you follow a sign-in link.

One file does come from somewhere else: the typeface of our name is served by Fontshare. Your browser asks Fontshare for it, so Fontshare sees your IP address and browser, as any site you visit does. It sets no cookie here and receives nothing about what you do on this site.

The lead form on the pricing page stores what you type into it and emails it to us, so we can reply. That is all it does.

Asking us what we hold, or to delete it

Write to hello@conxtagents.com. We will tell you what we hold about you and delete it on request. We are small enough that this is a person reading your email rather than a form, and we would rather you ask than guess.

One exception, and it is deliberate rather than convenient. The audit trail is append-only: nothing in conxtagents edits or removes an approval, a decline or the receipt for it, and we do not either, because a record that can be quietly changed afterwards is not a record. Where one of those names a person, the naming survives a deletion request even once the account and the work around it are gone. If that matters for your case, say so when you write and we will tell you which records hold what before you decide.

What this page does not yet say

We do not have a published retention schedule or a standard data processing agreement to hand you today. If you need either before you can use conxtagents, say so and we will work through it with you directly rather than point you at a document that does not exist.