What we hold, where it goes, and who sees it.

What we hold

• Your accountThe email address you sign in with, and which teams you belong to.
• The governance you authorPlaybooks, rules, allowed actions and the parameters they take, with the history of who changed them.
• The work you send inRequests and tickets, their content, and the classification the engine produced for each.
• DecisionsProposals, approvals, declines, and the receipts and audit records that record them.
• ConnectionsThe endpoint URL you register and its signing secret, so requests to your system can be signed.

If you ask us to act on your own system, whatever you put in a request reaches us: a customer’s email address, an account reference, a plan name. We hold it because the agent has to classify it and the receipt has to be checkable afterwards.

Where it is held, and who processes it

These are the services your content actually passes through.

• SupabaseThe database, in the US West region. Accounts, teams, playbooks, tickets, proposals and audit records live here.
• RailwayHosts the engine that classifies, proposes and executes.
• VercelHosts this site and the dashboard.
• OpenAIEmbeds your content for search, and answers in the agent chat. Today the models are text-embedding-3-small and gpt-4o-mini.
• AnthropicExtracts structure from what you import. Today the model is claude-sonnet-4-6.

When content is embedded, extracted or answered, it is sent to the provider named above for that purpose. We do not train models on your content, and we have no arrangement that would let us.

What we refuse to store

Content is scanned before it is written. If it contains something that looks like a live credential, the capture is blocked outright rather than stored and cleaned up afterwards. A signing secret you register is held so requests to your endpoint can be signed, and it is never returned to a browser or written to a log.

No analytics, no tracking

This site loads no analytics, no third-party scripts and no tracking cookies. Nothing here measures you. The only cookie is the session that keeps you signed in after you follow a sign-in link.

The lead form on the pricing page stores what you type into it, so we can reply. That is all it does.

Asking us what we hold, or to delete it

Write to hello@conxtagents.com. We will tell you what we hold about you and delete it on request. We are small enough that this is a person reading your email rather than a form, and we would rather you ask than guess.

One exception, and it is deliberate rather than convenient. The audit trail is append-only: an approval, a decline and the receipt for it cannot be edited or removed, because a record that can be quietly changed afterwards is not a record. Where one of those names a person, the naming survives a deletion request even once the account and the work around it are gone. If that matters for your case, say so when you write and we will tell you which records hold what before you decide.

What this page does not yet say

We do not have a published retention schedule or a standard data processing agreement to hand you today. If you need either before you can use conxtagents, say so and we will work through it with you directly rather than point you at a document that does not exist.