This policy explains what personal data Klinworks, LLC ("Klinworks," "we," "us") processes when providing the AgentCEO service (the "Service"), for what purposes, with whom we share it, and what rights you have.
Klinworks is a Delaware (United States) limited liability company, File No. 10704723, with its registered office at 131 Continental Drive, Suite 305, Newark, Delaware 19713.
Privacy contact: privacidad@klinworks.com
1. Two Different Roles, and Why It Matters
We process personal data in two different capacities:
1.1 As a controller, with respect to the data of the people who use the Service: your account, your billing, your support, your use of the platform. We decide what it is used for.
1.2 As a processor, with respect to the data you enter about your own customers, contacts and suppliers. There, you decide: we only process it following your instructions in order to provide the Service to you. You are the controller of that data and are responsible for having a legal basis to process it.
This distinction determines whom a person wishing to exercise their rights should contact: if they are your customer, you; if they are a user of the Service, us.
2. What Data We Process
2.1 Your account data. Full name, email address, phone number (optional), encrypted password, and two-factor authentication factors if you enable it.
2.2 Your organization's data. Company name, brands, team members and their roles, and the configuration of your agents.
2.3 Content you enter. Documents, conversations with the agents, tasks, generated deliverables and everything the Service produces for you.
2.4 Data about your customers and contacts. If you use the customer, sales or support modules, you will process third-party data: name, email, phone number, order history and conversations. We process it as a processor (Section 1.2).
2.5 Integration credentials. When you connect an external system, we store its keys or tokens, always encrypted, together with the identifier and email address of the connected account.
2.6 Billing data. Subscribed plan, credit history and transactions. We do not store full card numbers: payment is processed by a specialized provider.
2.7 Technical data. IP address, browser and device type, timestamps, active sessions and error logs.
2.8 Activity logs. We keep a log of changes to your data so you can audit and restore what your agents did.
2.9 Data from this website (agentceo.io). If you join the waitlist: your email address, the page language, the campaign that brought you (UTM or click parameters), the first page you viewed, the origin of the site that linked to you, your browser (user-agent), your type of business if you tell us, and the version of the privacy notice you saw when signing up. If you request a resource: your email address and the resource. The website's AI assistant does not store your conversations on our servers: they live only in your browser for 7 days; to limit abuse, we count messages per day using a hash of your IP address, without storing the IP address in plain text. This website does not use analytics or advertising cookies.
We do not deliberately process special categories of data (health, ethnic origin, political opinions, biometrics). If you enter them in your content, you do so under your own responsibility and must have a legal basis for it.
3. What We Use It For, and on What Legal Basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service and performing the contract | Performance of a contract (Art. 6(1)(b)) |
| Charging and invoicing | Performance of a contract (Art. 6(1)(b)) |
| Providing support | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Improving the Service with aggregated metrics | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Consent (Art. 6(1)(a)) — revocable |
We never sell your personal data, nor do we disclose it to third parties for their advertising.
4. What We Do NOT Do With Your Data
4.1 We do not train AI models on your content. Neither our own nor third parties'. Our contracts with model providers prohibit them from using the data we send them on your behalf for training.
4.2 We do not read your content for other purposes. We only access it if you ask us to in order to resolve an issue, if required by law, or if it is essential to investigate serious abuse.
4.3 We do not record personal data in our technical logs. Logs store identifiers, not identities: never email addresses, phone numbers or full names.
5. Who We Share Data With (Subprocessors)
To provide the Service, we rely on the following providers. All of them act as processors or subprocessors, under contracts that require them to protect the data and not to use it for their own purposes.
| Provider | Purpose | Data location |
|---|---|---|
| Cloudflare | Hosting of this website, delivery network, protection and the waitlist database | Global (distributed network) |
| Supabase | App database, authentication and storage | United States |
| Stripe | Payment processing | United States |
| Resend | Transactional email delivery (sender agentceo.io) | United States |
| OpenRouter | Routing requests to the language models that run the agents | United States |
| OpenAI | Language models | United States |
| Google (Gemini) | Language models | United States |
| Anthropic | Language models | United States |
| xAI | Language models | United States |
| Deepgram | Speech-to-text transcription | United States |
| ElevenLabs | Voice synthesis | United States / European Union [PENDIENTE verify] |
| Meta (WhatsApp Business Platform) | WhatsApp messaging your agents use with your customers | United States / European Union [PENDIENTE verify] |
The live list, with its change history, is at Subprocessors.
Changes to this list. If we add a new subprocessor that processes personal data, we will update this table and the date of this policy. If you have a data processing agreement with us, we will notify you with the advance notice set out in it.
Other disclosures. We may disclose data to authorities when required by law, and to advisors or acquirers in the context of a corporate transaction, in which case the acquirer will be bound by this policy.
6. International Transfers
Klinworks is located in the United States, and our providers process data there and in other countries. If you are in the European Economic Area, the United Kingdom or Switzerland, those transfers are covered by the Standard Contractual Clauses approved by the European Commission, together with supplementary technical measures: encryption in transit and at rest, and minimization of the data sent.
You may request information about these safeguards at privacidad@klinworks.com.
7. How Long We Retain Data
| Data | Retention |
|---|---|
| Active account and content | For as long as your account is open |
| Content after the account is closed | 30 days to export, then deletion |
| Items in the trash | 30 days, then permanent purge |
| Change log | 30 days |
| Security and access logs | Up to 12 months |
| Billing data | The period required by applicable tax law |
| Integration credentials | Until you disconnect the integration |
Backups follow their own rotation cycle and may retain data for a few additional weeks before being overwritten.
8. Your Rights
Regardless of where you live, you may exercise these rights by writing to privacidad@klinworks.com:
- Access: find out what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete it.
- Restriction: restrict its processing in certain cases.
- Portability: receive it in a structured, commonly used format.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without retroactive effect.
- Non-discrimination: we will not treat you worse for exercising your rights.
Response time: up to 30 days, extendable by another 30 days when the request is complex, with prior notice to you.
Verification: to protect your data, we may ask you to verify your identity before handling the request.
Complaints: if you believe we have not honored your rights, you may lodge a complaint with the supervisory authority in your country. In Spain, this is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).
The specific rights under the GDPR and the CCPA/CPRA are detailed in the GDPR and CCPA Notice.
9. Automated Decision-Making
The Service performs automated actions through AI agents on your business, according to the configuration you set. We do not make automated decisions that produce legal or similarly significant effects on the users of the Service.
If you configure agents that make decisions about individuals — hiring, granting credit, personalized pricing — you are the controller of that processing and must comply with Article 22 of the GDPR and equivalent regulations: provide information, ensure human intervention and allow the decision to be contested. The Terms of Service prohibit doing so without effective human oversight.
10. Security
We encrypt data in transit (TLS) and at rest. Integration credentials are encrypted with keys that not even our technical staff can read from the database. Isolation between organizations is enforced at both the database and application levels.
The details are in the Security Policy.
Breach notification. If a security breach occurs that poses a risk to your rights, we will inform you without undue delay and within a maximum of 72 hours of becoming aware of it, and we will notify the supervisory authority where required.
11. Children
The Service is not directed to individuals under 18 years of age, and we do not knowingly collect their data; in particular, we comply with the U.S. COPPA law with respect to children under 13. If we detect an account belonging to a minor, we will delete it. If you believe a minor has provided us with data, write to us at privacidad@klinworks.com.
12. Cookies
We use only strictly necessary or functional cookies and local storage, as described in the Cookie Policy. There is no analytics or advertising.
12A. U.S. Residents and the GPC Signal
We do not sell or share personal information (as those terms are defined under California law). We honor your browser's Global Privacy Control (GPC) signal as a request to opt out of sale or sharing, and you can make the same request at Do Not Sell or Share My Personal Information. Details for California are in the Notice to California Residents and, for other states, in Privacy Rights in Other U.S. States.
13. Changes to This Policy
We may update it. If the change is material — a new purpose, a subprocessor that processes personal data, a longer retention period — we will notify you by email or within the Service at least 30 days in advance. The date in the header always indicates the latest version.
Contact
Klinworks, LLC 131 Continental Drive, Suite 305 Newark, Delaware 19713, United States Delaware File No. 10704723
- Privacy and data: privacidad@klinworks.com
- Legal matters: legal@klinworks.com
- Security: security@klinworks.com