Privacy Policy

Effective date: September 17, 2026

Reducibl (“we,” “us,” or “our”) operates the Agentic Control Plane website (agenticcontrolplane.com) and the GatewayStack platform, including associated cloud services, documentation, and open-source tooling. This Privacy Policy describes how we collect, use, and protect your information when you use our services.

1. Information We Collect

Information you provide

• Account information. When you create an account for Agentic Control Plane Cloud, we collect your name, email address, and organization name. Authentication is handled by Firebase Authentication; we do not store passwords.
• Contact information. When you email us or submit a form, we collect the information you provide (name, email, message content).
• Payment information. If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store credit card numbers or bank account details on our servers. Stripe receives your payment method details, billing address, and email. See Stripe’s privacy policy.

Information collected automatically

• Analytics data. We use Plausible Analytics (self-hosted at analytics.reducibl.com) to collect anonymized usage statistics. Plausible does not use cookies, does not track individuals across sites, and does not collect personal data. We also use PostHog for product analytics, joining marketing-site visits with product sign-ups; PostHog sets a cookie (its default, cross-subdomain) and records pageviews and in-page events, tagged by product and surface rather than by name or email unless you’re a signed-in, identified user of the product itself. Neither tool is used on previews or localhost.
• Server logs. Our infrastructure providers (Google Cloud Platform, Firebase) may collect standard server logs including IP addresses, request timestamps, and HTTP metadata. These logs are used for security monitoring and debugging, and are retained for up to 30 days.

Information processed through GatewayStack Cloud

If you use Agentic Control Plane Cloud (our managed gateway service), the gateway processes API requests on your behalf. This includes:

• API request metadata. Tool name, user identifier, timestamp, latency, and success or failure status. This metadata is stored in audit logs.
• Session transcript usage. On harnesses that pass a transcript path to hooks (Claude Code does), the hook reads the local session transcript file — at most 2 MB per call — and sends, for each completed model turn, the model id, the message id, its timestamp and the token counts (input, output, cache read, cache creation). Message text is never extracted from that file or sent. These counts are used to estimate model cost for sessions not launched through an ACP launcher; that cost is an estimate at API list rates, not a metered charge. For sessions launched through an ACP launcher the transcript is not read.
• Request and response content. The gateway processes request arguments and response payloads in memory to execute tool calls. By default, request and response content is not stored: the audit record holds metadata only (tool name, acting identity, policy decision, timestamps, latency, token counts, cost, harness, working directory, session and call identifiers, the agent name, task label and delegation chain the harness reports, the user’s email, the human-readable reason for the decision, and for web tools the hostname; where PII scanning is enabled, the PII types detected — never the matched values). Workspace administrators may enable truncated input/output previews in audit logs from the console’s Logging page; when enabled, previews are limited to 1,500 characters, and where the workspace policy is set to redact or block, PII found by the scan is removed from the decision record before storage.
• Approval requests. When a policy requires a human to approve an action, up to 500 characters of that action’s arguments are stored with the approval request so the approver can see what they are approving. This preview is not PII-redacted, is included in the approval notification sent to approvers, and is kept with the request record until the workspace is deleted.
• OAuth tokens. When you connect third-party services (such as GitHub, Jira, Slack, or Google Workspace), we store OAuth access and refresh tokens on your behalf. Tokens are encrypted using AES-256-GCM with KMS-managed encryption keys before storage. Tokens are stored per user, per workspace, per provider.

We process this data solely to provide the gateway service (identity verification, policy enforcement, audit logging, and executing tool calls on your behalf). We do not use your data to train AI models, and we do not share your data with any third party for model training purposes. Data transiting the gateway is processed only to fulfill your requests.

AI model provider data flow

Agentic Control Plane acts as a gateway between your AI client (such as Claude, ChatGPT, or Cursor) and third-party APIs. When your AI client calls a tool through the gateway, the response data flows back to your AI client and may be processed by your chosen AI model provider according to their own terms. Agentic Control Plane does not control which AI model provider you use and is not responsible for how your AI provider processes data after it leaves our gateway.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Authenticate users and enforce access policies
• Execute tool calls and manage OAuth integrations on your behalf
• Generate audit logs for your compliance needs
• Scan request content for PII detection and content classification (as a security feature to help protect sensitive data)
• Respond to support requests and communications
• Monitor service health and prevent abuse
• Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties for their marketing purposes.

3. Sub-Processors and Third-Party Services

We use the following third-party services to operate our platform:

When you connect third-party integrations (such as GitHub, Jira, Slack, Salesforce, Google Workspace, Linear, Notion, or others), the gateway calls those services’ APIs on your behalf using your OAuth tokens. Each third-party service operates under its own privacy policy. We select providers that align with our commitment to data minimization and user privacy.

We maintain a current list of sub-processors on this page. If we add a new sub-processor that materially changes how personal data is processed, we will update this page and notify registered users.

4. Data Retention

• Account data is retained for as long as your account is active. You may request deletion at any time.
• OAuth tokens are retained while your integration is active. When you disconnect a service, tokens are deleted immediately. When you delete your account, all tokens are deleted.
• Audit logs generated by the gateway are retained for 12 months and then deleted by an automated job that runs hourly. Enterprise workspaces are retained indefinitely. Approval requests, session summaries and per-workspace agent memory notes are retained until the workspace is deleted.
• Plausible analytics data is aggregated and anonymized; no individual-level data is retained. PostHog analytics data is retained per PostHog’s standard retention terms and is not individually identified unless you’re a signed-in product user.
• Server logs are retained for up to 30 days for security and debugging purposes.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• TLS encryption for all data in transit
• Encryption at rest for all stored data (provided by Google Cloud Platform)
• AES-256-GCM encryption for OAuth tokens with KMS-managed envelope encryption
• OIDC-based authentication with RS256 token verification
• Role-based access controls for internal systems
• Tenant-level data isolation in our multi-tenant architecture (each workspace’s data, including OAuth tokens, audit logs, and configuration, is logically separated and inaccessible to other workspaces)
• SSRF protection on outbound requests from custom connectors
• Regular security reviews of our infrastructure and dependencies

6. Data Breach Notification

In the event of a confirmed security breach that affects your personal data, we will:

• Notify affected customers without undue delay after becoming aware of the breach
• Describe the nature of the breach, the categories of data affected, and the approximate number of records involved
• Describe the measures taken or proposed to address the breach and mitigate its effects
• Provide a point of contact for further information

Categories of data that could be affected in a breach include: account information (email, name), workspace configuration, encrypted OAuth tokens for connected services, audit log metadata, approval-request argument previews (up to 500 characters), session summaries, per-workspace agent memory notes, and — for workspaces that have enabled them — truncated request/response previews (up to 1,500 characters).

If required by applicable law (such as GDPR), we will also notify the relevant supervisory authority within the required timeframe.

7. Your Rights

For all users

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your account and associated personal data (including all OAuth tokens); audit records in workspaces you do not own are kept, with your identity replaced by a one-way hash — see how deletion works below
• Export your data in a portable format
• Object to processing of your personal data
• Disconnect any third-party integration and have its tokens deleted immediately

GDPR (European Economic Area)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local data protection authority. Our lawful basis for processing personal data is (a) performance of a contract (providing the services you requested) and (b) legitimate interest (security monitoring, service improvement).

Data Processing Agreements. Enterprise customers who require a Data Processing Agreement (DPA) for GDPR compliance may request one by contacting us at hello@agenticcontrolplane.com.

CCPA (California)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information

We do not sell or share personal information as defined by the CCPA.

How deletion works. All of this is self-serve, under Settings → Your data in the console. You do not need to ask us, and we do not need to approve it.

• Export. Downloads your profile, memberships, the configuration and key metadata of workspaces you own, your policies, your stored memories, and your audit records, as a single JSON file. It covers the main categories rather than every record we hold — ask us if you need something it does not include.
• Delete a workspace. Removes its audit logs, API keys, policies and configuration. You are shown what will be destroyed and must type the workspace’s ID exactly as shown to confirm. A workspace with a subscription that has not fully ended is refused — including one you have already cancelled, until the paid period runs out.
• Delete your account. Removes your profile, memberships and connected-service tokens. If you solely own any workspaces, you are first shown exactly which ones would be destroyed with you; nothing is deleted until you confirm. Sole ownership is no longer a reason we make you transfer or write in.

Everything in a workspace you owned is destroyed — its audit logs, policies, API keys, memories, configuration and stored secrets. Deletion is permanent: we keep no backups of workspace data.

What survives. Audit records in workspaces you belonged to but did not own are kept, because they are the owner’s record of what happened in their own workspace; your identity in them is replaced with a one-way hash we cannot reverse. We also keep a record that the deletion happened, and Stripe retains billing records under its own obligations.

To exercise any of these rights, contact us at hello@agenticcontrolplane.com. We will respond to verified requests within 30 days.

8. Cookies

Plausible Analytics is cookieless by design. PostHog, which we also run for product analytics, sets a cookie (its default, cross-subdomain) to connect a marketing-site visit to a product sign-up. Neither tool loads on previews or localhost. If you use Agentic Control Plane Cloud, session tokens may be stored in your browser’s local storage solely for authentication purposes.

9. Children’s Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. International Data Transfers

Our services are hosted on Google Cloud Platform infrastructure in the United States (us-central1 region). If you access our services from outside the United States, your data may be transferred to and processed in the United States. We rely on Google Cloud’s Data Processing Addendum, standard contractual clauses, and provider certifications to ensure appropriate data protection safeguards for international transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The “Effective date” at the top of this page indicates when the policy was last revised.

12. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

Reducibl Email: hello@agenticcontrolplane.com Website: reducibl.com

curl -sf https://agenticcontrolplane.com/install.sh | bash

irm https://agenticcontrolplane.com/install.ps1 | iex