Privacy Policy
Last updated: 14 October 2026
This policy explains how AGMAN (agman.app), operated by the AGMAN team, handles personal data. We are the controller of the data described here. We collect what we need to run a discovery network, and nothing for advertising.
1. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email, display name, password (stored only as a one-way hash by our authentication provider), sign-in and confirmation times | Create and secure your account | Contract |
| Listings you publish: everything you enter, images you upload, moderation decisions, and the publisher email used when you publish without an account | Publish and moderate listings, send a secure manage link, and let you connect the listing to an account later (listings are public by design) | Contract |
| Publisher agreements: which terms version you accepted, when, for which listing, a hashed network identifier and browser type | Prove what was agreed | Legitimate interest; legal claims |
| Messages you send to publishers: name, email, message | Deliver your inquiry to that publisher | Contract / your request |
| AGMAN Dispatch subscription (only if you subscribe): email, when and where you subscribed, the consent wording shown, a hashed network identifier, any topics you chose to get more of (optional), and which Dispatch emails were sent to you | Send the AGMAN Dispatch emails you asked for, use any topics you chose to pick what to include, and honour unsubscribes. Every email has a one-click unsubscribe link; unsubscribing does not affect account emails | Consent |
| Support requests, reports and suggestions | Answer you and keep AGMAN safe | Legitimate interest |
| Usage: a random visitor ID, public page paths, traffic source/campaign tags, listings viewed, outbound clicks, searches, Pulses and Supports | Measure aggregate traffic and acquisition, count activity once, show publishers aggregate statistics, improve search | Legitimate interest |
| Qualified Reddit lead data: public username, subreddit, permalink, short public excerpt, linked domain and deterministic match reasons, only after an AGMAN moderator marks the public post/comment as qualified | Evaluate relevant publishers/products for AGMAN discovery and outreach. Pending Reddit review stays inside Reddit; private messages, emails and private Reddit data are not imported | Legitimate interest |
| Pages added by AGMAN editors: the product's public website details, and, kept private, the public source page, maker names, public profile links and contact emails the product or its makers have published | Show the product to people looking for it, and check that a person claiming the page really represents the product. The private details are never shown on AGMAN or used to send email automatically. Ask for removal at any time through Support | Legitimate interest |
| External appearances: connected public URLs, source identity, ownership-check evidence, health results and distribution preparation progress | Help you track external appearances, verify matching identities and prepare relevant submissions | Contract; legitimate interest |
| Security: salted hashes of IP addresses, request counts | Rate limiting and abuse prevention | Legitimate interest |
| Promotion and Grow Pass purchases: amount, listing, payment reference, credit use, schedules and optional editorial briefs, evidence links and contact | Deliver paid benefits, review editorial work, handle refunds and keep accounting records | Contract; legal obligation |
We never receive your card details. We do not sell personal data, run third-party advertising or cross-site tracking, or build advertising profiles. Statistics shown to publishers are aggregate counts, never individual visitors.
We only send marketing email if you opt in. Emails about your account, listings, inquiries and purchases are transactional.
2. Who processes data for us
- Supabase - database and authentication, hosted in the EU (Frankfurt).
- Vercel - website hosting and cookieless, aggregate page-view analytics (Vercel Web Analytics; no cookies, no cross-site tracking, private and account pages excluded); requests may be processed in the United States.
- Google Analytics - limited public-page measurement with analytics and advertising storage denied, Google Signals and ad-personalization signals disabled, query strings removed from page-view URLs, and private/token/account routes excluded; requests may be processed in the United States.
- Anthropic - Quick Add listing preparation and optional LinkedIn PDF structure review. LinkedIn PDF text is sent only when you explicitly choose AI review after AGMAN's deterministic checks flag ambiguous fields. The review may reorganize only facts present in that PDF; account passwords and payment data are never sent.
- Amazon Web Services (SES) - sending email, from the EU (Stockholm).
- Dodo Payments - merchant of record for promotion purchases. They process payment data as an independent controller under their own privacy policy.
Where data leaves the UK or EEA, we rely on the provider's approved transfer safeguards, such as Standard Contractual Clauses or the EU-US Data Privacy Framework. We may also disclose data where the law requires it.
3. Public information
Listings are public. Anything you put in a listing can be seen by anyone, shared, and indexed by search engines. Publishers acknowledge at publish time that, if they later purchase paid promotion, AGMAN may choose to feature that page's public content in AGMAN-owned newsletters, social channels or marketing. Paid promotion does not guarantee such a feature. See the Publisher Terms.
4. Cookies and local storage
- Sign-in cookies (
sb-…-auth-token): keep you signed in. Only set if you sign in. - Visitor ID (
visitor_id): a random first-party identifier used for aggregate traffic measurement, unique-visitor reporting and daily Pulse uniqueness for signed-out visitors. Lasting Support is tied to a verified AGMAN account instead. Repeat outbound clicks can still count as separate traffic events. The visitor ID contains no personal details and lasts one year. - Google Analytics storage: analytics and advertising storage remain denied, so AGMAN does not grant Google Analytics permission to create analytics or advertising cookies. Limited cookieless measurement is sent only for public pages; private, token and account routes are disabled.
- Draft (browser storage): an unfinished listing form, kept only in your browser until you publish or clear it.
- Dispatch prompt preference (browser storage): remembers when you dismiss the optional Dispatch prompt, or that this browser subscribed, so AGMAN does not repeatedly interrupt discovery. No email address is stored in this browser preference.
There are no third-party advertising or cross-site tracking cookies. The first-party visitor ID above is used for aggregate product and traffic measurement.
5. How long we keep data
- Account data: while your account exists; deleted within 30 days of a deletion request.
- Listings: while published. If you publish by email before creating an account, that email is kept with the submission so we can send and validate your secure manage link. Once claimed, you can manage the listing from your dashboard. Backups roll off within 30 days after deletion. \n
- LinkedIn PDF imports: the PDF itself is parsed in memory and is not stored. If you explicitly request optional AI structure review, a bounded evidence excerpt and the resulting structured review are processed for that request; the reusable AI-analysis cache stores structured results and usage metadata, not the uploaded PDF.
- Publisher agreement records: for as long as the listing exists. If you delete a listing from your dashboard, its agreement records are deleted with it; listings with payment history are unpublished rather than deleted, and their records are kept as long as accounting law requires.
- Collection-feature notification delivery state: while the listing and Collection exist, so we can avoid sending the same one-off feature notice twice and retry a failed delivery. No email address is stored in that delivery state.
- Guest claim-reminder delivery state: while the listing exists, so an uncertain send cannot trigger repeated reminders. This state contains submission identifiers and delivery outcomes, not email addresses or claim tokens.
- Individual traffic, view, click and search events: 13 months; aggregate statistics may be kept longer.
- Reddit monitoring excerpts stay in the Reddit app for up to 90 days after detection or subsequent content changes. Qualified Reddit lead records imported into AGMAN are removed no later than 13 months after detection, even if syncing is disabled. Source deletion, expiry or removal of qualification scrubs the stored username, permalink, excerpt, domain and match reasons on the next successful sync. Moderator qualification does not constitute outreach or email-subscription consent.
- Rate-limit records: 2 days.
- Messages to publishers and support requests: up to 24 months.
- External appearance evidence and preparation progress: while the associated listing exists. Operational check events follow the 90-day activity retention policy.
- Promotion transaction records: as long as tax and accounting law requires.
6. Your rights
Depending on where you live (including under the GDPR and UK GDPR), you can ask to access, correct, delete or export your data, object to or restrict processing based on legitimate interest, and withdraw consent where we rely on it. We answer within one month. You can also complain to your data-protection authority.
If a listing represents you and you did not publish it, we will remove it on request - see content removal.
To use your rights: Use the support form.
7. Security
Passwords are handled by our authentication provider and never stored in readable form. Sessions use secure, HTTP-only cookies. The database is only reachable from our servers through a restricted role, and access to internal data is limited to staff who need it. If a breach affects your data, we will tell you and the authorities as the law requires.
8. Children
AGMAN is not for anyone under 16, and we do not knowingly collect their data.
9. Changes
We will update this page and its date when our data handling changes, and tell account holders about material changes. See also the Terms of Service.