Legal · Last updated 2026-09-03 · Effective 2026-09-03
Privacy Policy
This policy explains what personal data ShieldAgent collects, why we collect it, how long we keep it, and the rights you have over it. We process personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable national data-protection laws.
1. Controller identity
Who is responsible for your data?
ShieldAgent
Email: privacy@shieldagent.io
ShieldAgent is the data controller for account and contact data you provide directly to us. For data your AI agents route through our proxy, ShieldAgent acts as a data processor under Article 4(8) GDPR — you (the customer) remain the controller and determine the purposes and means of that processing. A separate Data Processing Agreement governs the processor relationship.
ShieldAgent is not yet incorporated as a company. No legal entity has been registered, and the jurisdiction of incorporation has not been decided. Until it is, the controller under Article 4(7) GDPR is the person or persons operating the ShieldAgent service, reachable at the address above. We will publish the entity, its registered address and its registration number here as soon as incorporation completes.
We are not established in the European Union. Where you are in the Union, the GDPR applies to our processing of your personal data under Article 3(2) GDPR, because we offer our services to you there. That applies whether or not we are established anywhere else, and it does not depend on where ShieldAgent is eventually incorporated.
We have not yet designated a representative in the Union under Article 27 GDPR. Until we do, send any request under Section 7 — Your rights — or any question about how we handle your data — to privacy@shieldagent.io, and we answer within the time stated in that section. When a representative is designated, their name and contact details will be published here.
2. Data we collect
What data do we collect?
Account data
- Name and email address (registration and billing contact)
- Company name and job title (for licence management and B2B context)
- Password hash (bcrypt; we never store or log plaintext passwords)
- SSO / SAML identity attributes when enterprise SSO is configured
Usage and telemetry data
- MCP tool-call metadata (tool name, agent identity, outcome, latency) — not the raw payload unless DLP logging is enabled by the customer
- Policy evaluation results and security-event classifications
- Audit-trail entries (hash-chained for tamper evidence)
- Dashboard interaction events (page views, feature usage)
Technical data
- IP address and user-agent string (log retention: 30 days)
- Session tokens (short-lived JWTs; not persisted beyond validity window)
- API authentication keys (stored as salted hashes; never in plaintext)
Support communications
- Email and in-app messages you send to our support or security teams
- Bug reports and feature requests
Prospect and enquiry data
- Work email address and company name, when you submit the pilot-request form on this site
- “What your agents do today” — a free-text field you write yourself. Please do not put personal data about other people, credentials, or confidential system details in it; we do not need them to evaluate a pilot
- The language version of the page you submitted from, and the time we received it
- Nothing else. The form sets no tracking identifier of its own, and we do not append data about you from third-party enrichment providers
We apply Data Loss Prevention (DLP) redaction to the 13 EU PII classes (names, email addresses, EU national ID formats, etc.) before events are persisted to our audit trail. Customers control whether raw-payload logging is enabled; by default it is off.
3. How we use your data
Why do we process personal data?
| Purpose | Data categories |
|---|---|
| Provision and operate the ShieldAgent service | Account, usage, technical |
| Authenticate users and manage sessions | Account, technical |
| Billing and licence management | Account, payment reference |
| Detect, investigate, and respond to security incidents | Usage, technical, audit trail |
| Generate compliance evidence (Annex IV, SOC 2) | Usage, audit trail |
| Respond to support requests | Account, support communications |
| Evaluate a pilot request you submit on this site | Prospect and enquiry |
| Send product and security updates (transactional) | Account (email) |
| Improve the service and train internal models (no customer payload data) | Aggregated, anonymised telemetry |
| Comply with legal obligations (GDPR Art. 17 erasure exceptions, tax and lawful-authority requirements) | Account, financial records |
| Retain compliance snapshot metrics (coverage percentages, control counts) as a contracted service (EU AI Act Art. 18 technical documentation retention remains your obligation as provider, not ours) | Compliance snapshot metrics (coverage percentages, control counts) |
4. Legal bases (GDPR)
Our legal bases for processing
Performance of a contract (Art. 6(1)(b))
Account registration, service delivery, billing, and authentication. The same basis covers steps taken at your request before a contract exists: if you submit the pilot-request form, we rely on Art. 6(1)(b) pre-contractual steps to evaluate that request — not on legitimate interests, and not on consent. Using that data for anything other than evaluating your request would need a separate basis, and we do not. It also covers our generation, on demand, of your compliance PDF reports (Annex IV, SOC 2, ISO 42001, NIST AI RMF) — which we transmit to you and do not retain — and our retention of the underlying compliance snapshot metrics (coverage percentages, control counts) as part of the contracted service: the underlying EU AI Act Art. 18 documentation-retention duty belongs to you, as provider of the high-risk system, not to ShieldAgent.
Legitimate interests (Art. 6(1)(f))
Security monitoring, fraud prevention, service improvement, and abuse detection — balanced against your rights; we have conducted a Legitimate Interests Assessment on request.
Legal obligation (Art. 6(1)(c))
Tax records and responding to lawful authority requests.
Consent (Art. 6(1)(a))
Non-essential cookies and marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5. Retention
How long do we keep your data?
Account data is retained for the duration of your subscription plus 90 days after account closure (to allow reactivation or data export), then deleted unless a legal hold applies.
Audit-trail events follow tier-specific schedules: Business — 1 year online; Enterprise — 1 year online + 4 years warm. The EU AI Act Article 18 requires providers of high-risk AI systems to retain technical documentation for 10 years — that obligation is yours, as provider, not ours. Compliance snapshot metrics (coverage percentages, control counts), on plans that include compliance reporting, are retained with your account data, on the schedule above; your compliance PDF reports (Annex IV, SOC 2, ISO 42001, NIST AI RMF) are generated on demand and transmitted directly to you, and we do not store the PDF.
IP / access logs — 30 days, then purged automatically.
Support communications — 3 years after ticket close.
Billing records — 7 years (tax obligation).
Prospect and enquiry data — 12 months from our last contact with you about the request, then deleted. If the pilot goes ahead it becomes account data and follows the account schedule above. That period applies to the record we keep of your submission: when delivery succeeds, the full submission — including the free-text field describing your agent stack — is recorded in LeadTracker, our own lead-tracking system running in our own infrastructure. If delivery fails we also emit a server log line, so that we still have a way to reach you. That line carries your email, company, locale and timestamp only — the free-text field is redacted before it is written, and is never stored in our logging system. The log line is a short-lived, best-effort backstop and not a second record we keep: it goes to our container-log store, which discards its contents automatically after 7 days — a period set on that store itself, independently of the 12 months above and far shorter than it. Individual lines cannot be located and removed from that store, so we do not promise to erase one, and we do not rely on it as a copy of your request. You can ask us to delete a pilot request at any time by emailing privacy@shieldagent.io; we do not require a reason, and we will delete the LeadTracker record.
6. Sub-processors & international transfers
Who do we share data with?
We share data only with sub-processors necessary to deliver the service. The full, current sub-processor list is published in our Trust Center. Key principles:
- Managed SaaS runs on EU-region infrastructure only.
- All sub-processors are bound by GDPR-compliant Data Processing Agreements.
- Standard Contractual Clauses (EU SCC, 2021) apply to any transfer outside the EEA.
- We notify affected customers at least 30 days before adding or replacing a sub-processor.
Pilot-request submissions are, as of the effective date of this policy, sent to no third party at all. The form on this site writes to our own infrastructure and nowhere else; no external messaging, CRM, or automation provider receives them. If that changes, the provider will appear in the Trust Center sub-processor list before it starts receiving data, under the 30-day notice commitment above, and this paragraph will change with it.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.
7. Your rights
Your rights under GDPR
Access (Art. 15)
Obtain a copy of the personal data we hold about you.
Rectification (Art. 16)
Correct inaccurate or incomplete data.
Erasure (Art. 17)
Request deletion, subject to legal-hold exceptions.
Restriction (Art. 18)
Limit processing in certain circumstances.
Portability (Art. 20)
Receive your data in a machine-readable format.
Object (Art. 21)
Object to processing based on legitimate interests.
Withdraw consent
For consent-based processing (e.g. marketing emails) at any time.
Lodge a complaint
With the supervisory authority in your EU member state.
To exercise any right, email privacy@shieldagent.io. We provide information on action taken without undue delay and in any event within one month of receiving your request, as required by GDPR Art. 12(3). We may need to verify your identity before fulfilling a request.
8. Security
How we protect your data
We implement appropriate technical and organisational measures including: TLS 1.3 in transit; AES-256 at rest with per-tenant keys; row-level security (RLS) at the database layer; Merkle-tree hash-chain integrity for audit events; and DLP redaction of PII before persistence. Full details are in the Trust Center. In the event of a personal-data breach affecting you, we will notify you as controller without undue delay, per GDPR Art. 33(2); our Data Processing Agreement separately commits to doing so, where feasible, within 72 hours.
10. Changes to this policy
How we communicate updates
We may update this policy to reflect changes to our practices or applicable law. We will notify registered users of material changes by email at least 30 days before they take effect, or display a prominent notice in the dashboard. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the service after the effective date constitutes acceptance of the updated policy.
One exception to the 30-day notice: when an update only adds a description of data we collect from site visitors, without changing how we process existing customers’ data, it takes effect immediately. GDPR Art. 13 requires that information to be available at the moment the data is collected, so deferring it by 30 days would defeat its purpose. The 2026-08-30 revision, which added the prospect and enquiry category, was such an update.
11. Contact
Questions or requests?
Privacy enquiries: privacy@shieldagent.io
Security incidents: security@shieldagent.io
DPA requests & sub-processor objections: privacy@shieldagent.io
This policy was last reviewed on 2026-09-03 and is effective from 2026-09-03. ShieldAgent.