Privacy Policy

Creative Intelligence provides Agents, an orchestration console for working with agents, projects, runs, and reviews. This policy covers the Agents web service, native clients, and information sent to the service by a connected local runtime.

Account and sign-in information

When you sign in, we process your account identifier and the identity information your sign-in provider supplies, such as your email address, name, and profile photo. Clerk processes and stores account and session information to authenticate you, maintain your account, and help secure access to Agents.

Google sign-in requests only the basic scopes openid, email, and profile. These permissions do not give Agents access to your Gmail messages, Google Drive files, or Google Calendar. We use Google account data for sign-in and account security. We do not sell that data, use it for targeted advertising, or use it to train generalized AI models. Agents can open Google Drive files only through the separate Google Drive connection described below, and only if you make it.

Our authorized use of Google account information is limited to the sign-in and security purposes described here, including processing by our authentication service, and, if you connect Google Drive, to the purposes in the Google Drive section below. See the Google API Services User Data Policy for Google’s requirements for developers that receive Google user data.

If you use Sign in with Apple in a native client, we receive the identity information you permit Apple to share. This may include your name and an email address, including an Apple private relay address if you choose to hide your email.

Information you submit and connect

Agents processes prompts, messages, project information, run and review records, activity and trace records, and attachments or captures you submit. These records let us route requests, show progress and results, support reviews, and maintain continuity across clients.

A connected local installation can mirror selected runtime records to the hosted control plane through its configured sync. Connecting a runtime does not mean every local file is uploaded. What is sent depends on the features, sync, integrations, and tools you configure or use. Local installations and connected providers may retain their own copies; removing a hosted record does not necessarily remove those copies.

Google Drive

Connecting Google Drive is optional. You connect it yourself from Library, Connections, and it is separate from signing in with Google. The connection asks Google for three permissions: openid and email, to know which Google account you connected, and drive.file, which Google describes as “See, edit, create, and delete only the specific Google Drive files you use with this app”. With drive.file, Agents can open only the files you choose in Google’s own file picker. It cannot see or search the rest of your Google Drive, and choosing a folder does not share the files inside it.

We store, for your connection: your Google account identifier and email address, the permissions you granted, a refresh token encrypted with AES-256-GCM before it is stored, when you connected, when the connection was last used, and whether it needs a reconnect. For each file you choose we store its Google Drive identifier, name, file type, and last-modified time, as Google Drive reports them. Access tokens are made for each use and are not stored. Each time you open Google’s file picker, one short-lived access token is sent to your own browser for the picker to use. While you connect, we keep a short record of that sign-in (one-time values kept only as hashes, an encrypted verifier, and Google’s one-time code, encrypted), which is deleted when the connection finishes or within about ten minutes.

We use this information only to show and manage your connection and the files you chose. Agents does not read the contents of your files. We do not sell Google Drive data, use it for advertising, or use it to develop, improve, or train generalized AI or machine-learning models. People do not read it except with your permission, where needed for security or to comply with the law, or in aggregated, anonymized form for operating the service.

Agents’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To disconnect, open Google Drive in Library, Connections and choose Disconnect. Agents asks Google to revoke this app’s access and deletes the connection, its stored token, and the list of files you chose. If Google does not confirm the revocation, Agents keeps the encrypted token only to ask again, up to five more times within a day, and then deletes it. Google revokes an app’s access for a whole Google account, so if another Agents account has connected the same Google account, Agents does not ask Google to revoke, and that account’s access stays. If Agents can no longer decrypt the stored token after a security change, it cannot ask Google either. In each of these cases the page says so, and you can remove the access yourself in your Google Account connections settings. If connecting fails after Google has issued access, Agents asks Google to revoke that access at once, unless a connection in Agents already uses the same Google account. You can also remove Agents in your Google Account connections settings at any time; the next time Agents uses the connection it shows it as needing a reconnect, and disconnecting in Agents deletes what it still holds. We keep Google Drive information until you disconnect in Agents or ask us to delete it. Google Drive is a trademark of Google LLC.

How information is processed and shared

• Service providers process information to operate Agents. These include Clerk for authentication, Convex for hosted control-plane records and uploaded files, and Vercel for web hosting.
• Configured AI providers, agent harnesses, and tools receive the requests and context needed to perform the work you initiate or authorize. Their own terms, retention, and data-use settings apply. Review those settings before sending sensitive information.
• We process support communications and operational records to answer requests, investigate failures or abuse, and protect the service. We may disclose information when required by law or necessary to protect rights and security.

Sessions, preferences, and diagnostics

Agents and its authentication provider use cookies or similar storage for sessions and security. Clients also store preferences, such as your selected theme. Hosting and operational systems may process technical information such as IP addresses, device or browser details, timestamps, and error or request records.

Depending on deployment and client settings, analytics and diagnostics services may process usage events and error information to help us understand use and troubleshoot the service. The web analytics integration is enabled only when the deployment’s analytics setting is enabled. Diagnostic logging is separate from that switch.

Retention and your choices

We retain information according to its purpose: maintaining your account, providing work history and results, operating the service, investigating security issues, and meeting legal obligations. Retention also depends on the record type and configured provider. There is no single deletion period for all records.

Contact help@creative-int.com to request access, correction, or deletion of information held by Creative Intelligence, or to ask about closing your account. We may need to verify your identity and clarify which records you mean. Backups and records needed for security or legal obligations may remain after a request.

You can revoke Agents’ Google connection in your Google Account connections settings. Revocation stops future access through that authorization; it does not itself delete information already stored in Agents. Manage local copies and third-party provider records through those installations or providers, and contact us for help with hosted records.

International processing and children

Our service providers may process information in countries other than where you live. The protections and legal requirements in those countries may differ. Agents is intended for adults managing their work and is not directed to children under 13. Contact us if you believe a child has provided personal information.

Changes and contact

We may update this policy as Agents changes. We will publish the updated policy here with a revised date and provide additional notice or request consent where required. For privacy questions, contact help@creative-int.com. Use of Agents is also covered by our Terms of Service.