Privacy Policy

This Privacy Policy explains how AgoraCrew (hereinafter referred to as "we", "us", or "our") collects, processes, stores, and protects personal data in connection with our custom software engineering services, our Shopify applications, our HubSpot and monday.com marketplace applications, enterprise integration platforms, and our corporate website at agoracrew.com.

This policy applies to:

• Clients and prospects who engage with us for custom software development, enterprise integrations, or AI automation projects.
• End customers whose data may be processed when a merchant installs and uses one of our Shopify applications (e.g., Order Exceptions Copilot).
• Website visitors who interact with our website, contact forms, or AI-powered chat widget.
• Users of our AI Support Agent & Growth Engine whose interactions are processed to deliver customer support and revenue recovery services on behalf of e-commerce merchants.

We are committed to full compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK Data Protection Act 2018, and Shopify's App Store Developer Guidelines.

For data processed on behalf of our clients (e.g., via Shopify apps, enterprise integrations, or our AI Support Agent), AgoraCrew acts as a data processor. The client (merchant or business) remains the data controller and is responsible for ensuring they have a lawful basis for sharing their customers' data with us.

For any data we process independently (such as client account information, website enquiries, or contact form submissions), we act as the data controller. Our registered contact for data protection matters is:

The data we collect depends on the service context. We access and process only the minimum data required to fulfil the specific service engagement:

We adhere strictly to the GDPR principle of data minimization (Article 5(1)(c)). This means:

• We only process data that is strictly necessary to deliver the specific service — whether that's a custom software project, a Shopify app integration, or an AI-powered support interaction.
• No additional data is requested, scraped, inferred, or collected beyond what is explicitly required for the stated purpose.
• We do not build customer profiles, track browsing behaviour, or aggregate personal data for marketing purposes.

In accordance with transparency requirements under GDPR (Articles 13–14) and Shopify's App Store guidelines, we inform all users of the following:

Our AI systems operate under the following principles:

• No autonomous decision-making: Our AI does not make decisions that produce legal effects or similarly significantly affect data subjects. Its function is to draft support replies, identify operational exceptions, and automate predefined workflows.
• Human oversight: All AI-powered systems include escalation mechanisms so that complex or sensitive matters can be reviewed and handled by a human.
• Brand-aligned responses: AI support agents are configured to match the merchant's specific brand voice, tone, and support policies. They do not generate unsolicited content.
• No model training on your data: Your data is never used to train, fine-tune, or improve third-party AI models. We maintain contractual agreements that explicitly prohibit this.
• Right to human intervention: Under Article 22 of the GDPR, you have the right to request human intervention at any stage. Contact the merchant directly or reach out to us at the email address provided in this policy.

To deliver our software engineering services and AI-powered products, we work with the following categories of subprocessors:

XSync for QuickBooks Desktop sends no data to any language model. Its AI features are exposed as tools for monday.com's own assistant: the app returns figures from your synced QuickBooks data, and monday's assistant writes the sentence. There is no AI provider in that application's data path, and none of your QuickBooks data reaches Anthropic or any other model provider through it.

All subprocessors are bound by data processing agreements. Anthropic does not retain, cache, or store customer data beyond the time required to process an individual API request, and does not use it to train models.

We apply strict data retention practices:

• Client project data: Retained for the duration of the active engagement plus 12 months for support and warranty purposes. Deleted upon request after that period.
• AI support interaction data: Customer data processed during a support interaction is deleted from our active caches immediately following ticket resolution. We do not maintain long-term databases of end-customer personal data.
• Shopify app data: When a merchant uninstalls one of our apps, all associated customer data is purged from our systems within 48 hours of receiving the uninstallation webhook.
• Contact form submissions: Retained for up to 24 months for business development follow-up, then deleted.
• Erasure requests: We honour all data erasure requests in full compliance with GDPR Article 17 (Right to Erasure). All requests are processed within 30 calendar days of receipt.
• Anonymised logs: We may retain fully anonymised and aggregated usage logs (containing no personal data) for service improvement and performance monitoring.
• ARBridge for QuickBooks — synced HubSpot data: Data ARBridge has synced into a customer's own HubSpot account (Companies, Contacts, Invoice records, and derived AR fields) is not deleted or retracted by ARBridge when the customer disconnects or uninstalls the app. It remains ordinary CRM data under that customer's own control, since it resides in an account they own.
• ARBridge for QuickBooks — connection credentials & sync logs: As of the date of this policy, ARBridge's backend does not yet automatically purge a disconnected connection's stored encrypted credentials (QuickBooks Web Connector password, HubSpot OAuth refresh token) or historical sync logs. This is a known gap that we are tracking for a future fix; customers who want this data deleted manually can contact us at the email address in Section 13.
• ARBridge for QuickBooks — GDPR erasure requests: When HubSpot notifies ARBridge of a contact.privacyDeletion event (an end-customer of our customer exercising their GDPR right to be forgotten), ARBridge permanently purges that contact's personal data (email address and name) from its own database and durably prevents QuickBooks from re-populating that same data on a future sync.
• XSync for QuickBooks Desktop — synced monday.com data: Items the app has created on a customer's own monday.com boards are not deleted or retracted when that customer disconnects or uninstalls it. They remain ordinary board data under the customer's own control, since they reside in an account they own.
• XSync for QuickBooks Desktop — staged QuickBooks data, credentials & sync logs: When monday.com tells us a customer has uninstalled the app or revoked its authorisation, a deletion clock starts. Unless the app is reconnected, everything held for that connection — the staged QuickBooks records, the encrypted QuickBooks Web Connector credentials, the monday.com tokens, the board mappings and the sync history — is permanently erased within ten days, and in practice within seven. Deletion is deferred rather than immediate because uninstalling and reinstalling is a normal way to troubleshoot a problem, and an instant purge would destroy a customer's entire setup during their own attempt to fix it. Reconnecting stops the clock.

Our processing of personal data is based on the following lawful grounds under GDPR Article 6:

• Performance of a Contract (Article 6(1)(b)): Processing necessary to deliver our custom software engineering services, maintain integrations, and fulfil our contractual obligations to clients and their customers.
• Legitimate Interests (Article 6(1)(f)): Processing client and prospect enquiries, improving our services, and maintaining the security of our systems.
• Consent (Article 6(1)(a)): Where applicable, the merchant/client is responsible for obtaining and managing end-customer consent in accordance with their own privacy policy.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:

• Right of Access — Request a copy of the personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your personal data ("Right to Be Forgotten").
• Right to Restriction of Processing — Request limitation of processing under certain conditions.
• Right to Data Portability — Receive your data in a structured, machine-readable format.
• Right to Object — Object to processing based on legitimate interests.
• Right to Human Intervention — Request that automated decisions (including AI-generated responses) be reviewed by a human.

To exercise any of these rights, please contact us at karim@agoracrew.com. We will respond to all valid requests within 30 calendar days. If your request is complex, we will inform you of any extension (up to a maximum of 90 days total) as permitted under GDPR.

You also have the right to lodge a complaint with your local supervisory authority. For Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest. In our QuickBooks integrations this is applied at the column level as well as by the hosting provider: personal data — customer and contact names, email addresses, billing addresses, and free-text notes — is encrypted with AES-256-GCM under a versioned key ring before it is written, so it is not readable from the database itself
• Access controls based on the principle of least privilege
• Regular security audits and vulnerability assessments
• Mandatory data protection training for all personnel with data access
• Secure API authentication using OAuth 2.0 for platform integrations (Shopify, HubSpot, QuickBooks, monday.com)
• Encrypted credential storage for all integration tokens and API keys

Our website uses Vercel Web Analytics to collect anonymised, aggregate page view data. This service does not use cookies, does not track individual users, and does not collect personally identifiable information.

We may use a language preference cookie (agoracrew_lang_pref) to remember your language selection between English and French versions of our website. This cookie is strictly functional and contains no personal data.

Our AI-powered chat widget may use session-scoped storage to maintain conversation context during your visit. This data is not persisted after the session ends and is not used for tracking or advertising purposes.

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that affect how we process personal data, we will provide notice through our website or via direct communication to affected clients.

We encourage you to review this page periodically to stay informed about our data practices.

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us: