Privacy Policy

1. Who controls this data

Agentic Zero is operated by Dis-Solutions, a consultancy company registered in Spain, EU, trading under the name "Agentic Zero," who is the data controller for the account/contact information described below. For your own operational and business data processed while delivering the Service, Agentic Zero acts as a data processor on your behalf — that relationship is governed by a separate Data Processing Agreement (DPA), not by this page. Your acceptance of this policy is recorded when you submit the AUDIT form.

2. What we collect, and why

Data	Purpose	Source
Company name, sector, process description	Generate your feasibility preview and tier classification	You, via the AUDIT form
Contact name and email	Send your preview, respond to your inquiry, send account credentials	You, via the AUDIT form or checkout
Payment confirmation (not the card itself)	Activate your Essential purchase	Stripe, our payment processor
Portal login (email + password hash)	Authenticate you to your own dashboard	Created automatically at onboarding
Operational data from your connected systems (e.g. SAP)	Perform the certified business process	Your own systems, per the DPA
Usage/audit logs of autonomous actions	Give you an auditable record of every autonomous decision	Generated by the Service

3. Payment processing

Essential purchases are paid through Stripe. We never see, store, or transmit your card number — Stripe's own hosted checkout collects it directly. Stripe acts as an independent controller for payment data; see Stripe's privacy policy.

4. How long we keep it

Account and billing records are kept for as long as your account is active, plus 6 years thereafter to comply with EU/Spanish commercial record-keeping obligations (Código de Comercio) and tax law. Operational data processed under a DPA is retained and deleted according to the terms of that specific agreement.

5. Who we share it with

• Stripe — payment processing.
• Our email/SMTP provider — sending you account and transactional emails.
• We do not sell contact or business data to third parties, and we do not use a third-party marketing automation platform for lead/customer communication — our own systems send these emails directly.

6. Your rights

Subject to applicable law (including the GDPR, where it applies to you), you may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. To exercise any of these rights, contact alberto@agentic-zero.com. Given the current scale and nature of processing — a small number of business clients, no large-scale or systematic monitoring, no large-scale processing of special-category data — a Data Protection Officer is not currently required under Article 37 GDPR; this will be reassessed as the business grows. Agentic Zero is established within the EU, so no separate EU representative under Article 27 GDPR applies.

7. Security

Security is not a policy statement layered on top of the Service — it is enforced in the same runtime that executes your autonomous processes, on every request, not only reviewed periodically. Concretely:

• Automated secret and personal-data screening. Every piece of data entering or leaving the operational runtime is scanned before it is processed or stored: exposed credentials or API keys are blocked outright, and personal data is automatically redacted from operational logs and screens.
• Per-client data isolation. Your operational data, memory, and audit history are stored and processed separately from every other client's — verified in a dedicated internal audit covering every module that reads or writes client data, not assumed from the architecture alone.
• Scoped authorization on every autonomous action. Each action the Service takes on your connected systems is checked against an explicit, per-client allow-list of systems and operations before it executes. Anything outside that agreed scope is blocked and routed to a human for review — it is never silently allowed, and never silently denied without a record.
• Bounded autonomy. Autonomous sequences are capped by evidence-based stop conditions and a limited retry budget. Nothing retries indefinitely against your systems; a process that cannot complete successfully escalates to a human instead of looping.
• Automatic isolation under abnormal activity. If unusual patterns are detected against your account — an abnormal burst of calls, or repeated security flags in a short window — that account is automatically isolated from further autonomous execution until a human reviews and manually clears it.
• Grounding checks on AI-generated output. Recommendations produced by the Service are automatically checked against the data you actually submitted, and flagged for human review if a result appears more confident than the underlying evidence supports.
• Full audit trail. Every autonomous decision and action is timestamped, logged, and available to you (see Section 2) — nothing autonomous happens off the record.
• Password storage. Portal passwords are never stored in plain text; we store a salted, one-way cryptographic hash only, and cannot recover your original password.
• Continuous automated testing. The controls above are covered by automated regression tests that run before any change to the Service is deployed.

If we become aware of a data incident affecting your personal data, we will assess and notify affected parties and any applicable authority as required by law.

8. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected in the version and date at the top of this page.

9. Contact

Questions about this policy: alberto@agentic-zero.com.