Privacy at AgentPass

When you scan a website, our crawler (AgentPassBot) fetches publicly available pages and files such as robots.txt and the sitemap. It never signs in, fills in forms or reads anything that isn't public.

We store the address you scanned, the result of each check, the addresses and titles of the pages we read, and the structured data and metadata extracted from them — not copies of whole pages.

Anyone with a report's link can open it, so share it only with people you want to see it. Reports aren't listed in search engines.

• Your email address and name, so you can sign in and we can tell you about your account.
• Your organization and business details (such as business name and website), and the settings you choose.
• A record of important account changes (for example, connecting an integration), kept for security.

Sign-in may be handled by our authentication provider, Clerk, which processes your email address to let you sign in securely.

To stop the free scanner from being misused, we limit how many scans can be started. For this we store a one-way hash of the requesting IP address — never the address itself — with each scan and in short-lived rate-limit records.

If you connect a system such as Shopify or your own API, its access credentials are encrypted before they're stored and are never sent to your browser. We only use them to provide the capabilities you've switched on.

When AI agents use your AgentPass interface, we record what happened so you can see it in your analytics: which capability was used, whether it worked, how long it took, search terms and filters, cart and order identifiers and amounts, and how the agent identified itself.

We don't collect shoppers' names, email addresses, postal addresses or payment details from agent requests, and we don't store the conversations people have with AI apps.

Subscriptions are processed by Stripe. Your card details go directly to Stripe; AgentPass never sees or stores them. We keep the plan and subscription status Stripe reports to us. Agents send shoppers to your own checkout, so AgentPass never handles your customers' payments either.

Scan results and scores are calculated by fixed rules. If AI-assisted features are switched on, AgentPass may send a short, sanitized summary of public page content to an AI provider — for example to recognize whether a site is a restaurant or a store. Account data and integration credentials are never sent.

We record basic product events in our own database — for example that a scan was started or a report was viewed — to understand how AgentPass is used. We don't use advertising trackers.

We use a small number of cookies that AgentPass needs to work: keeping you signed in, remembering the business you're viewing, and letting you add a scan you ran before signing up to your new account.

We don't sell personal data. We share it only with the service providers that run AgentPass (hosting, database, authentication and payments), and when the law requires it.

To ask what we hold about you, or to have your account data deleted, email hello@getagentpass.com.