Privacy at AgentPass

When you scan a website, our crawler (AgentPassBot) fetches publicly available pages and files such as robots.txt and the sitemap. The scan never signs in, fills in forms or reads anything that isn't public.

We store the address you scanned, the result of each check, the addresses and titles of the pages we read, and the structured data and metadata extracted from them — not copies of whole pages.

Anyone with a report's link can open it, so share it only with people you want to see it. Reports aren't listed in search engines.

AgentPass runs automated shopping tests of some businesses' public websites — the steps an AI shopping agent would take — and may contact a business about its results. A test may add an item to a cart through the store's public cart, but never signs in, enters details at checkout, pays or places an order (see AgentPassBot).

For these businesses we keep the business name and website, the test results with up to 8 screenshots of the pages tested, a business contact's name, email address or LinkedIn profile when we have one, the messages we sent, and how many times and when the private report link was opened (nothing else about the visitor).

If AI-assisted features are switched on, the names, prices and options of a few public products may be sent to an AI provider to phrase a test task the way a shopper would; AI never runs or scores a test. AgentPass may also run a small sample of AI Visibility searches for the business's category (see below).

We use this only to share the results and follow up. Reply “no thanks” or email hello@getagentpass.com and we'll stop contacting you and, if you ask, delete it.

• Your email address and name, so you can sign in and we can tell you about your account.
• Your organization and business details (such as business name and website), and the settings you choose.
• A record of important account changes (for example, connecting an integration), kept for security.

Sign-in may be handled by our authentication provider, Clerk, which processes your email address to let you sign in securely.

To stop the free scanner from being misused, we limit how many scans can be started. For this we store a one-way hash of the requesting IP address — never the address itself — with each scan and in short-lived rate-limit records.

If you connect a system such as Shopify or your own API, its access credentials are encrypted before they're stored and are never sent to your browser. We only use them for what that connection is for: the capabilities you've switched on for your own system, or, for Shopify, AgentPass's own checks of your store.

Shopify stores. AgentPass's Shopify app only reads your products (titles, descriptions, images and their descriptions, variants, prices, SKUs and barcodes, categories, product types, vendors, collections, search descriptions and online store links), whether stock is tracked and available, stock levels at your locations, and your store locations. It doesn't read orders or customer data, and it never changes your store. AgentPass stores the results of its checks: the catalog check results, including the titles of products that need a fix, and the results of its read-only store checks, such as a sample product's title and option names and the product ids it looked up. It uses them only to show you those checks inside AgentPass. Nothing it reads from your store is shared with AI agents, AI platforms or AI providers.

When AI agents use your agent on AgentPass, we record what happened so you can see it in your analytics: which capability was used, whether it worked, how long it took, search terms and filters, cart and order identifiers and amounts, and how the agent identified itself.

We don't collect shoppers' names, email addresses, postal addresses or payment details from agent requests, and we don't store the conversations people have with AI apps.

Subscriptions are processed by Stripe. Your card details go directly to Stripe; AgentPass never sees or stores them. We keep the plan and subscription status Stripe reports to us. If you installed AgentPass from the Shopify App Store, Shopify bills your plan instead and tells us which plan you chose. Agents send shoppers to your own checkout, so AgentPass never handles your customers' payments either.

To measure whether AI systems mention or recommend your business, AgentPass sends each of your monitored customer searches — the searches you approve — with an approximate location where the surface supports one, to the AI providers whose results you see: OpenAI, Anthropic and Google (Gemini). It never sends your account details, your customers' data, integration credentials or anything read from a connected Shopify store.

If you ask AgentPass to suggest searches or competitors, it sends a short profile built from your public website to an AI provider: your business type, description, attributes and city, and — for businesses without a Shopify connection — product categories, a few product names, a price range and your current searches. It may also send AI answers to an AI provider to recognize competitor names.

AgentPass deletes raw provider responses after 30 days and full answer text after 180 days. The results computed from them (mentions, citations and daily snapshots) are kept while your account is active.

Scan results, scores, catalog checks and automated shopping test results are calculated by fixed rules. AI is used only in optional, clearly scoped places: to recognize a business's type from a short, sanitized summary of public page content; to suggest AI Visibility searches and competitor names; and to phrase an automated shopping test's task from a store's public product data. AI Visibility itself asks AI providers questions, as described above. Account data and integration credentials are never sent to an AI provider, and neither is anything AgentPass reads from a connected Shopify store.

We record basic product events in our own database — for example that a scan was started or a report was viewed — to understand how AgentPass is used. We don't use advertising trackers.

We use a small number of cookies that AgentPass needs to work: keeping you signed in, remembering the business you're viewing, and letting you add a scan you ran before signing up to your new account.

• Account, business and agent activity data is kept while your account is active, so you can see your history. Email us and we'll delete it.
• Integration credentials are deleted when you disconnect the system. When you uninstall the Shopify app, its access token is deleted straight away, and 48 hours later (when Shopify asks) we erase that store's connection and installation record, its catalog check results and the results and test records of AgentPass's read-only store checks. The security record that the store was connected and erased is kept.
• AI Visibility: raw provider responses are deleted after 30 days and full answer text after 180 days; the results computed from them are kept while your account is active.
• Automated shopping tests of businesses AgentPass contacts (results, screenshots, messages and report views) are kept until we no longer need them for that conversation, or until you ask us to delete them.
• Rate-limit records are short-lived and pruned automatically.

Data is encrypted in transit (HTTPS) and at rest by our hosting and database providers. Integration credentials are additionally encrypted by AgentPass (AES-256-GCM) before they're stored, and messages from Shopify are verified with Shopify's signature.

We don't sell personal data. We share it only with the service providers that run AgentPass, and when the law requires it:

• Replit — hosting and database
• Clerk — sign-in
• Stripe — subscription payments
• Shopify — for stores that install AgentPass's Shopify app: the app connection and, for App Store installs, billing
• OpenAI, Anthropic and Google — AI Visibility and the optional AI features described above

To ask what we hold about you, or to have your account data deleted, email hello@getagentpass.com. If AgentPass tested your website or contacted you, you can also ask us to stop contacting you or to delete what we hold about your business.