Last updated: October 2, 2026
This Privacy Policy explains how Swirl Software Solutions, which operates Agent One ("Agent One," "we," "us," and "our"), collects, uses, shares, and protects information when you use our websites, applications, hosted AI agents, chat widgets, APIs, and related services.
Agent One customers may create AI agents that interact with their own users, leads, customers, or visitors. If you interact with an AI agent created by one of our customers, that customer may also collect and control information about your interaction. Their own privacy policy may apply in addition to this Privacy Policy.
Some tools and agents are operated by Agent One itself for our own product, marketing, support, research, or internal use ("Agent One-operated tools"). Other agents are created, configured, deployed, or controlled by our customers for their own websites, products, businesses, or users ("customer-controlled agents"). We treat these categories differently as described below.
We collect the following types of information:
We use information to:
Conversation data is core to how Agent One works. We may process conversation data to provide the requested AI response, preserve conversation history, show analytics, improve the relevant agent, detect abuse, debug errors, and improve Agent One's product quality, safety, and reliability.
We may use aggregated, de-identified, or otherwise minimized information derived from conversations and usage patterns for internal analytics, product research, evaluation, benchmarking, and feature improvement. We take reasonable steps designed to avoid using information that directly identifies a person or customer when we use data for these internal improvement purposes.
For customer-controlled agents, we do not sell raw conversation logs, uploaded customer files, customer prompts, customer end-user messages, or lead capture submissions as a standalone dataset. We will not license customer-controlled agent conversations as a commercial training dataset or use them to train general-purpose third-party AI models unless we have appropriate permission, an explicit opt-in, or another valid legal basis.
For Agent One-operated tools, we may use de-identified, aggregated, or otherwise minimized conversation data and usage patterns to build internal research, benchmarks, evaluation sets, product insights, and quality-improvement datasets for Agent One and related first-party tools. If we offer any commercial dataset, model training dataset, or external licensing program based on Agent One-operated tool data, we will use additional safeguards and provide notice, consent, opt-out, or other controls where required by law or by the context in which the data was collected.
We use third-party service providers to run Agent One. These may include AI model providers, hosting providers, database providers, analytics providers, payment processors, email providers, support tools, and security vendors.
When you or your users send messages to an AI agent, relevant prompts, messages, files, metadata, and retrieval context may be shared with AI model providers and infrastructure providers as needed to generate responses, provide the service, monitor safety, and troubleshoot issues. These providers process information under their own terms and privacy commitments or under agreements with us.
We may share information:
If you create, deploy, or manage an Agent One AI agent, you are responsible for providing any privacy notices and obtaining any consents required for your own users, visitors, customers, or leads. You should not submit sensitive personal information, regulated health information, financial account information, credentials, trade secrets, or other confidential information unless you have the right to do so and your use of Agent One is appropriate for that data.
If your agent is embedded on your website or used with your own customers, you are responsible for explaining how your agent collects and uses conversation data, lead information, and any information your users provide.
We retain information for as long as needed to provide Agent One, operate your account, preserve conversation history, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and support legitimate business purposes.
You may request deletion of your personal information or account. Deletion may not remove information already retained in backups, security logs, payment records, records needed for legal compliance, or aggregated or de-identified information that no longer reasonably identifies you.
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. You may also have the right to opt out of certain uses or disclosures. To make a request, contact us using the information below.
If your request relates to an agent operated by one of our customers, we may direct you to that customer or assist them in responding to your request.
We use cookies and similar technologies to keep you signed in, remember preferences, understand usage, measure performance, and improve Agent One. You can control cookies through your browser settings, but some features may not work properly if cookies are disabled.
We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No system is perfectly secure, and we cannot guarantee absolute security.
Agent One is operated from the United States. Information may be processed in the United States and other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your location.
Agent One is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can take appropriate action.
Agent One offers a plugin that lets you connect your Agent One account to ChatGPT, Codex, and other assistants that support the Model Context Protocol. The plugin only works after you sign in to Agent One and approve the connection, and it only accesses agents owned by the account you connect.
When you ask the assistant to create an agent, Agent One receives and stores the agent details the assistant sends on your behalf, such as its name, description, greeting, instructions, suggested questions, and knowledge text, and creates a private agent in your account. Agents created through the plugin are private until you publish them yourself in Agent One; the plugin cannot make an agent public. Once you publish an agent, it is public: anyone with the link, or any website where you embed the agent, can view it and chat with it, and visitor conversations and lead form submissions are handled as described elsewhere in this policy. Only publish information you have the right to make public. We may screen this content with automated moderation from our AI providers to prevent abuse.
When you ask the assistant for information, Agent One returns the data needed to answer that request. Depending on what you ask, this can include your account name and email address; your agents' names, descriptions, instructions, greetings, knowledge source names, and public page links; visitor conversation transcripts, statuses, and feedback; conversation counts and other analytics; and lead form submissions, which may contain a visitor's name, email address, phone number, or other answers, along with the page where the form was submitted. The plugin does not return visitor IP addresses or locations. If you approve a change, the plugin updates a private agent's instructions or adds the knowledge you confirmed.
When you ask the assistant to make a listing video, Agent One downloads the photos you uploaded to the assistant from the file links its provider gives us, and receives the details you asked to show in the video, such as an address, price, headline, highlights, and your name, brokerage, and contact information. We do not receive the rest of your conversation. We store the photos with our cloud storage provider so our video rendering provider can create the video, and the rendering provider stores the finished video. Stored photos sit at long, unguessable web addresses that the rendering service reads; we do not publish or list them, but anyone who obtained one of those addresses could open that photo. Finished videos belong to your account: you can watch and download them in the assistant and, after signing in, in Agent One, through links that expire after about an hour. Our service providers process listing photos and videos only to provide the service, and authorized Agent One personnel may access them for support, security, or legal reasons. We may screen photos and text with automated moderation from our AI providers to prevent abuse. We keep listing photos and videos until you ask us to delete them or your account, as described in Data Retention.
Information returned to an assistant is shared with that assistant's provider (for example, OpenAI for ChatGPT and Codex) and is handled under your settings with that provider and its policies. Agent One does not receive or store your conversations with the assistant. To keep the connection working and secure, we process access and refresh tokens, the approved permissions, and short-lived security records (such as whether a sign-in code or refresh token has already been used), which expire within 31 days. We may keep server logs of plugin requests for security and troubleshooting as described in Data Retention. You can disconnect the plugin from the assistant's settings at any time.
We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "last updated" date. If we make material changes that expand how we use personal information, we will provide notice or obtain consent where required by law.
Agent One is operated by Swirl Software Solutions. If you have questions or requests about this Privacy Policy, contact us at help@swirlwebdesign.com.