Privacy Policy

HomePrivacy Policy
  1. Introduction & Scope
    This Privacy Policy governs all collection, storage, processing, disclosure, and cross-border transfer of information when you access and use HermCoze Agent, including our official website, web dashboard, cloud SaaS services, on-premises private deployment solutions, open API and all autonomous multi-agent task execution capabilities.
    The policy applies to individual power users, creative studios and enterprise customers worldwide. By registering an account, logging in or using our Services, you acknowledge that you have read, understood and accepted all terms of this Privacy Policy. If you access the platform on behalf of an organization, you warrant you hold valid authorization to bind such entity.
    We design data practices in compliance with the EU GDPR, UK Data Protection Act, California CCPA/CPRA, Singapore PDPA, and for users located in Mainland China, the PIPL (Personal Information Protection Law of PRC), Cybersecurity Law and Data Security Law. Where conflicting mandatory local legislation exists, the stricter local legal requirements shall prevail.
    Core guiding principles: data minimisation, purpose limitation, transparency, confidentiality, integrity, and user autonomy.
  2. Information We Collect
    We only collect information strictly necessary to deliver and operate the Services. No non-mandatory information will be collected without your voluntary consent.
    2.1 Account & Subscription Information
    Data you actively submit during registration and authentication: username, email address, login contact information. For enterprise clients: entity name, authorized contact details, business verification materials, billing and invoicing information.
    2.2 Agent Interaction & Task Data (Core Service Data)
    Information generated when you deploy autonomous agents, processed solely to execute your assigned tasks:
    Natural language instructions, prompts, task objectives and conversation inputs;
    Files uploaded by you: documents, spreadsheets, source code, business materials and other attachments;
    Sandbox execution logs: task decomposition trails, automated browser operations, code execution records, validation results and failure retry logs;
    Agent long-term memory & skill iteration data: opt-in only. You may disable the memory function or erase all stored memory records at any time via account settings.
    2.3 Device & Access Log Data
    Collected for service stability, security monitoring, error diagnostics and abuse prevention: IP address, device type, browser & OS version, access timestamps, API invocation records, crash logs. We avoid persistent cross-device tracking.
    2.4 Transaction Data
    Subscription plans, order records and billing history. We do not store full credit card or sensitive financial information. All payment handling is processed by licensed third-party payment processors subject to their own privacy terms.
    2.5 Sensitive Personal Data
    We do not proactively collect identity numbers, residential addresses, biometrics or other categories of sensitive personal data. If you voluntarily upload sensitive personal information for task execution, such data will be protected by strict isolation and encryption.
  3. Purposes of Processing Your Information
    We process data only for legitimate, specified and transparent purposes. No secondary undefined commercial use will occur without your explicit consent.
    Service Delivery: Deliver core platform capabilities including autonomous task planning, multi-agent collaboration, isolated sandbox execution, result verification, automatic retry and long-running task scheduling.
    Platform Maintenance & Optimisation: Troubleshooting, vulnerability remediation and agent logic improvement. You may opt out of non-essential data-driven optimisation.
    Security & Risk Control: Account authentication, access control, malicious request detection and anti-abuse protection.
    User Support & Contract Performance: Process support tickets, respond to enquiries and fulfil legal and contractual obligations.
    Critical AI Data Commitments
    No default model training: Your prompts, uploaded files, task records and private agent memory will NOT be used for training public foundational AI models without your separate written consent.
    Tenant logical isolation: All user and enterprise data is separated by default and never shared across independent accounts.
    Content ownership: All materials you upload and outputs generated by HermCoze Agents belong to you. We obtain no independent commercial rights to use or distribute such content.
  4. Automated Decision-Making & AI Transparency
    HermCoze relies on automated multi-agent workflows to split tasks, execute operations and validate outputs.
    These automated processes improve task efficiency but will not generate legally binding decisions that solely determine your legal rights, obligations or status.
    You hold the right to request human review for any automated agent result you dispute. Full execution logs are traceable, auditable and exportable.
  5. Cookies and Tracking Technologies
    We deploy strictly necessary cookies to maintain login sessions and store interface preferences, required for basic platform operation.
    Non-essential analytics, profiling and advertising trackers remain disabled by default. You may block cookies via browser configuration; partial UI functions may be affected, while core agent capabilities remain available. We do not conduct cross-site behavioural advertising tracking.
  6. Data Storage, Deployment Models & Retention Rules
    6.1 Security Measures
    All cloud data is protected by TLS 1.3 encryption in transit and AES encryption at rest. Task workloads run inside isolated Kata Containers sandboxes to mitigate cross-tenant data leakage risks.
    6.2 Deployment Modes & Data Residency
    Cloud SaaS Users: Data will be stored in designated compliant cloud regions. Regional data residency options are available upon customer request.
    On-Premises / Private Deployment Enterprise Users: All business and account data resides within infrastructure controlled by the customer. We only conduct remote maintenance under explicit written authorisation and retain no copies of customer private data.
    6.3 Special Rule for Users Located in Mainland China
    If you are a user based in Mainland China:
    Personal information generated within Mainland China service scenarios will comply with PIPL data localisation requirements as applicable;
    Any cross-border transmission of your personal information must comply with China’s data outbound regulations. We will obtain your separate consent before transferring your personal data overseas, and adopt legal safeguards including standard contracts where required.
    6.4 Retention Schedule
    Active account data: retained until you manually delete content, clear agent memory or terminate your account;
    Terminated accounts: all associated personal data will be permanently erased within 30 calendar days after deletion request confirmation;
    Compliance audit logs: preserved for the minimum period required by applicable laws, anonymised or deleted upon expiry.
  7. Data Sharing & Third-Party Processing
    We never sell, rent or trade your personal or business data under any circumstances. Information may only be shared in the following limited compliant scenarios:
    With your explicit, verified consent;
    Trusted service providers (cloud infrastructure, payment services, notification systems). All processors execute binding data protection agreements and may only process data following our instructions;
    Legally required disclosure responding to valid judicial or regulatory official orders;
    Business succession events (merger, acquisition, asset transfer). Affected users will receive prior notice, and successors will be bound by this Privacy Policy.
    Third-Party LLM & MCP Tools Disclaimer
    HermCoze enables you to connect self-managed API keys to external large language models and custom MCP tools (such as Claude, DeepSeek, Tongyi Qwen). When you activate third-party integrations, task data will be transmitted externally. Such data processing is governed exclusively by the third party’s privacy policy. You acknowledge and assume related compliance risks.
  8. International Data Transfers
    HermCoze delivers global services, meaning data may be stored and processed outside your jurisdiction.
    Cross-border transfers are supported by adequate safeguards including EU Standard Contractual Clauses (SCCs) and formal Data Processing Agreements (DPAs) to satisfy GDPR, PDPA and international transfer standards.
    For users in Mainland China: cross-border transmission of personal information will only occur after fulfilling all outbound compliance obligations under PIPL, including obtaining separate consent where required. Enterprise customers with localisation mandates may select on-premises deployment to avoid cross-border data movement.
  9. Data Subject Rights (Global Jurisdictions)
    Subject to applicable local laws, you enjoy the following rights. To submit requests, email privacy@hermcoze.com. We will respond within 30 calendar days; complex applications may be lawfully extended by a maximum of 60 days after identity verification.
    Right of Access: Request copies of your account information, task history and agent memory;
    Right of Rectification: Correct inaccurate personal records;
    Right of Erasure (“Right to be Forgotten”): Delete conversations, uploaded files, agent memory or terminate your account;
    Right to Withdraw Consent: Disable memory iteration and optional data optimisation authorisations at any time;
    Right to Restrict Processing: Suspend specific data processing activities;
    Right to Data Portability: Export your data in structured, machine-readable format;
    Right to Object & Request Human Review: Object to processing based on legitimate interests and challenge automated agent outputs.
    9.1 Supplementary Rights for California Residents (CCPA/CPRA)
    California consumers have the right to opt out of sale of personal information. HermCoze does not sell any personal information.
    9.2 Supplementary Rights for Users in Mainland China (PIPL)
    If you are located in Mainland China, you additionally enjoy rights under the PIPL, including the right to demand explanation of automated processing logic, and the right to file complaints with local data protection authorities. You may withdraw consent for data cross-border transmission at any time.
  10. Minors Protection
    HermCoze is designed for enterprises, studios and professional power users. Our Services are not intended for individuals under the age of 18. We do not knowingly collect data from minors. Any unintentionally obtained minor personal data will be permanently deleted immediately upon discovery.
  11. Policy Updates & Notification
    We may revise this Privacy Policy to reflect legal updates, regulatory requirements or product iteration. Minor adjustments will be published on the official website. Material changes affecting your data rights will be notified via website announcement, platform notification or email in advance. Your continued use of Services after the effective update constitutes acceptance of the revised terms.
  12. Governing Law and Jurisdiction
    Users residing in EU / EEA / United Kingdom: governed by applicable GDPR and local member state legislation;
    Users residing in Singapore: governed by the Personal Data Protection Act (PDPA);
    Users residing in California, USA: subject to CCPA/CPRA;
    Users residing in Mainland China: governed by the laws of the People’s Republic of China including the PIPL, Cybersecurity Law and Data Security Law;
    All other users: governed by the law of the registered jurisdiction of our legal entity, without prejudice to mandatory local privacy legislation in your territory.
  13. Contact Information
    For privacy enquiries, data subject requests, security incident reports or complaints
    Email:privacy@hermcoze.com