Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains how FermAI ApS, CVR no. 45902749, Brønshøj Kirkevej 26, 2700 Brønshøj, Denmark ("FermAI", "we", "us"), collects and uses personal data when you visit www.agentwork.com (the "Site") or use the Agentwork service (the "Service").

We are the data controller for the personal data described here. For questions or to exercise your rights, contact us at [email protected].

1. Scope

This policy covers:

• visitors to the Site, and
• account holders who sign up for and use the Service.

It does not cover the company content that business customers connect to the Service (for example, data from Slack, Notion, or Google Workspace). For that content we act as a data processor on the customer's behalf; the customer is the controller, and the processing is governed by our Data Processing Agreement (DPA), available at https://trust.agentwork.com. Section 5 additionally describes how we handle data received through Google's APIs, as Google's API policies require.

2. What we collect

Information you give us

• Sign-up and account data: name, work email, organization, and credentials.
• Communications: messages you send us, and support or sales correspondence.
• Billing data: for paid subscriptions, billing details processed through our payment provider. We do not store full card numbers.

Information collected automatically

• Usage data: how you interact with the Site and Service, collected via our product analytics provider, PostHog, including pages viewed, features used, approximate location derived from IP, device and browser type, and timestamps.
• Cookies and similar technologies: as described in Section 6.

3. Why we use it, and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Create and manage your account; provide the Service	Performance of a contract
Process payments and prevent fraud	Contract; legal obligation
Respond to enquiries and provide support	Contract; legitimate interest
Analyse and improve the Site and Service	Consent (where required) or legitimate interest
Send service and security notices	Contract; legitimate interest
Send marketing communications	Consent (you can withdraw at any time)
Comply with legal and accounting obligations	Legal obligation

Where we rely on legitimate interest, it is our interest in operating, securing, and improving our business, balanced against your rights.

4. Who we share it with

We share personal data only as needed to run the Service, with:

• Sub-processors who host and support the Service (such as cloud hosting, analytics, and payment providers). Our current sub-processor list is available at https://trust.agentwork.com.
• Professional advisers and authorities where required by law or to protect our rights.
• A successor entity in the event of a merger, acquisition, or similar transaction.

We do not sell personal data.

5. Google user data and Google API Limited Use

When you connect a Google account to the Service — your personal Google Drive, Gmail, Google Calendar, and Google Ads — you authorize us to access Google user data through Google's APIs on your behalf. Separately, an organization's owner or admin can connect a Google Workspace domain on behalf of the whole organization. Depending on the permissions granted, this may include:

• Google Drive file content and metadata, so the Service can index your documents and allow the AI assistant to answer questions from them;
• Google Drive sharing permissions, which we read so that access to a document inside the Service reflects how it is shared in Google Drive (an organization's administrator may additionally designate certain shared or organizational drives as visible to their whole organization);
• where you grant write access, the ability to create, edit, comment on, share, and move to trash Google Drive files. Each such action is carried out only after your explicit in-product approval and is performed as you, under your own authorization, so Google's own permission checks always apply. Deletions use Google Drive's recoverable Trash rather than permanent deletion;
• Gmail messages, threads, drafts, and labels, which the Service reads so the AI assistant can search and answer questions from your mail; and, where you grant write access, the ability to create drafts, apply and remove labels, and send email on your behalf. We do not delete your email. Sending a message and any other change to your mailbox is carried out only after your explicit, per-action in-product approval and is performed as you, under your own authorization;
• Google Calendar calendars and events, including free/busy availability, which the Service reads so the assistant can answer scheduling questions; and, where you grant write access, the ability to create, update, respond to (RSVP), and cancel events. Creating, changing, or cancelling an event — which may notify other attendees — is carried out only after your explicit in-product approval and is performed as you, under your own authorization; and
• Google Ads account, campaign, and performance data, which the Service reads so the assistant can answer questions and produce reporting on advertising performance — including performance broken down by audience segment and by demographic — and the ability to pause or enable a campaign, ad group, or ad, set a campaign's daily budget or an ad group's CPC bid, and add or remove negative keywords. Google publishes no read-only Google Ads permission, so the single permission we request authorizes both reading and these changes; what the Service can do with it is limited by the features we build, not by the permission itself. By default every such change is carried out only after explicit, per-action in-product approval by a person at your organization, and we record who requested and who approved it; an organization's owners or admins can opt a specific action out of that approval step, and changes made through an action opted out in that way run without one. A Google Ads connection is made by each person individually, and their calls — including approved changes — run under their own Google account, so the Service reaches only the Google Ads accounts that person can already reach and Google's own records attribute the changes to them. We cannot create or delete campaigns, ad groups, or ads, and we do not access billing information, account user lists, audience lists, or customer-match records.

We access and use this Google user data to provide and maintain the Service for you and your organization — including the search, assistant, and agent features described above and keeping your organization's memory accurate and consistent. Agentwork's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we do not use Google user data for advertising, or to target or serve ads — where you connect Google Ads, we act on your organization's own advertising accounts solely at your instruction;
• we do not permit humans to read it, except with your consent (including where your organization's administrator enables Agentwork support staff to access your organization's data for troubleshooting), where necessary for security or to comply with the law, or in aggregated and anonymized form for internal operations; and
• we do not use it to develop, improve, or train generalised or non-personalised artificial-intelligence or machine-learning models.

Where service providers (including our AI model providers) process this data to deliver the features you request, they act only on our behalf and under obligations at least as protective as those in this policy. Gmail, Google Calendar, and Google Ads data is accessed on demand to carry out the request you make and is not ingested into or retained in your organization's memory; only Google Drive content is indexed and stored to power search and the assistant. You can disconnect a Google account at any time, which removes our ongoing access; for a personal Google Drive connection, disconnecting also deletes the content ingested through it. For organization-level Google Workspace connections, ingested content is customer content and its deletion is handled under the DPA (see Section 1).

For business customers, Google Workspace content connected to the Service is customer content that we process as a data processor on the customer's behalf under the DPA (see Section 1); this Section describes how we handle Google user data received through Google's APIs regardless of that role.

6. Cookies and analytics

We use cookies and similar technologies that are strictly necessary to run the Site, and — with your consent — analytics technologies to understand and improve how the Site and Service are used.

When you first visit the Site, our cookie banner lets you accept or decline non-essential cookies and tracking. You can change your choice at any time through the "Cookie settings" link in the Site footer. We do not set non-essential cookies or run consent-based analytics until you agree.

7. Where your data is processed

We host and process personal data within the EU/EEA. Where any provider processes personal data outside the EU/EEA, we rely on an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses. Current sub-processors and their locations are listed at https://trust.agentwork.com.

8. How long we keep it

We keep personal data only as long as needed for the purposes above:

• account data for as long as your account is active, and a limited period afterwards;
• billing records for the period required by accounting and tax law (generally five years in Denmark);
• analytics data for a limited retention window; and
• support and marketing data until you object or withdraw consent, subject to legal retention requirements.

When data is no longer needed, we delete or anonymise it.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure ("right to be forgotten");
• restrict or object to processing;
• request data portability;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these, contact us at [email protected]. We will respond within the timeframes required by law.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) or your local supervisory authority.

10. Security

We use technical and organizational measures appropriate to the risk, including access controls, encryption in transit, and a permission-aware architecture. We are working towards ISO 27001 and SOC 2 certification. No system is completely secure, but we take protecting your data seriously and will notify you and the relevant authority of a personal data breach where required by law. You can review our current security posture at https://trust.agentwork.com.

11. Children

The Site and Service are not directed at children. We do not knowingly collect personal data from children below the age of digital consent that applies to them (13 in Denmark). If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, give additional notice.

13. Contact

FermAI ApS CVR no. 45902749 Brønshøj Kirkevej 26, 2700 Brønshøj, Denmark [email protected] Trust center: https://trust.agentwork.com