This Privacy Policy describes how MESH LABS ("we", "us", or "our") collects, uses, and discloses your personal information when you visit or use AgentWing, make a purchase through agentwing.io (the "Site"), or otherwise communicate with us (collectively, the "Services"). For the purposes of this Privacy Policy, "you" and "your" mean you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

AgentWing is a product operated by MESH LABS. MESH LABS is the data controller for the purposes of applicable data protection laws.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

Data roles

Depending on the context of use, we may act as:

• a data controller (for account, billing, and platform usage data), and/or
• a data processor (when processing the content you and your team create within your workspace on your behalf).

Where you use AgentWing to process personal data about others (for example, information contained in the documents and workbooks your team creates), you act as the data controller for that content and are responsible for determining your own compliance obligations.

What Personal Information We Collect

The types of personal information we obtain about you depend on how you interact with our Site and use our Services. When we use the term "personal information", we are referring to information that identifies, relates to, describes, or can be associated with you. The following sections describe the categories and specific types of personal information we collect.

Information We Collect Directly from You

Information that you directly submit to us through our Services may include:

• Basic contact details including your name and email address.

• Account information including your username, password, and profile details.

• Billing information including your billing name, billing address, and payment confirmation. Card details are collected and processed directly by our payment processor and are not stored by us.

• The content you create, upload, or submit within the Services, including workbooks, documents, comments, knowledge sources, and instructions you provide to your AI agent.

Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.

Usage Data We Collect Through Your Activity

Usage data is collected automatically when using the Services.

Usage data may include information from any device that can access the Services such as your device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Services that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Services.

Information We Collect Through Cookies

We also automatically collect certain information about your interaction with the Services. To do this, we may use cookies, pixels and similar technologies ("Cookies"). We use Cookies to power and improve our Site and our Services (including to remember your actions and preferences), and to run analytics and better understand user interaction with the Services.

Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available.

For full details of the cookies we use and how to manage them, please see our Cookie Policy.

Information We Obtain from Third Parties

We may obtain information about you from third parties, including from vendors and service providers who collect information on our behalf, such as:

• Companies who support our Site and Services, including our hosting and infrastructure providers.

• Our payment processor, who collects payment information (e.g. card information and billing address) to process your payment in order to fulfil your orders and provide you with the Services you have requested.

• Where you sign in using a third-party identity provider (for example, Google or GitHub), we receive basic profile information such as your name and email address from that provider.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices.

How AI Features Process Your Content

AgentWing uses artificial intelligence to draft, review, summarise, and answer questions about your work. To provide these features, the content relevant to a given request (for example, the workbook you are working on and the knowledge sources your agent is permitted to access) is sent to third-party AI model providers acting as our subprocessors.

These providers process your content solely to return a result to you. We contract with providers on terms that prohibit the use of your content to train their models, except where you have separately and explicitly opted in to any such feature.

Your AI agent only draws on sources within the scopes you are permitted to access. It does not access private content belonging to other people or teams that you have not been granted access to.

Legal basis for processing

We process personal data on the following legal bases:

• Performance of a contract — providing the Services and fulfilling our obligations to you.
• Legitimate interests — service improvement, security, and fraud prevention.
• Legal obligations — compliance with applicable laws and regulations.
• Consent — where applicable, such as for non-essential analytics cookies, which you may withdraw at any time.

How We Use Your Personal Information

We may use your personal information in the following situations:

• Providing the Services. We use your personal information to provide you with the Services in order to perform our contract with you, including to process your payments, send notifications related to your account or transactions, and create, maintain, and otherwise manage your account.

• Operating AI features. We use the content you provide to generate the drafts, reviews, summaries, and answers you request from your AI agent.

• Communicating with you. We use your personal information to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you and to maintain our business relationship with you.

• Marketing. Where permitted, we may send you marketing and promotional communications by email. You can opt out of these at any time.

• For business transfers. We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of our assets.

• For other purposes. We may use your information for purposes such as data analysis, identifying usage trends, determining the effectiveness of our communications, and evaluating and improving our Services and your experience.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• With vendors or other third parties who perform services on our behalf, including hosting and infrastructure providers, our payment processor, AI model providers, analytics providers, and error-monitoring providers.

• With other members of your workspace or organisation. Content you create or share within a workspace may be visible to other members of that workspace in accordance with the access controls that apply.

• When you direct us, request it, or otherwise consent to our disclosure of certain information to third parties.

• In connection with a business transaction such as a merger or acquisition, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

• With your consent, we may disclose your personal information for any other purpose.

Security and Retention of Your Information

Data retention

We retain personal data only for as long as necessary to:

• provide the Services
• comply with legal obligations
• resolve disputes
• enforce agreements

Usage data is generally retained for a shorter period of time, except when this data is used to strengthen the security or improve the functionality of our Services, or where we are legally obligated to retain it for longer periods. When you delete content or close your account, we delete or anonymise the associated personal data within a reasonable period, subject to any retention required by law.

Security measures

We implement reasonable technical and organisational measures, including:

• encryption of data in transit and, where applicable, at rest
• access controls and authentication mechanisms
• logging and monitoring of system activity

However, no system can be guaranteed to be completely secure. We do not warrant that unauthorised access, hacking, data loss, or other breaches will never occur.

Data breach handling

In the event of a data breach affecting personal data, we will take reasonable steps to:

• investigate the incident
• mitigate its effects
• notify affected users and regulators where required by applicable law

This is in accordance with our obligations under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (GDPR) Articles 33–34.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

Under applicable data protection laws (including the UK GDPR, the Data Protection Act 2018, and the EU GDPR), you may have rights to:

• Access your data — request access to personal information that we hold about you.
• Correct inaccuracies — request that we correct inaccurate personal information we maintain about you.
• Request deletion — request that we delete personal information we maintain about you.
• Restrict processing — ask us to stop or restrict our processing of personal information.
• Data portability — receive a copy of the personal information we hold about you and request that we transfer it to a third party, in certain circumstances.
• Object to processing — object to our processing of your personal information in certain circumstances.
• Withdraw consent — where we rely on consent to process your personal information, withdraw this consent at any time.
• Appeal — appeal our decision if we decline to process your request by replying directly to our denial.
• Manage communication preferences — opt out of receiving promotional emails at any time by using the unsubscribe option displayed in our emails to you or by contacting us using the details provided below. If you opt out, we may still send you non-promotional emails such as those related to your account or your ongoing use of the Services.

You may exercise any of these rights by contacting us using the contact details provided below.

We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity before providing a substantive response to your request. In accordance with applicable laws, you may designate an authorised agent to make requests on your behalf. We will respond to your request in a timely manner as required under applicable law.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, you may have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Third-party processors

We use third-party service providers (for example hosting, payment processing, AI model providers, analytics, and error monitoring) to operate the Services. These providers process data on our behalf under appropriate safeguards. A current list of our subprocessors is available on request.

International Users

Personal data may be transferred to and processed in the United States or other jurisdictions outside your country of residence. Your personal information may also be processed by staff and third-party service providers and partners in these countries.

Where required, we implement appropriate safeguards for such transfers. If we transfer your personal information out of the UK or Europe, we will rely on recognised transfer mechanisms, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Children's Privacy

Our Services do not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from anyone under the age of 18 without appropriate consent, we take steps to remove that information from our servers.

Links to Other Websites

Our Services may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. By continuing to use the Services after the effective date of any changes, you agree to be bound by the modified terms.

Governing law

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. This Privacy Policy should be read in conjunction with our Terms of Service.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at hello@agentwing.io.

For the purpose of applicable data protection laws, MESH LABS is the data controller of your personal information.

MESH LABS · hello@agentwing.io