Privacy Policy
This Privacy Policy explains how Purogaly Advisory Group, doing business as DeployCo (“DeployCo,” “we,” “our,” or “us”) collects, uses, stores, and discloses information about you when you visit our website, use our platform, or engage with us as a customer. Please read this policy carefully.
1. Who we are
DeployCo is an AI agent deployment and governance platform. We design, deploy, and operate AI agents for businesses — enabling them to automate specific operational tasks while maintaining human oversight and a complete audit trail.
Our registered business is Purogaly Advisory Group, a California company. Our primary place of business is California, United States. For privacy-related inquiries, you may contact us at hello@deployco.co.
2. Information we collect
We collect information in three ways: information you provide to us directly, information generated through your use of the platform, and limited technical information collected automatically.
2.1 Information you provide directly
- Contact and inquiry information. When you submit a contact form on our website, we collect your name, work email address, company name, role, and the content of your message.
- Account and organizational information. When we onboard you as a customer, we collect your name, email address, company name, and role for the purpose of creating and managing your account.
- Agent configuration data. When you or our team configures an AI agent on your behalf, we collect the goals, rules, tool permissions, voice samples (if provided), and policy configurations that define how your agent operates.
- Content submitted for processing. We collect any content you submit to the platform — such as writing samples, brand guidelines, topic lists, or business rules — for the purpose of configuring and operating your agents.
2.2 Information generated through platform use
- Agent execution records. Each time an agent runs, we record the execution details: what triggered it, what the agent reasoned, which tools it called, and what it produced.
- Draft content. Content generated by agents on your behalf is stored in our system for your review, approval, or rejection.
- Approval decisions. Every approval, edit, or rejection decision made by your team members is logged with a timestamp and actor identity.
- Audit log entries. All platform actions — by agents, by your team, and by our administrative team — are recorded in an append-only audit log.
2.3 Technical information collected automatically
- Usage data. Standard web server logs, including IP addresses, browser type, pages visited, and timestamps. We do not use this data to identify individuals.
- Authentication tokens. We store encrypted session tokens necessary to keep you logged in to the platform.
3. How we use your information
We use the information we collect for the following purposes:
- To provide the service. We use your configuration data, content, and execution records to design, deploy, and operate AI agents on your behalf.
- To respond to inquiries. We use contact form submissions to reply to your questions and evaluate whether we are a fit for your needs.
- To maintain an audit trail. We log all platform actions to provide you and your compliance team with a complete, verifiable record of agent activity.
- To monitor and improve agent performance. We review execution records to detect drift, identify edge cases, and improve the agents we operate for you.
- To communicate with you. We may send operational communications — such as notifications when a draft is ready for review, or alerts when an agent encounters an error.
- To comply with legal obligations. We process certain data as required by applicable law, regulation, or lawful government request.
We do not use your data for advertising. We do not sell your data to third parties. We do not train AI models on your content.
4. Legal bases for processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases as defined in the General Data Protection Regulation (GDPR):
- Performance of a contract. Processing necessary to provide the services you have engaged us to deliver.
- Legitimate interests. Processing necessary for our legitimate business interests, including platform security, service improvement, and fraud prevention, provided those interests are not overridden by your rights.
- Legal obligation. Processing required to comply with applicable law.
- Consent. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
5. How we share your information
We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:
- Infrastructure and hosting providers. We use Supabase, Inc. to host our platform database and Edge Functions. Your data is stored on servers located in the United States (West US region). Supabase processes data on our behalf as a data processor, under appropriate data processing agreements.
- AI model providers.When an agent runs, we send prompts to Anthropic, PBC's Claude API to generate outputs. These prompts may include your agent's configuration and contextual information. Anthropic processes this data under their own API terms and privacy policy. We do not send personally identifiable information about your end customers to Anthropic unless you explicitly include it in your agent configuration.
- Legal and regulatory disclosure. We may disclose your information where required by applicable law, court order, or government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of DeployCo, our customers, or the public.
- Business transfers. In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website prior to your data becoming subject to a different privacy policy.
6. Data retention
We retain your personal data for as long as your engagement with DeployCo is active, and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements.
- Contact form submissions. Retained for 24 months from submission, or until you request deletion.
- Agent configuration and execution records. Retained for the duration of your engagement plus 12 months, unless a longer retention period is required by applicable law or agreed upon in writing.
- Audit log entries. Retained for a minimum of 36 months. Audit logs may be retained longer where required by regulatory obligation.
- Account data. Retained until your account is closed, plus 12 months.
Upon expiry of the applicable retention period, we will securely delete or anonymize your data.
7. Data security
We implement technical and organizational measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Row-level security enforced at the database layer, ensuring one customer's data is never accessible to another.
- Encrypted transport (TLS) for all data in transit between your browser, our platform, and third-party services.
- Authentication token verification on every platform operation.
- Service-role isolation: administrative database writes are performed under a restricted service role that is not exposed to end-user sessions.
- Access controls limiting DeployCo personnel access to customer data to what is necessary for operating and supporting the service.
No method of electronic storage or transmission is completely secure. While we take these protections seriously, we cannot guarantee absolute security. We will notify affected customers without undue delay in the event of a data breach that is likely to result in a risk to your rights and freedoms.
8. Your rights
8.1 Rights under GDPR (EEA and UK residents)
If you are located in the EEA or UK, you have the following rights:
- Right of access. You may request a copy of the personal data we hold about you.
- Right to rectification. You may request correction of inaccurate or incomplete data.
- Right to erasure. You may request deletion of your personal data, subject to our legal retention obligations.
- Right to restriction. You may request that we restrict processing of your data in certain circumstances.
- Right to data portability. You may request your data in a structured, commonly used, machine-readable format.
- Right to object. You may object to processing based on legitimate interests.
- Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time.
To exercise these rights, contact us at hello@deployco.co. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
8.2 Rights under CCPA (California residents)
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:
- The right to know what personal information we collect, use, disclose, and sell.
- The right to delete personal information we have collected, subject to certain exceptions.
- The right to opt out of the sale of personal information. We do not sell personal information.
- The right to non-discrimination for exercising your CCPA rights.
To submit a CCPA request, contact us at hello@deployco.co.
9. International data transfers
DeployCo is based in California, United States. If you access our platform from outside the United States, your information will be transferred to, stored, and processed in the United States. We take steps to ensure that such transfers comply with applicable data protection law, including, where required, implementing Standard Contractual Clauses approved by the European Commission for transfers from the EEA.
10. Cookies and tracking
Our website uses only the cookies necessary to operate the platform — specifically, authentication session cookies that keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics that follow you across websites.
You may disable cookies in your browser settings, but doing so may prevent you from accessing authenticated areas of the platform.
11. Children's privacy
The DeployCo platform is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will delete that information promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify affected customers by email at least 14 days before the changes take effect, and update the “Last updated” date at the top of this page. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.
13. Contact us
For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact: