Privacy Policy

1. Data we process

We process account, billing, deployment metadata, and operational logs required to run your hosted OpenClaw instances.

2. Google user data

When you sign in with Google or connect Google services to Agentbot, we may access the following Google user data:

• Your Google account profile information (name, email address, profile picture) for authentication and account creation.
• Google API tokens and refresh tokens to maintain persistent access to connected services on your behalf.
• Data from Google services you explicitly connect (e.g. Gmail, Calendar, Drive) as required for the agent features you activate.

3. How we use Google user data

Google user data is used exclusively to:

• Authenticate your account and maintain your session.
• Provide, maintain, and improve the Agentbot features you have enabled.
• Operate AI agent workflows that you configure to interact with your Google services.

We do not use Google user data for advertising, marketing, or any purpose unrelated to providing or improving Agentbot functionality.

4. Sharing and disclosure of Google user data

We do not sell Google user data. We do not share, transfer, or disclose Google user data to third parties except:

• With your explicit consent, such as when you configure an agent to send data to an external service.
• With AI model providers (e.g. OpenRouter, Anthropic, OpenAI) when you enable AI features that process your Google data — only the minimum data required for the requested operation.
• As required by law or to protect the security of our services.

5. Data protection

We protect Google user data with the following mechanisms:

• All data is encrypted in transit (TLS 1.2+) and at rest.
• Google API tokens are stored encrypted and never exposed in logs or UI.
• Each user's agent instance runs in an isolated environment with scoped access.
• We follow the principle of least privilege — agents only access Google data you explicitly authorize.

6. AI provider credentials

Your model provider keys are used to configure your instance and power your requests. Handle and rotate keys as needed.

7. Payments

Payment information is handled by Stripe. We do not store full card details on our servers.

8. Retention and deletion

Google user data is retained only as long as your account is active or as needed to provide our services. You may request deletion of your data at any time through your dashboard or by contacting support. Upon account deletion, all associated Google tokens and data are permanently removed within 30 days.

9. Contact

For privacy requests, contact support through your dashboard channel.