Privacy Policy

Last updated: 10 July 2026

This Policy explains how Agent Nine LLP (ТОО «Agent Nine»), BIN 260740007202, 55/6-72 Turan Avenue, Nura District, Astana, Republic of Kazakhstan ("we", "us"), collects, uses, shares, and protects personal data when you use Agent Nine ("the Service"). We are the data controller for this processing.

1. Data we collect

• Account data: your email address, authentication identifiers, plan, and settings.
• Usage & technical data: request and event logs, model and quota usage, feature usage, IP address, approximate region, device and operating system, app version, language, and diagnostic/crash data.
• Your content: the prompts, code, files, and instructions you send to the AI agent, and the responses generated for you.
• Payment data: subscription and transaction records. Card details are handled by our payment provider (see §6); we do not store full card numbers.
• Cookies & local storage: small identifiers used to keep you signed in, remember preferences, and secure the Service (see §7).
• Communications: messages you send to support and related correspondence.

2. How we collect it

We collect data you provide directly (account, content, support messages) and data collected automatically when you use the app (usage, technical, and cookie data).

3. Why we use it and legal bases

• To provide the Service — to perform our contract with you (accounts, running the agent, subscriptions, quotas).
• To secure the Service and prevent abuse and fraud — our legitimate interests.
• To provide support and send service messages — contract and legitimate interests.
• To maintain, debug, and improve the Service — legitimate interests.
• To comply with law — legal obligation.

We process personal data under the Personal Data Protection law of the Republic of Kazakhstan (Law No. 94-V) and, where applicable, other data protection laws.

4. AI processing and model training

To generate responses, your content is sent to our AI model sub-processors (including Anthropic) and processed only to produce your output. We do not use your content or code to train our own models, and we do not sell it. Our AI sub-processors process content under their own terms and, under our business/API access, do not train their models on the data we send. Some AI sub-processors operate outside Kazakhstan (see §9).

5. Data retention

We keep account data while your account is active and as needed to provide the Service. Usage, technical, and diagnostic logs are kept for a limited period for security, debugging, and legal purposes, then deleted or anonymized. When you delete your account, we delete or anonymize your personal data unless longer retention is required by law.

6. Payments

Payments are processed by our payment provider and Merchant of Record, Polar (polar.sh), which acts as an independent controller of the payment data it collects (including card and billing details). Please review Polar's privacy policy.

7. Cookies and local storage

We use strictly necessary cookies and local storage to authenticate you, maintain your session, and secure the Service, plus minimal analytics and error monitoring to keep it reliable. We do not use advertising cookies and do not sell your data. You can control cookies in your browser, but disabling essential ones may break the Service.

8. Sharing and sub-processors

We do not sell personal data. We share data only with service providers that help us run the Service, acting on our instructions, in these categories: cloud hosting (Stockholm, Sweden, EU), AI model providers (including Anthropic), payments (Polar), email and communications, and analytics/error monitoring. We may also disclose data where required by law or to protect our rights, our users, or the public.

9. International transfers

Your data is hosted on servers in Stockholm, Sweden (European Union). As we are established in the Republic of Kazakhstan and some sub-processors (including AI model providers) operate in other countries (including the United States), your personal data may be processed in those countries; where this happens we rely on appropriate safeguards.

10. Security

We use reasonable technical and organizational measures to protect personal data, including access controls and encryption in transit. No method of transmission or storage is completely secure. If a breach affecting your rights occurs, we will act in line with applicable law.

11. Your rights

Subject to applicable law, you may request access to, correction, or deletion of your data; restrict or object to certain processing; request portability; and withdraw consent where processing is based on it. To exercise your rights, email privacy@agentnine.io. You also have the right to lodge a complaint with the authorized personal-data protection body of the Republic of Kazakhstan or your local supervisory authority.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13. Changes

We may update this Policy; material changes will be posted at agentnine.io with a new "Last updated" date.