Privacy Policy

Last updated: 4 August 2026 · Applies to the hosted service at astarlabshub.com

The short version

On the hosted service, your company data (tasks, results, notes, brand kit, leads/contacts you add) is stored in our managed database — hosted in the EU — so your agents can run and you can reach your data from any device.
We never store your password: sign-in is handled by Google/GitHub OAuth. Connected-app tokens are stored encrypted and used only for actions you request.
We do not sell your data and do not use it to train models.
You can export or delete everything at any time from your dashboard.
If you run the open-source, self-hosted version instead, none of your data reaches us — it stays entirely on your own infrastructure.

Who we are
Hosted vs. self-hosted
Data we collect
How we use it & legal basis
Sub-processors
Where data is stored
Retention & deletion
Your rights
Security
Breach notification
If the service ends
Cookies
Changes & contact

1. Who we are

Agentica (the "Service") is an AI platform that plans, builds and operates software companies on your behalf, available at astarlabshub.com. The Service is provided and operated by Carlos, a sole independent operator ("we", "us"), acting as the data controller for the hosted service, based in Spain (European Union).

Contact / Data Protection point of contact: [email protected]. If you require a signed Data Processing Agreement (DPA), or our full registered contact details for procurement/vendor onboarding, email us and we will provide them.

Note on the "NanoCorp" name: the internal dashboard and source repository historically used the codename NanoCorp; the public product is Agentica. They are the same service operated by the same party.

2. Hosted vs. self-hosted — which privacy terms apply to you

Agentica can be used two ways, and the privacy implications are genuinely different. This policy governs the hosted service. We call this out explicitly because earlier marketing copy blurred the two.

	Hosted (astarlabshub.com)	Self-hosted (open source)
Where your data lives	Our managed database (EU)	Your own server / machine
Who can technically access it	Us + our sub-processors (see §5)	Only you
Where your AI/API keys live	Encrypted in our database (if you add them)	Your own `.env`, never sent to us
This policy applies?	Yes	No — you are your own controller

The self-hosted option is available at github.com/cadamar1236/astarlabshub. If privacy from us is a hard requirement, self-hosting gives you full control.

3. Data we collect (hosted service)

You provide:

Account data: your name, email and avatar as supplied by Google or GitHub OAuth. We never receive or store your password.
Company & workspace content: company mission, agent configuration, tasks and their results, task history, notes, brand kit, publications, and any documents you create or upload.
Data you feed to your agents: e.g. lead lists, customer records, investor lists, business metrics. You control whether to put such data on the platform.
Integration tokens: OAuth tokens for connected apps (Gmail, GitHub, Linear, social, Stripe, etc.), stored encrypted, used solely to perform actions you request.
Billing data: plan and usage counters. Card payments are processed by Stripe — we do not store card numbers.

Collected automatically:

Usage & diagnostic logs (actions taken, errors, timestamps) to run and debug the Service.
Basic analytics via Google Analytics, only if you consent to analytics cookies (see §12).

4. How we use your data & legal basis (GDPR)

Purpose	Legal basis
Provide the Service (run agents, store & serve your data, perform requested integration actions)	Performance of a contract
Billing, fraud prevention, support	Contract / legitimate interests
Security, debugging, service improvement	Legitimate interests
Analytics cookies	Consent

We do not sell your personal data, and we do not use your company content to train AI models.

5. Sub-processors

We rely on the following infrastructure providers to deliver the hosted service. Each processes data only as needed to provide their function:

Sub-processor	Purpose
Railway	Application hosting & managed PostgreSQL database
Cloudflare	DNS, CDN, DDoS protection, R2 object storage for generated sites
Google Cloud (Cloud Run)	Isolated per-company backend runtime
DeepSeek (and any AI model provider you select)	Powers agent reasoning on the prompts your tasks generate
Composio	Brokers OAuth connections to third-party apps
Stripe	Payment processing
Resend	Transactional & report emails
Google Analytics	Website analytics (consent-gated)

We will keep this list current and give notice of material changes. A full sub-processor list with entity/location detail is available on request for enterprise due diligence.

6. Where your data is stored

Primary application data is stored in the European Union. Some sub-processors (e.g. AI model providers, Cloudflare's global CDN) may process data outside the EU; where that occurs, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

7. Retention & deletion

While your account is active, we keep your data so the Service works.
Deleting a company removes its database row immediately; associated generated-site artifacts and object storage are purged shortly after (typically within minutes, via a background cleanup job).
Deleting your account removes your companies and personal data from our production systems. Residual copies in encrypted backups are purged on our rolling backup cycle, within 90 days.
Logs are retained for a limited period for security and debugging, then rotated out.

8. Your rights

Under GDPR, UK GDPR and CCPA you may: access your data, correct it, delete it, export it (portability), object to or restrict certain processing, and withdraw consent. You can:

Export a full copy of any company's data from the dashboard, or via GET /api/companies/<name>/export while signed in.
Delete a company or your whole account from the dashboard.
Ask us anything at [email protected] — we respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Security

Encryption in transit (HTTPS/TLS everywhere).
Passwords never handled — authentication delegated to Google/GitHub OAuth.
Connected-app tokens and any stored API keys are encrypted at rest.
Per-company database isolation (separate schema per company).
Standard HTTP security headers (HSTS, nosniff, Referrer-Policy, Permissions-Policy).

No online service is perfectly secure, but we work to protect your data and to be honest about what we do and don't do.

10. Breach notification

If a personal-data breach is likely to affect you, we will notify affected users and, where required, the relevant supervisory authority within 72 hours of becoming aware, describing what happened and what we're doing about it.

11. What happens if the Service is discontinued

If we ever decide to wind the hosted service down, we will give reasonable advance notice by email and keep the export function available so you can retrieve all your task results and company data before shutdown. The open-source version means you can also continue running the software yourself.

12. Cookies

We use a strictly-necessary session cookie to keep you logged in. Analytics cookies (Google Analytics) load only if you accept them in the cookie banner; you can decline and the Service still works fully.

13. Changes & contact

We may update this policy; material changes will be announced on this page with a new "last updated" date. Questions, DPA requests, or data requests: [email protected].