Agor Cloud Privacy Policy

Last Updated: September 18, 2026

Preset, Inc. ("Preset," "we," "us," or "our") provides Agor Cloud, a cloud-based AI orchestration platform that helps you and your team coordinate work across the AI tools, agents, and providers you use (the "Service" or "Agor Cloud"). This Privacy Policy explains how we collect, use, disclose, and protect information in connection with Agor Cloud, including the Agor Cloud console at console.agor.cloud (together with the Service, the "Agor Cloud Services").

This Privacy Policy supplements the Preset Privacy Notice and should be read together with the Agor Cloud Terms of Service (the "Terms"). If there is a conflict between this Privacy Policy and the Terms with respect to Customer Content, the Terms (including the Data Processing Addendum) control.

SCOPE AND OUR ROLE
INFORMATION WE COLLECT
THIRD-PARTY AI PROVIDERS AND CONNECTED SERVICES
HOW WE HANDLE API KEYS, MCP CONNECTIONS, AND OTHER CREDENTIALS
HOW WE USE YOUR INFORMATION
NO MODEL TRAINING
HOW WE DISCLOSE YOUR INFORMATION
SECURITY OF YOUR INFORMATION; BETA STATUS
RETENTION AND DELETION
YOUR PRIVACY CHOICES AND RIGHTS
INTERNATIONAL DATA TRANSFERS
SUPPLEMENTAL U.S. STATE PRIVACY DISCLOSURES
SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS
CHILDREN'S INFORMATION
CHANGES TO THIS PRIVACY POLICY
CONTACT US

1. SCOPE AND OUR ROLE

This Privacy Policy applies to personal information processed in connection with the Agor Cloud Services. It applies to Agor Cloud as hosted and operated by Preset. It does not apply to self-hosted deployments of the open-source Agor software, which are operated by you or by third parties and not by Preset. It also does not apply to the agor.live website, which serves as a general landing site for the Agor project (including the open-source software); information collected through agor.live is governed by the Preset Privacy Notice or any privacy notice posted on that site.

Preset acts in two distinct roles:

As a controller, for personal information we collect directly from you when you register for, access, and use the Agor Cloud Services — such as your account information, usage data, and communications with us. This Privacy Policy governs that processing.
As a processor (or service provider), for Customer Content — the information, data, prompts, inputs, outputs, files, and other materials that you or your organization transmit to or through the Service, including any personal information contained within it. Our processing of Customer Content is governed by the Terms, including the Data Processing Addendum, and by the instructions of the applicable Customer. If you use Agor Cloud through an organization, that organization's privacy policy governs its collection and use of Customer Content, and questions or requests relating to Customer Content should be directed to that organization.

2. INFORMATION WE COLLECT

A. Information You Provide to Us

Account and Registration. You create an Agor Cloud account by signing in with a supported identity provider (currently Google) through our authentication provider; we do not collect or store a password for the Service. From that identity provider we receive your email address, an indication of whether that email address has been verified, your name, and your profile picture. Access to Agor Cloud is currently invite-gated or capacity-gated: if you ask to join the waitlist, we collect the email address you provide for that purpose. If you register on behalf of an organization, we collect the name of that organization. If paid features are introduced, billing details will be collected as described at that time; payments are handled by third-party payment processors, and we do not directly store payment card numbers.
Customer Content. In operating the Service, we process the content you and your authorized users transmit to or through Agor Cloud, which may include: prompts and inputs you provide; outputs returned from AI tools and agents you orchestrate through Agor Cloud; session data, transcripts, and work products from connected AI providers; and your configuration and memory files. Customer Content may include personal information, depending on what you choose to route through or store in the Service. We process Customer Content as described in Section 1 and in the Terms.
Credentials for Connected Services. To orchestrate third-party AI tools and services on your behalf, the Service stores the credentials you provide or authorize for those services, which may include API keys, OAuth tokens, and credentials or endpoint configurations for Model Context Protocol ("MCP") servers. See Section 4.
Communications, Support, and Feedback. We collect personal information such as your name and email address when you contact us, request support, or provide feedback about the Service. Feedback is handled as described in the Terms.

B. Information Collected Automatically

When you use the Agor Cloud Services, we automatically collect certain information, which may include your IP address, approximate location derived from IP address, browser and device information, operating system, identifiers such as cookie identifiers, log data, and information about how you use the Agor Cloud Services (such as pages visited, features used, session duration, and workflow and usage metadata). We and our service providers may use cookies and similar technologies to collect this information, to keep you logged in, to remember your preferences, and to understand and improve how the Agor Cloud Services are used. Most browsers allow you to block or delete cookies, though parts of the Service may not function properly if you do.

C. Service Information

We may derive usage data and trends with respect to the Service ("Service Information") in de-identified and/or aggregated form. Service Information is never identified or identifiable to a specific user or customer, and we will not attempt to re-identify it. Where we make Service Information available to others, we require them to maintain it in de-identified form and not to attempt re-identification.

3. THIRD-PARTY AI PROVIDERS AND CONNECTED SERVICES

Agor Cloud is an orchestration layer: at your direction, it transmits your data to, and receives data from, third-party AI providers, agents, tools, and services that you choose to connect (for example, providers of large language models and coding agents). These connections may be established through APIs, through MCP servers, or through other integration mechanisms. When you connect a third-party service to Agor Cloud via MCP, the Service may access, retrieve data from, and take actions in that third-party service on your behalf, according to the permissions and workflows you configure.

Important: when Customer Content is transmitted to a third-party provider or service through Agor Cloud — whether via API, MCP server, or otherwise — that provider's processing of your data is governed by your agreement and relationship with that provider, not by this Privacy Policy. For example, if you use Agor Cloud to transmit data to a third-party AI service, or connect an MCP server operated by a third party, that third party's terms and privacy practices govern its handling of that data. We encourage you to review the privacy policies and data-use terms of every provider and MCP server you connect to Agor Cloud, including their positions on data retention and model training, and to configure those services (e.g., opting out of training where available, and scoping permissions narrowly) according to your needs. Preset is not responsible for the privacy or security practices of third-party providers or MCP servers you choose to connect.

4. HOW WE HANDLE API KEYS, MCP CONNECTIONS, AND OTHER CREDENTIALS

To function, Agor Cloud may store the credentials necessary to access your connected AI providers, engines, tools, and data locations on your behalf. These may include API keys, OAuth tokens and refresh tokens, and authentication credentials and endpoint configurations for MCP servers. We treat these credentials as sensitive:

Credentials are encrypted in transit and at rest.
We use your credentials solely to provide the Service — that is, to execute the connections, MCP sessions, and workflows you configure — and for no other purpose.
You may remove or rotate stored credentials, and disconnect MCP servers or other integrations, at any time through the Service; stored credentials are deleted when the associated connection or account is deleted, subject to Section 9.

You are responsible for the scope of the credentials and permissions you grant (we recommend least-privilege keys and narrowly scoped MCP server permissions where your provider supports them) and for keeping your Agor Cloud account credentials secure, as described in the Terms.

5. HOW WE USE YOUR INFORMATION

We use personal information to:

Provide, operate, maintain, and secure the Agor Cloud Services, including managing accounts, authenticating users, executing the orchestration workflows and MCP connections you configure, and storing Customer Content at your direction;
Provide customer and technical support and communicate with you about your account, the Service, and changes to our terms and policies;
Improve, debug, and develop the Agor Cloud Services, including through analysis of de-identified and aggregated Service Information;
Detect, prevent, and respond to security incidents, fraud, abuse, and violations of our Terms;
Comply with legal obligations and enforce our agreements; and
With your consent or at your direction, for other purposes disclosed at the time of collection.

We use Customer Content solely to provide and improve the Service during your subscription, as described in the Terms, and as instructed by the Customer.

6. NO MODEL TRAINING

We do not use your Customer Content — including your prompts, inputs, outputs, configuration files, or memory files — to train artificial intelligence or machine learning models, whether our own or those of our subprocessors, and we contractually require our subprocessors not to use your data for model training or for their own purposes. Note that this commitment applies to processing under Preset's control; the practices of third-party AI providers and MCP servers you connect to Agor Cloud are governed by your agreements with those providers, as described in Section 3.

7. HOW WE DISCLOSE YOUR INFORMATION

We do not sell your personal information. We may disclose personal information:

To service providers and subprocessors that help us provide the Agor Cloud Services, such as cloud hosting and infrastructure providers, subject to contractual obligations consistent with this Privacy Policy and the Terms. A current list of Preset's subprocessors is available at preset.io/Preset-Sub-Processors.pdf.
To third-party AI providers and services you connect, at your direction, whether via API, MCP server, or other integration mechanism, as described in Section 3.
To comply with law, such as in response to a subpoena, court order, or other lawful request, or to protect the rights, property, safety, or security of Preset, our users, or others.
In connection with a business transaction, such as a merger, acquisition, financing, reorganization, or sale of assets, in which personal information may be transferred as part of the transaction, subject to standard confidentiality protections.
To our affiliates, for administrative and operational purposes consistent with this Privacy Policy.

8. SECURITY OF YOUR INFORMATION; BETA STATUS

We implement and maintain physical, operational, and technical safeguards that are no less rigorous than accepted industry standard practices to protect personal information and Customer Content, including encryption of Customer Content submitted to the Service. However, no system is 100% secure, and we cannot guarantee absolute security.

Agor Cloud is currently offered as a beta service. As described in the Terms, Agor Cloud has not yet obtained the security certifications held by other Preset products, and Preset is actively working toward SOC 2 Type II certification for Agor Cloud and to enhance its reliability and security on an ongoing basis. You should take this into account when deciding what data to route through or store in the Service, and what permissions to grant to connected services and MCP servers, particularly in production settings.

If we become aware of unauthorized access to, use of, or disclosure of personal information, we will notify affected customers or individuals without undue delay, consistent with the Terms and applicable law.

9. RETENTION AND DELETION

Account information is retained for as long as your account is active and thereafter as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.
Customer Content submitted to the Service is temporarily and automatically cached for performance purposes for a period that can be controlled by the user. Customer Content stored at your request is retained for the duration of your subscription. Any remaining Customer Content in Preset's possession is deleted following the end of the subscription term if not renewed (as evidenced by an account closure request), or upon your request for deletion, except for backup or archival copies that are deleted in due course in accordance with Preset's data retention schedule, and except where retention is required by applicable law.
Credentials, including API keys and MCP server credentials, are handled as described in Section 4.

To request deletion of your account or data, contact privacy@preset.io or use the controls available in the Service.

10. YOUR PRIVACY CHOICES AND RIGHTS

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. You may exercise these rights by contacting privacy@preset.io. We will verify your request and respond as required by applicable law. We will not discriminate against you for exercising your rights.

If your personal information is contained in Customer Content processed on behalf of an organization, please direct your request to that organization; we will assist as described in the Terms and required by applicable law.

Additional choices:

Email communications. You can opt out of marketing emails using the unsubscribe link in those emails. You will continue to receive transactional and service-related communications.
Cookies. You can manage cookies through your browser or device settings, as described in Section 2.
"Do Not Track." We do not currently respond to Do Not Track signals.
Opt-out preference signals. Because we do not sell or share personal information, opt-out preference signals such as the Global Privacy Control do not change how we process your information; where applicable law requires such signals to be honored, we will treat them as a valid opt-out request.

For individuals in the EEA, the United Kingdom, and Switzerland. Where we act as a controller and the GDPR or UK GDPR applies, our legal bases for processing are: performance of a contract (to provide the Agor Cloud Services you request); our legitimate interests (to secure, maintain, and improve the Agor Cloud Services, prevent fraud and abuse, and communicate with business users), balanced against your interests and rights; your consent, where required (for example, for certain cookies or marketing communications), which you may withdraw at any time without affecting prior processing; and compliance with our legal obligations. You also have the right to lodge a complaint with your local data protection supervisory authority.

11. INTERNATIONAL DATA TRANSFERS

Information processed by us may be transferred to, processed, and stored in the United States or other countries, which may have data protection laws different from those of your jurisdiction. Where we transfer personal information originating in the European Economic Area, Switzerland, or the United Kingdom to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, including the Standard Contractual Clauses (Module 2, Controller to Processor) as incorporated in the Data Processing Addendum to the Terms.

12. SUPPLEMENTAL U.S. STATE PRIVACY DISCLOSURES

California. This subsection applies to our processing of personal information subject to the California Consumer Privacy Act, as amended ("CCPA"). In the preceding 12 months, the categories of personal information we have collected are: identifiers (such as name, email address, IP address, and cookie identifiers); professional information (such as your organization's name); internet or other electronic network activity information (such as the usage and log data described in Section 2.B); approximate geolocation derived from IP address; commercial information (if paid features apply to your account); sensitive personal information as described below; and any personal information contained in Customer Content, which we process as a service provider on behalf of our customers. We collect these categories directly from you and automatically from your use of the Agor Cloud Services, use them for the purposes described in Section 5, disclose them for business purposes to the recipients described in Section 7, and retain them as described in Section 9.

Sensitive personal information. The account log-in credentials you create for Agor Cloud, and the third-party access credentials described in Section 4, constitute sensitive personal information under the CCPA. We use and disclose sensitive personal information only to provide the Agor Cloud Services and for purposes permitted by CCPA regulations, and not to infer characteristics about you; accordingly, no "Limit the Use of My Sensitive Personal Information" option is required or offered.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA. California residents may exercise their rights to know, access, correct, and delete personal information, the right to data portability, and the right to non-discrimination by contacting us at privacy@preset.io. You may designate an authorized agent to make a request on your behalf, subject to verification.

Other U.S. states. If you reside in a state with a comprehensive consumer privacy law (such as Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, New Hampshire, New Jersey, Oregon, Texas, Utah, or Virginia, among others), you may have similar rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising, sales of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal information, process it for targeted advertising, or engage in such profiling. You may exercise applicable rights by contacting privacy@preset.io.

Appeals. If we decline to take action on a privacy request, you may appeal our decision by replying to our response or by emailing privacy@preset.io with "Privacy Appeal" in the subject line. If your appeal is unsuccessful, you may contact your state Attorney General.

13. SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS

If you are a resident of Nevada, you have the right to opt out of the sale of certain personal information to third parties. We do not currently sell personal information as sales are defined in Nevada Revised Statutes Chapter 603A.

14. CHILDREN'S INFORMATION

The Agor Cloud Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us at privacy@preset.io and we will take appropriate steps to delete it.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time as Agor Cloud evolves. If we make material changes, we will notify you through the Service, to your account, or by email, and update the "Last Updated" date above. Your continued use of the Agor Cloud Services after notice of changes constitutes acceptance of the updated Privacy Policy, to the extent permitted by applicable law.

16. CONTACT US

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, contact us at:

Preset, Inc. 548 Market St, PMB 51897 San Francisco, CA 94104-5401 privacy@preset.io