Legal · Privacy
Privacy Policy
Effective · Coastal Carolina Tech LLC
This policy explains what personal information DMZAgent collects, why we collect it, who else handles it, how long we keep it, and the rights you have over it. Questions go to privacy@dmzagent.com.
The short version
- We collect what it takes to run your account: your work email, your organization’s name and details, and billing details if you pay for usage.
- While you are signed in, we note the topics you ask the docs assistant about and the services you try, so we can follow up with you.
- This site sets no advertising or analytics cookies, and it does not follow you across other sites.
- We do not sell personal information or share it for advertising, and we do not use it, or your organization’s data, to train AI models.
- Data your organization sends into the platform belongs to your organization, and we process it on the organization’s instructions.
- You can ask to see, correct, export or delete your personal information at privacy@dmzagent.com. We answer within 30 days.
1.Who we are and what this policy covers
DMZAgent is owned and operated by Coastal Carolina Tech LLC, a Delaware limited liability company (“we”, “us”). We decide how and why the personal information in this policy is used, which makes us its controller.
This policy covers personal information about visitors to dmzagent.com, people who create or use a DMZAgent account, people who publish rule packs or refer customers, and anyone who writes to us.
Organizations also send their own data into the platform, and it can include personal information about their staff, customers and systems. We process that data for the organization, on its instructions. Data we process for our customers explains how that works.
2.What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Your work email address and a display name, your organization’s name and type, what you want to watch first, and your role and the work areas you can reach. | You, when you sign up or accept an invitation |
| Sign-in details | One-time sign-in links, the details of any passkey you register (its public key, a nickname and the type of authenticator), and the session that keeps you signed in. | Your browser and your devices |
| Connection details | Your IP address, browser type and the pages or API routes you request, as they reach our network. We store an IP address when a request from it is refused for exceeding our rate limits. | Your browser and your devices |
| Billing details | Your organization’s billing email and country, the address, tax ID, phone number and contacts you add to its profile, and your plan, invoices and usage records. Card numbers go from your browser straight to our payment processor, and our servers do not receive them. | You, and our payment processor |
| Payout details | For rule-pack authors and referral partners: the payout account you connect and the record of what we paid you. Our payment processor collects the identity, tax and bank details it needs, and we do not see your bank credentials. | You, through our payment processor |
| Lead record | Your email address, name, company and role, and notes on what you do while signed in: that you signed up, the topic of each question you ask the docs assistant, the services you try with sandbox keys, and when you upgrade to an organization. Our team adds notes when they talk with you. | You, your use of the Service, and our team |
| Assistant exchanges | The topic of each question you ask the docs assistant, how the assistant handled it, and the answer it gave. The text of your question goes to our AI model provider to produce the answer, and we do not keep it. | You |
| Activity records | The actions your organization’s audit log records, such as role changes and key events, with your name on each one. | Your use of the Service |
| Messages | What you write to us, and our replies. | You |
If your device checks a fingerprint or a face before it uses a passkey, that check happens on your device. We receive only a public key.
3.How we use it, and our legal bases
We use personal information for the purposes below. Where the EU or UK General Data Protection Regulation applies, each purpose rests on the legal basis beside it.
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in and providing the Service | Performing our contract with you |
| Billing, author and partner payouts, tax records and accounting | Performing our contract, and meeting our legal obligations |
| Sending sign-in links, a welcome email, notification digests, security alerts, and notices about your account and these policies | Performing our contract, and our legitimate interest in keeping accounts secure |
| Following up with you about your sign-up, using what you told us and the notes on your lead record | Our legitimate interest in serving the people who sign up. You can object at any time. |
| Keeping the Service secure: limiting abuse, investigating incidents and enforcing our terms | Our legitimate interest in protecting the Service and its customers |
| Meeting legal requirements and answering lawful requests | Meeting our legal obligations |
We need your work email to create an account and send you sign-in links, and an organization name to open an organization. Without them we cannot open the account. We make no decision about you that rests solely on automated processing and has legal or similarly significant effects.
4.The docs assistant
The docs assistant answers questions about DMZAgent for signed-in accounts. To answer, it sends your question and the relevant documentation to our AI model provider, which returns a response.
We keep a record of each exchange: the topic we sorted the question under, how the assistant handled it, and the answer it gave. We do not store the text of your question. The topic is also noted on your lead record, so we can see which subjects people ask about.
Ask the assistant about the product. Keep secrets, credentials and other people’s personal information out of your questions.
5.Cookies and measurement
This site sets no advertising, analytics or cross-site tracking cookies. When you select one of its sign-up buttons, the page sends our servers the name of that button, with no cookie and no identifier attached.
Signing in sets one cookie, anima_session, for dmzagent.com and its subdomains. It keeps you signed in for up to 7 days, travels only over encrypted connections, and cannot be read by scripts on the page. This site reads it only to show features for signed-in accounts, such as the docs assistant. It is strictly necessary, so it is set without asking for consent.
Our hosting provider can set a strictly necessary security cookie when it checks whether traffic is automated. The site also remembers which programming language you last picked in code samples, in your browser’s local storage, and that preference stays on your device.
We do not track visitors across sites, so a Do Not Track signal changes nothing about how the site behaves. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information. We do neither for anyone.
6.Who we share it with
We share personal information with the providers that help us run the Service, and each one receives only what its task needs. Each is bound by contract to use the information only for that task. The subprocessor list on our trust page names every provider and what it can see.
| Role | What it handles |
|---|---|
| Hosting provider | Runs the platform, its databases, its storage and its network, so it handles all the information described here. |
| AI model provider | Processes the text we send for reasoning or to the docs assistant, to return a response. |
| Payment processor | Handles billing contacts, payment details, and payouts to authors and partners. |
| Email provider | Delivers sign-in links, welcome emails and notifications, so it handles your email address and each message. |
The API reference pages on our API host load open-source components from a public content delivery network. Your browser fetches them directly, so that network receives your IP address.
Inside an organization, administrators can see its members and the audit log of their actions. A referral partner can see the health and the spend of the accounts it referred, and none of their content.
We may also disclose personal information when the law, a court order or a valid legal request requires it. When such a request concerns an organization’s data, we tell the organization first wherever the law allows. We may disclose information to protect the safety, rights or property of our customers, the public or ourselves, and to a buyer or successor if the business is sold or reorganized, under a commitment to honor this policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
7.AI models and your data
We do not use your personal information, your organization’s data, or the records the platform produces from it to train or fine-tune AI models.
Our AI model provider processes the text we send it in order to return a response. Its commercial terms do not allow it to train its models on that text. If your organization connects its own model provider account, text sent with that account is also covered by your organization’s agreement with that provider.
8.How long we keep it
| Information | How long we keep it |
|---|---|
| Account details and sign-in records | While your account is open. When it closes, we delete them within 60 days, or sooner if you ask. |
| Sessions | Up to 7 days, or until you sign out. |
| Lead record | While your account is open. If you never open one, until we no longer need it to follow up. We delete it sooner when you ask. |
| Assistant exchanges | The topic stays with your lead record. The assistant’s answers are kept as a record of what it said, stored without your name or email address. |
| Billing and payout records | As long as tax and accounting law requires. |
| Activity records | While your organization’s account exists. The audit log is append-only, so its entries are never edited, and it is deleted with the rest of your organization’s data when the agreement ends. |
| Service logs and security records | Up to seven years, in a write-once archive kept as a security and audit record. These logs record requests to the platform and can include your email address. Entries in the archive cannot be removed early, including on request. |
| Messages | As long as we need them to handle what you wrote about. |
| Backups | Deleted information leaves our backups within 90 days. |
We keep information longer only when the law requires it, or when we need it to resolve a dispute or investigate misuse of the Service.
9.How we protect it
Information travels over encrypted connections. Stored secrets, such as the credentials for systems you connect, are encrypted with AES-256-GCM, and API keys are stored as hashes. Inside the platform, access is refused unless a rule grants it, and the data layer keeps each account’s data separate on every query. Passkeys give phishing-resistant sign-in, and an organization can require them of its members.
Our operators can see account health and billing. The data your organization watches, and the conclusions drawn from it, sit outside their access. Operator changes to an account, and every reveal of a stored secret, are recorded in a separate audit trail.
No system is perfectly secure. If a breach affects your personal information, we notify you and the authorities as the law requires. The trust page sets out our security controls and certification status, and explains how to report a vulnerability.
10.Where it is processed
Our primary databases and file storage are in the United States. Hosting in the EU or another region is unavailable today.
Our hosting provider’s network receives each request at the data center nearest you and carries it to those systems. Our AI model provider and our payment processor handle information in their own facilities, under their own terms.
If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States. Where we process personal data as an organization’s processor, the Data Processing Addendum covers that transfer with the Standard Contractual Clauses.
11.Your rights and choices
Depending on where you live, you may have the right to:
- see the personal information we hold about you, and get a copy of it;
- correct it;
- delete it;
- receive it in a portable format;
- object to or restrict how we use it, including follow-up about your sign-up;
- withdraw consent, where we rely on consent;
- complain to your data protection authority.
Send a request to privacy@dmzagent.com from the email address on your account, or tell us how to reach you if you have no account. We may ask you to confirm the request from that address before we act on it. We answer within 30 days. If a complex request needs longer, we tell you within those 30 days, as the law allows.
You can change how often notification digests arrive, or turn them off, from your notification preferences, and every digest links to them. Emails about sign-in, security and billing continue while your account is open.
12.More for residents of U.S. states
Residents of California and several other states have rights under state privacy laws. This section adds what those laws ask us to state.
- In the past 12 months we collected these categories: identifiers (such as your email address, name, account identifiers and IP address), commercial information (plan, billing and payout records), internet activity (sessions, connection details, lead record notes and actions in the Service), and professional information (your organization and role). Their sources and purposes are set out in What we collect and How we use it.
- We disclose those categories to the providers in Who we share it with, for the purposes described there.
- We do not sell personal information or share it for cross-context behavioral advertising, and we have done neither in the past 12 months. We do not knowingly sell or share the information of anyone under 16.
- We use sensitive personal information only to provide the Service and keep it secure, the uses the law permits without a right to limit.
- We do not share personal information with third parties for their own direct marketing.
- You may act through an authorized agent. We will ask the agent for your signed permission, and we may ask you to confirm the request.
- We will not treat you differently because you used a privacy right.
- If we decline your request, you can appeal by replying to our decision. We answer an appeal within 45 days. If we still decline, you may contact your state attorney general.
13.Data we process for our customers
Organizations send data into DMZAgent: events from their systems, the records the platform produces from those events, the content their agents handle, and the conversations visitors have with chat assistants an organization places on its own site, including those visitors’ messages and technical details such as IP address and browser type. That data can include personal information about people we have no direct relationship with.
For that data, the organization is the controller and we are its processor. We process it only to provide the Service, under our Terms of Service and the Data Processing Addendum. To exercise a right over data an organization holds in DMZAgent, contact that organization. If you write to us, we pass your request to the organization and help it respond.
14.Children
DMZAgent is built for businesses and professionals. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, write to privacy@dmzagent.com and we will delete it.
15.Changes to this policy
We post every revision on this page with a new effective date. For a material change, we also email account administrators at least 14 days before it takes effect.
16.How to reach us
Coastal Carolina Tech LLC owns and operates DMZAgent and is the controller of the personal information this policy describes. Write to privacy@dmzagent.com with any question or request about it. Report security issues to security@dmzagent.com.
This version takes effect on 27 September 2026 and replaces the policy dated 26 September 2026.