Privacy policy

This is a translation of our German privacy policy; if the two versions differ, the German version applies. As at October 2026. This policy applies to the website agentnow.io and the AgentNow! application (app.agentnow.io).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

LittVest GmbH
Hallesche Str. 5a, 10963 Berlin, Germany
Represented by: Ron Littmann
Email: info@reportnow.de

We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG, the German Federal Data Protection Act. You can reach us at the address above with any questions about data protection.

2. Hosting

The website and the application run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Helsinki (Finland, European Union). The database and backups are kept there as well. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

3. Visiting the website (server logs)

When you visit the website, technically necessary data is processed without which the page could not be delivered: IP address, time of access, address requested, amount of data transferred, status code, and information about the browser and operating system.

Purpose

Delivering the page, operational security, defence against attacks.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service).

Retention period

Server logs are deleted after five weeks at the latest, unless they are needed to investigate a specific incident.

4. Cookies and storage in your browser

We only set cookies that are needed for the service, and none for advertising or analytics:

Signing in

The cookie __Host-bot_sitzung keeps you signed in. It contains a random identifier; on the server we store only its hash. It is valid for 30 days from last use and is deleted when you sign out.

Language

The cookie sprache remembers whether you want to see the pages in German or English, for up to 400 days.

In your browser

Your browser’s local storage (localStorage) holds the workspace you last chose and whether you have closed the hint about installing the app. This information is not sent to our server.

Legal basis

§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act (strictly necessary for the service requested), and Art. 6(1)(b) or (f) GDPR.

5. No external content

Fonts, icons and images are served exclusively from our own server; the drawn portraits are generated there too. No third-party services are embedded – no Google Fonts, no video services, no social media embeds, no chat tools. Your IP address is not transmitted to any third party merely by visiting the website.

6. Sign-up and account

If you sign up, we process your name, whether you use AgentNow! privately or for a business, for businesses the company name, your email address and the language of the form. We do not store your password in plain text, only as a cryptographic hash (scrypt); we cannot see it.

Your account and workspace are only created when you open and confirm the link in our confirmation email. We store the time of confirmation as evidence – without it, any address at all could be used to create an account. An unconfirmed entry lapses after 7 days and is deleted. If there is already an account for the address, we send a note about signing in instead of the link. We send the confirmation email through a mail server in the EU.

If a customer invites you to their team, you create your account through the invitation link; we then process the same details except the company.

Purpose

Setting up and running your account and workspace, signing in, contacting you about it.

Legal basis

Art. 6(1)(b) GDPR; for the confirmation of the address, additionally Art. 6(1)(f) GDPR (evidence and protection against other people’s addresses being registered).

Usage

For each workspace we record which model used how many tokens and web searches, when, and what that cost – as the basis for the free allowance, the monthly cap and billing.

Orders

If you buy token packages, we store the package, the time, the wording of your declarations (terms, and for private customers the immediate start) and the identifiers of the payment at Stripe (section 8), as evidence and to perform the contract (Art. 6(1)(b) and (c) GDPR). We send the confirmation by email. If you cancel via “Cancel contracts here”, we store the details from the form and the time of receipt as evidence.

Retention period

For as long as the account exists. On request we delete the account and workspace with all content; statutory retention obligations remain unaffected – we keep orders and invoices for eight or ten years (section 147 of the German Fiscal Code, section 14b of the German VAT Act).

7. Content in the application

With AgentNow!, customers set up agents that write with people over WhatsApp, Signal, Telegram, Slack and other channels, read mailboxes and calendars, keep tasks and organise polls. This involves content data: conversations, contacts and their numbers, the agents’ notes, tasks, emails, appointments, polls. Who is responsible for it depends on what a workspace was set up for:

For a business

If a business or a self-employed person uses AgentNow! professionally, the customer is the controller and we are their processor under Art. 28 GDPR. The customer concludes theagreement for this in the app.

Privately

If you use AgentNow! for yourself privately, we process your content data as the controller – solely to provide the service to you (Art. 6(1)(b) GDPR), not for advertising and not for our own analyses. Data of other people your team deals with on your behalf (such as friends in a poll) is processed only for this purpose (Art. 6(1)(f) GDPR – your and our interest in providing the service you asked for).

If you write to an agent

If you write to a company’s agent or vote through a link an agent sent you, we process your messages and details on behalf of that company. You can obtain access and erasure from the company; we support it in this. If the link came from a private individual, contact us.

Credentials

We store credentials for channels, mailboxes, calendars and other services in encrypted form.

The customer’s services

The channels and connections a customer sets up – such as WhatsApp (Meta), Telegram, Slack, their mail or calendar provider, Google, social media accounts or their own webhooks – are the customer’s service providers, not ours. Data only goes there insofar as the customer has connected them and the agent needs them for the task.

Retention period

Determined by the customer; when the workspace is deleted, its content is deleted.

8. AI and other service providers

Claude (Anthropic)

The agents’ replies are written by the Claude language model of Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. For each reply, the agent’s instructions and knowledge, the conversation so far, the notes on the contact and the results of the tools (such as appointments or emails found) go to Anthropic. The agents’ web search also runs through Anthropic. Anthropic processes this data as our sub-processor, does not use it to train its models and deletes it within the periods set out in its data processing terms.

Transfers to third countries

Anthropic processes the data in the USA. The transfer is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Google Maps

If an agent uses maps through our access (“Google Maps included”), the addresses and search terms of the request – such as the start, destination and stops of a route – go to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process them in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Voice messages

We convert voice messages into text on our own server, and spoken replies are produced there as well. Nothing goes to third parties for this.

Sending email

We send confirmation emails and account notices through a mail server in the EU.

Payment (Stripe)

You pay for token packages via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details directly with Stripe; they never reach our server. We transmit to Stripe the name of the workspace, the email address of the ordering account, the package and the price; Stripe collects your billing address and – for businesses, if you wish – your VAT ID, calculates the VAT and sends the invoice. We store only Stripe’s identifiers for customer, payment and subscription and their status. Stripe processes some data as a controller in its own right, for example to prevent fraud and for its own legal obligations. Stripe may also process data in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). The legal basis is Art. 6(1)(b) and (c) GDPR.

9. Contact by email

If you write to us, we process your details in order to deal with your enquiry (Art. 6(1)(b) or (f) GDPR). We delete this data once the enquiry has been dealt with and no retention periods under commercial or tax law prevent this.

10. Protection against misuse

To fend off automated sign-ups, we check an additional field that is invisible to humans and the time taken before submission, and we limit the number of attempts per IP address, per email address and in total. When you sign in, we count failed attempts per email and IP address to slow down password guessing. These counters are held only in memory and expire after 24 hours at most. No third-party services are used for this – in particular no reCAPTCHA. The legal basis is Art. 6(1)(f) GDPR.

11. Your rights

You have the following rights with respect to us:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise them, contact us informally at info@reportnow.de. If it concerns data that a customer processes with their agents (section 7), we forward your request to them.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin.

13. Encryption

Data is transmitted over TLS. You can tell whether a connection is encrypted by the padlock symbol in your browser’s address bar.

14. Changes to this policy

We update this policy when the processing changes – for example if we add another service. The version available here applies at any given time.

Legal notice