Privacy Policy

Jurisdiction: Washington, United States. Exclusive venue for disputes is King County, Washington.

1. Introduction

AICraftworks, LLC ("AgentCraftworks", "we", "us", or "our") operates AgentCraftworks, an AI agent governance platform delivered as a GitHub App and Microsoft Azure SaaS application. This Privacy Policy explains what data we collect, how we use it, how long we retain it, and what rights you have over it.

This policy applies to:

• The AgentCraftworks GitHub App installed on GitHub organizations and repositories
• The AgentCraftworks MCP (Model Context Protocol) server
• The AgentCraftworks web application and dashboard (agentcraftworks.com)
• All associated APIs, SDKs, and integrations

By installing the AgentCraftworks GitHub App or subscribing to any AgentCraftworks service tier, you agree to this Privacy Policy.

We do not collect, process, or store any Protected Health Information (PHI) as defined under HIPAA. AgentCraftworks is not intended for use with healthcare data. If your repositories contain PHI, do not install AgentCraftworks without a signed Business Associate Agreement (BAA). Contact privacy@agentcraftworks.com to discuss BAA terms.

2. Data We Collect

2.1 GitHub Webhook Payloads

When the AgentCraftworks GitHub App is installed on a GitHub organization or repository, GitHub delivers webhook events to our servers. These payloads may contain:

We do not read or store the contents of files in your repositories unless those files are explicitly referenced in a governance action that you have configured (e.g., reading a .agentcraftworks.yml config file or CODEOWNERS for routing).

2.2 Agent Action Audit Logs

AgentCraftworks generates structured audit log entries for every agent action processed through the governance layer. Each log entry contains:

• Timestamp (UTC)
• Agent identity (GitHub user ID or Entra ID object ID)
• Tool name invoked (e.g., create_handoff, accept_handoff, complete_handoff)
• Engagement level at time of action
• Input parameters (sanitized — secrets and credentials are excluded)
• Output state (e.g., handoff ID, new FSM state)
• Repository and organization scope
• Environment (local / staging / production)
• Rate governor outcome (allowed / throttled / blocked)

Audit logs do not contain:

• Source code content (beyond identifiers like commit SHAs)
• File contents from your repositories
• AI model prompts or completions
• Personal health information
• Payment card data

2.3 Azure Application Insights Telemetry

AgentCraftworks uses Microsoft Azure Application Insights for performance monitoring, error tracking, and usage analytics. Telemetry collected includes:

• Request latency and HTTP status codes for webhook and API endpoints
• Exception stack traces (sanitized to remove user content)
• Dependency call durations (GitHub API, Azure Key Vault, Azure Container Apps)
• Custom event counts (e.g., handoff_created, governance_gate_blocked)
• Server-side metrics (CPU, memory, request rate)

Application Insights telemetry is non-personally-identifiable at the field level. Repository names and organization names may appear in trace context. We do not use Application Insights for individual behavioral profiling.

2.4 GitHub Actions OIDC Tokens

When AgentCraftworks integrates with GitHub Actions workflows, short-lived OIDC (OpenID Connect) tokens may be issued by GitHub to authenticate workflow runs. These tokens are:

• Ephemeral — valid for the duration of a single workflow job
• Not stored by AgentCraftworks at rest
• Used only to verify the identity of the calling workflow
• Discarded immediately after verification

2.5 Microsoft Entra ID (Azure Active Directory) Identity Data

For customers using the Team or Enterprise subscription tier, AgentCraftworks optionally integrates with Microsoft Entra ID for agent identity management. In this context, we may process:

• Entra ID object IDs (GUIDs) for authenticated agents
• Security group memberships (for policy scope binding)
• Tenant IDs (for multi-tenant isolation)

We do not store Entra ID access tokens or refresh tokens at rest. Token validation is performed in-memory and tokens are discarded after verification.

2.6 Subscription and Billing Data

For paid subscription tiers (Team and Enterprise), billing is handled through GitHub Marketplace or Azure Marketplace. We do not directly collect or store payment card numbers, bank account information, or other financial credentials. Billing data is processed and stored by GitHub or Microsoft under their respective privacy policies.

We receive from the marketplace:

• Organization name and billing contact email
• Subscription plan and seat count
• Subscription lifecycle events (created, changed, cancelled)

2.7 Website and Dashboard

The AgentCraftworks web application (agentcraftworks.com) may collect:

• IP addresses (anonymized in logs within 24 hours)
• Browser type and version (User-Agent header)
• Pages visited and navigation paths
• Authentication session tokens (stored as secure, httpOnly cookies with a 24-hour TTL)

We do not use third-party advertising trackers. We use privacy-first analytics that do not fingerprint individual users.

3. How We Use Your Data

We do not:

• Sell your data to third parties
• Use your data to train AI models without explicit written consent
• Use your data for advertising or behavioral profiling
• Share your repository contents with other AgentCraftworks customers

4. Data Retention

Enterprise tier customers may request custom retention periods in their subscription agreement. Retention periods may be shortened (to as few as 30 days total) upon customer request.

5. Data Sharing and Third-Party Services

AgentCraftworks shares data with the following third-party sub-processors to deliver the service:

5.1 Microsoft Azure Data Residency

AgentCraftworks is deployed on Microsoft Azure. Data residency depends on the Azure region selected at deployment time. The default region for SaaS deployments is East US. Enterprise customers may request deployment to alternative Azure regions (including EU regions) to meet data residency requirements.

We do not share data with any third party beyond those listed above without your explicit consent, except as required by law.

We will notify you within 72 hours of becoming aware of any data breach that is likely to result in a risk to your rights and freedoms, as required by applicable law.

6. Multi-Tenant Data Isolation

AgentCraftworks is a multi-tenant SaaS platform. Each customer's data is logically isolated using the following controls:

• Tenant scoping: All data records are tagged with a unique organization ID derived from the GitHub organization or Azure tenant. Queries are always scoped to the requesting tenant's ID.
• Authentication boundary: API requests are authenticated using GitHub App installation tokens or Entra ID bearer tokens. Cross-tenant access is architecturally blocked.
• Encryption at rest: All data stored in Azure is encrypted at rest using Azure-managed keys (AES-256). Enterprise tier customers may bring their own keys (BYOK) via Azure Key Vault.
• Encryption in transit: All data in transit uses TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled.
• Audit log partitioning: Audit log storage is partitioned by organization ID. Shared infrastructure does not expose cross-tenant data.
• Rate limiting: The Rate Governor applies per-organization quotas to prevent one tenant's agent workload from degrading service for other tenants.

7. Security

AICraftworks implements technical and organizational security measures appropriate to the risk, including:

• GitHub App private keys stored exclusively in Azure Key Vault — never in environment variables or source code
• Webhook signature verification (HMAC-SHA256) on every incoming GitHub event
• All production access requires multi-factor authentication
• Periodic dependency vulnerability scanning via GitHub's Dependabot
• Penetration testing conducted annually; results available to Enterprise customers under NDA
• SOC 2 Type II audit in progress — target completion Q4 2026

8. Your Data Rights

If you are located in a jurisdiction with applicable data protection laws (including but not limited to the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), or UK GDPR), you may have the following rights:

Response time: We will respond to data rights requests within 30 days. Complex requests may require up to 60 days; we will notify you if an extension is needed.

Identity verification: To protect your data, we will verify your identity before fulfilling a data rights request. For organization-level requests, the requester must be a GitHub organization owner or an authorized representative.

Uninstalling the GitHub App: Uninstalling the AgentCraftworks GitHub App from your organization stops all future data collection. Existing data is retained per the retention schedule in §4 unless you submit a deletion request.

9. Children's Privacy

AgentCraftworks is a developer productivity tool intended for use by adults in professional and organizational contexts. We do not knowingly collect personal information from individuals under the age of 13 (or the applicable age of digital consent in your jurisdiction). If you believe we have inadvertently collected such information, contact privacy@agentcraftworks.com immediately.

10. International Data Transfers

Data collected by AgentCraftworks may be processed in the United States and in other countries where Microsoft Azure operates data centers. When we transfer personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries that may not provide the same level of data protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Microsoft's Data Protection Addendum (DPA) for Azure services
• Adequacy decisions where applicable

11. Changes to This Policy

We will notify you of material changes to this Privacy Policy by:

• Posting a notice in the AgentCraftworks dashboard (for active subscribers)
• Sending an email to the billing contact on record (for paid tiers)
• Updating the "Effective Date" at the top of this document

If you continue to use AgentCraftworks after the effective date of a revised policy, you accept the revised policy. If you do not agree, you may uninstall the GitHub App and request data deletion per §8.

12. Governing Law

This Privacy Policy and any disputes arising from it shall be governed by the laws of Washington, United States, without regard to conflict of law principles.

Any dispute, claim, or controversy arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in King County, Washington. You waive any objection to jurisdiction or venue in such courts.

13. Contact

For privacy-related questions, data rights requests, or to report a potential data breach:

Privacy Officer
AICraftworks, LLC
Email: privacy@agentcraftworks.com
Web: https://agentcraftworks.com/privacy

For legal matters: legal@agentcraftworks.com
For security disclosures: security@agentcraftworks.com (PGP key available on request)

AICraftworks, LLC — AgentCraftworks Privacy Policy — Effective 2026-07-29