At AgentKeeper (operated by RAD Security, Inc., accessible from https://www.agentkeeper.dev), one of our main priorities is the privacy of our visitors and customers. This Privacy Policy describes the types of information collected and recorded by AgentKeeper and how we use it.

If you have questions or require more information, please contact us.

Consent

By using our website, you consent to this Privacy Policy and agree to its terms.

Information We Collect

The personal information we ask you to provide, and the reasons why, will be made clear at the point of collection.

If you contact us directly, we may receive additional information such as your name, email address, phone number, message contents, and any other information you choose to provide.

When you register for an account, we may ask for contact information including name, company name, address, email address, and telephone number.

How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain our website and services
Improve, personalize, and expand our offerings
Understand and analyze how you use our website
Develop new products, services, features, and functionality
Communicate with you — for customer service, updates, and marketing purposes
Send you emails
Find and prevent fraud

Log Files

AgentKeeper uses log files. Log files record visitors when they visit websites — a standard part of hosting analytics. Information collected includes IP addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and click counts. This information is not linked to personally identifiable information and is used for analyzing trends, administering the site, and gathering demographic data.

Cookies and Web Beacons

Like most websites, AgentKeeper uses cookies to store information including visitor preferences and pages accessed. This information is used to optimize your experience by customizing page content based on your browser type and other information.

Analytics and marketing cookies load only with your consent. You can review or withdraw your choice at any time via your . For the full list of cookies and their purposes, see our Cookie Policy.

On our marketing pages, and only if you allow marketing cookies, we use HubSpot (HubSpot, Inc.) to understand which pages visitors read. When you send us a request, such as a demo request, we store your name, email address and company in HubSpot so our team can reply. HubSpot processes this information on our behalf and is listed on our Sub-processors page. HubSpot is never loaded inside the product.

Advertising Partners Privacy Policies

This section applies to the AgentKeeper website only. The AgentKeeper browser extension does not use advertising partners, ad networks, or ad tracking of any kind.

Third-party ad servers or ad networks may use technologies like cookies, JavaScript, or web beacons in advertisements on the AgentKeeper website. They automatically receive your IP address when this occurs. These technologies measure advertising effectiveness and personalize content. AgentKeeper has no access to or control over these third-party cookies.

Third-Party Privacy Policies

This Privacy Policy does not apply to other advertisers or websites. We advise consulting the respective privacy policies of any third-party ad servers for detailed information on their practices. You can disable cookies through your browser options.

Sub-processors and Data Processing Agreement

When RAD Security processes personal data on behalf of a customer organization, it does so as a data processor. The third-party sub-processors we engage to provide the service are listed on our Sub-processors page. A Data Processing Agreement (DPA) is available to customers on request — contact [email protected].

CCPA Privacy Rights

Under the CCPA, California consumers have the right to:

Request disclosure of the categories and specific pieces of personal data a business has collected about them
Request deletion of personal data a business has collected
Request that a business that sells personal data refrain from doing so

We have one month to respond to your request. To exercise these rights, contact us.

GDPR Data Protection Rights

Every user is entitled to the following:

Right to access — request copies of your personal data (a small fee may apply)
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request erasure of your personal data under certain conditions
Right to restrict processing — request restriction of processing under certain conditions
Right to object to processing — object to our processing under certain conditions
Right to data portability — request transfer of collected data to another organization or directly to you

We have one month to respond. To exercise these rights, contact us.

Children's Information

AgentKeeper does not knowingly collect personal information from children under 13. If you believe your child has provided such information on our website, contact us immediately and we will promptly remove it.

AgentKeeper Browser Extension

This section applies specifically to the AgentKeeper browser extension and supplements the website privacy policy above. It governs data collected when the extension is deployed on employee browsers by an organization.

Role of RAD Security

When the AgentKeeper browser extension is deployed by an organization, RAD Security acts as a data processor on behalf of that organization (the data controller). The subscribing organization determines the purpose and scope of AI activity monitoring. RAD Security processes captured data solely on the organization's behalf and under its instructions.

The advertising partners, cookies, and web beacons described elsewhere in this policy apply to the AgentKeeper website only and have no bearing on the browser extension.

What the Extension Captures

On behalf of the deploying organization, the AgentKeeper extension captures the following from monitored AI providers (claude.ai, and optionally ChatGPT, Gemini, Perplexity, Microsoft Copilot, Microsoft 365 Copilot, Grok, Replit, and — newly added — DeepSeek, each captured only if enabled by the administrator and, where the site is not one of the extension’s required hosts, only if the browser has granted access to it):

The content of AI API requests: user prompts, system prompts, and tool definitions
The content of AI API responses: model output, tool calls, and tool results
Browser and operating system family and version strings
A per-browser installation identifier — a random ID generated locally on first install, not linked to a Google account or employee identity unless the administrator supplies an email address via MDM configuration
The hostname and URL path of the active tab at capture time; query strings are stripped before any data is recorded

Automatic redaction: before any event leaves the browser, the extension replaces email addresses, JWT tokens, AWS access keys, US Social Security numbers, and payment-card numbers with [REDACTED]. Raw HTTP headers, cookies, authorization tokens, and general browsing history are never captured.

Connection Country (Activity Map)

To render the organization-level activity map, AgentKeeper derives a two-letter connection country code (for example, US or DE) from the connection IP address at the moment an event is ingested. The IP address is used only for this lookup and is then discarded — it is never stored or logged. Only the resulting country code is persisted alongside the event.

Country-level only. The map aggregates events by country. No city, region, postal code, or latitude/longitude coordinates are derived or stored.
Approximate. The country is inferred from network metadata and may not reflect a user's physical location — VPNs, corporate proxies, and cloud egress can resolve to a different country.
Opt-out available. An organization administrator can disable connection-country capture entirely under Settings → Privacy. When disabled, no country code is derived or stored and the activity map shows no geographic data.

How Captured Data Is Used

Captured data is transmitted exclusively to the deploying organization's AgentKeeper backend for AI security monitoring, policy enforcement, and compliance auditing. RAD Security does not use this data for advertising, profiling, or any purpose unrelated to providing the AgentKeeper service to the deploying organization.

Who Has Access

Captured data is accessible only to the deploying organization's authorized security and IT personnel through the AgentKeeper dashboard. RAD Security personnel may access data only as necessary to provide technical support, subject to confidentiality obligations.

Enterprise Deployment and Employee Notice

AgentKeeper is deployed by organizations via MDM (Jamf, Intune, Iru/Kandji, Google Admin Console) or by IT administrators. Individual employees do not install or configure the extension. Organizations are responsible for notifying employees about AI activity monitoring in accordance with applicable employment law and their own acceptable use policies.

Data Retention

Events are retained on the AgentKeeper backend per the organization's configured retention period. The local browser queue retains a maximum of 5,000 events (50 MB); events older than 24 hours are pruned if the backend is unreachable.

Employee Rights

Because RAD Security acts as a processor on behalf of the employing organization, employees who wish to access, correct, or delete their data should contact their organization's IT or security team — not RAD Security directly. The organization, as data controller, is responsible for fulfilling those requests.

Contact

For questions about AgentKeeper's data practices: [email protected]