Privacy Policy

This Privacy Policy explains how Klik Til Kunder (“we”, “us”, “our”) collects, uses, stores, and shares personal data in connection with Agentrix, available at agentrix.one.

Agentrix is a marketing operations platform. Customers use it to build and publish websites and landing pages, connect Google Ads and Meta (Facebook/Instagram) ad accounts, run AI agents against those same surfaces, and measure what happens on the pages they publish.

This policy is an information notice. It is not a contract. Where we rely on consent for a particular activity, we collect that consent separately.

01Who the controller is

Data controller

Klik Til Kunder
CVR: 37876674
Ole Jørgensens Gade 7, st. th.
2200 København
Denmark

Product: Agentrix (agentrix.one)
Contact: hello@agentrix.one

Agentrix is a product of Klik Til Kunder. There is no separate legal entity behind the product.

For privacy questions, rights requests, and deletion requests, write to hello@agentrix.one.

02Two roles: controller and processor

Which hat we wear depends on whose data it is.

We are the controller for personal data about:

• people who create an Agentrix account or are invited into one
• people who visit our own website at agentrix.one
• billing, support, and security records about the use of Agentrix itself
• usage of the Agentrix application (how the product is used, not how your published sites perform)

We are the processor for personal data that you (the customer organisation) put into Agentrix or that is generated because you use Agentrix on your own behalf, including:

• websites, landing pages, assets, knowledge documents, and agent conversations
• Google Ads and Meta advertising data you connect
• measurement of visitors to the sites you publish through Agentrix
• data accessed by API keys or MCP connections you authorise

When we act as processor, you are the controller of that data. You decide what goes in, who on your team can see it, which ad accounts to connect, and what you tell visitors of your published sites. We process that data on your documented instructions (your use of the product, plus our Terms of Service and, where we have one with you, a data processing agreement).

This policy describes processor data as well, so you can see what the product actually does. It does not make us the controller of your customers’, site visitors’, or advertising audiences’ data.

If you are an agency using Agentrix to work in a client organisation, you are responsible for having a lawful basis to access that client’s data. We still process it as processor for the organisation that owns it.

03Data we collect as controller

3.1Account and organisation data

When someone registers or is invited, we process:

• email address
• name / display name
• password (stored as a hash by our authentication provider; we never store the plaintext)
• language preference
• organisation name, organisation type (business or agency), and membership role (owner, admin, or member)
• invite tokens, optional invite-email labels, expiry, and who created or accepted the invite

Providing an email address and a password is required to create an account. Without that we cannot provide the service.

3.2Authentication and security

We use Firebase Authentication. That involves session tokens, sign-in events, password-reset and email-verification messages, and technical logs needed to keep accounts secure (IP address and user agent as seen by the authentication provider, timestamps, failed sign-in attempts).

3.3Support and correspondence

If you email us or otherwise contact us, we process the content of that correspondence and the contact details you use.

3.4Billing

If you buy a paid plan, we process the billing identity of the organisation (name, address, CVR/VAT number where you give it, invoice email, plan, and payment status). Card numbers are collected and processed by Stripe (Stripe Payments Europe, Limited / Stripe, Inc.). They do not pass through our servers. We keep invoices and bookkeeping records because Danish law requires it. Stripe’s own privacy notice applies to the payment data Stripe holds.

3.5Use of the Agentrix application

We record how the product is used at a technical level: pages loaded inside the app, feature events, error logs, device/browser type, and approximate location derived from IP at the infrastructure layer (we do not store a visitor-analytics profile of you from this). This is so we can run, secure, and improve the product.

3.6Our own website (agentrix.one)

When you visit the public Agentrix website, we process the technical data any website receives (IP address at the host, request logs, browser type) and, if you accept the relevant cookies, data from the tags described in Section 10.

04Data we process as processor (your content and integrations)

You and your team put this data into Agentrix, or the product pulls it because you connected an account. We do not use it to advertise Agentrix to third parties, and we do not sell it.

4.1Sites, pages, assets, and knowledge

• site and page records, including HTML, CSS, and scripts you or the agents write
• media you upload or generate (images and other files in the organisation asset library)
• knowledge-library documents and folders (including files you upload for agents to use)
• custom domain records and DNS verification data
• agent configuration, instructions, grants, triggers, threads, and run history
• API keys and MCP OAuth connections you create, and the activity those connections generate

Knowledge documents and page copy may contain personal data about your customers or staff. That is your data. We process it only to provide the product.

4.2Google Ads

If you connect Google Ads, we process:

• OAuth access and refresh tokens for the Google account you authorise
• the ad account(s) or manager account (MCC) you select, and assignments from an agency manager account to a client organisation
• campaign, ad group, ad, keyword, search-term, budget, bid, asset, and performance data needed to show the manager, editor, and keyword planner and to let you or an agent make changes
• keyword ideas and forecasts you request through the planner

We request only the Google Ads scope required to provide those features (https://www.googleapis.com/auth/adwords). We do not read your Gmail, Drive, or other Google products.

Google API Services User Data Policy. Agentrix’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to show ads, we do not sell it, and we do not allow humans to read it unless you ask us to for support, we need to for security or legal reasons, or the data has been aggregated and no longer identifies you.

4.3Meta (Facebook / Instagram) advertising

If you connect Meta, we process:

• OAuth access tokens for the Meta account you authorise
• the ad account(s) or Business Manager you select, and assignments from an agency connection to a client organisation
• campaign, ad set, ad, creative, page, pixel, audience-configuration, lead-form, and performance data needed to show the manager and editor and to let you or an agent make changes

We request ads_management, ads_read, and business_management. Those permissions exist so you can manage advertising for your own business or for clients you are authorised to represent. We do not store the personal data of people inside your custom audiences; we store the audience objects and settings you use to run ads.

We do not use Meta platform data to build our own advertising profiles, and we do not sell it. Meta’s own terms and privacy policy apply to data Meta holds. Disconnecting the integration stops new access; Section 13 describes how to delete what we already stored.

4.4What we do not take from Google or Meta

We do not request your personal Facebook or Google profile beyond what the OAuth flow returns to complete the connection. We do not scrape your friends, your personal photos, or your personal messages. The integrations are advertising-account integrations.

05Visitors to sites you publish

We process measurement data about visitors to sites published through Agentrix. You are the controller of that data. We are the processor.

We process page views, interactions and conversion events you define, time on page, referrer, UTM parameters, device type, operating system, browser, and screen size. We derive a short-lived visit identifier on our servers from the incoming request (IP address and user agent) and a salt that changes every day. The raw IP address is not stored. The identifier expires after about 30 minutes of inactivity and is not reused the next day.

Default measurement does not set cookies and does not write to the visitor’s device.

If you enable persistent / cross-visit measurement, an identifier is stored on the visitor’s device. That requires the visitor’s consent, which you are responsible for collecting.

We retain this data for 365 days, or until you ask us to delete it or the organisation is deleted.

We do not store the contents of forms submitted on your pages unless you have configured the page to send those contents to us. Third-party forms you embed are governed by that provider.

06AI processing

Agentrix runs a brain and specialist agents (pages, Google Ads, Meta Ads, analytics, image generation, and any agents you configure). Those agents read the current state of the surfaces you give them access to — pages, campaigns, knowledge, analytics — and can write back to the same surfaces.

To do that we send relevant prompts, page or campaign excerpts, knowledge you granted, and tool results to the model provider configured for that agent. Today those providers are:

• Anthropic (Claude)
• OpenAI
• Google (Gemini, including image generation)

Whatever you put in a thread, a knowledge file, or a page the agent can see may be transmitted to the selected provider to generate the reply or the image. Generated images are stored in your organisation’s asset library.

We do not use your content to train our own models. Whether a given provider uses API inputs for their own training is governed by that provider’s terms at the time of the call. We use their API products, not their consumer chat products.

Agents can publish changes to your live pages or live ad accounts when you have configured them to do so (including when human-in-the-loop review is off). That is you using the product, not us taking an automated decision about you as a data subject. See Section 12.

07Why we process data, legal bases, and how long we keep it

Legitimate interests. Where we rely on legitimate interests, those interests are: running and securing a B2B SaaS product, understanding whether the product works, and telling existing customers about changes to a product they already use. You can object (Section 12). We do not use legitimate interests as a basis for selling personal data or for third-party advertising on the logged-in product.

Contract. Account and billing details are required to perform the contract. You do not have to connect Google or Meta, upload knowledge, or publish a site; if you do, the data those features need is required for those features.

08Who we share data with

We do not sell, rent, or trade personal data.

We share personal data only:

• with you and the people you authorise — members of your organisation, an agency you have allowed to scope into your organisation, and third-party applications you connect via API key or MCP
• with sub-processors who run the product for us, under a contract that keeps them to our instructions (Section 9)
• with Google and Meta, when you connect those integrations — the data then also lives under their terms
• when you instruct us to (for example you publish a page, or an agent you configured pushes a campaign)
• when the law requires it, or to protect a person, our rights, or the security of the service
• if the business is transferred (sale, merger, or similar). Any buyer must continue to protect the data as described here. We will tell you if the controller changes in a material way

Platform operators (our own staff acting in the platform organisation) can access organisation data where that is necessary to operate, secure, or support the product. Agency staff you have a relationship with can access a client organisation when they scope into it. That is a product feature, not a sale of data.

09Sub-processors and infrastructure

These are the providers the product depends on. Each processes data only to provide their part of the service.

If we add or replace a provider that processes personal data, we will update this list. Material changes will be communicated as described in Section 15.

Transfers out of the EEA are addressed in Section 11.

10Cookies and similar technologies

10.1Strictly necessary (Agentrix application)

The logged-in product needs a small amount of storage on your device to function:

• Firebase Authentication session (cookie / storage) — so you stay signed in
• organisation context in localStorage (which organisation you are acting in, and whether you have scoped into a client)
• UI state such as sidebar open/closed (a first-party cookie)

These are essential for a service you asked for. They are not used to advertise to you.

10.2Preferences

Interface preferences stay on your device. They are not a tracking profile.

10.3Published-site measurement (your sites)

Default measurement of sites you publish does not use cookies or other storage on the visitor’s device. See Section 5. Persistent / cross-visit measurement, if you enable it, uses a device identifier and requires the visitor’s consent.

10.4Our website — Google Tag Manager

The public Agentrix website uses Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to load measurement and marketing tags.

Google Tag Manager itself is a container. The tags it may load include Google Analytics 4 and other analytics or advertising tags we configure. Those tags can set third-party cookies and send usage data (including IP address and device/browser data) to Google and to any other tag vendor we enable.

Legal basis: consent. You can accept or refuse non-essential cookies in the cookie settings on the website. Refusing them does not block the site. You can withdraw consent the same way.

We do not use these marketing-site tags to populate the logged-in Agentrix product, and we do not inject Google Tag Manager into the sites you publish. Your published pages use the first-party script in Section 5 unless you add your own tags in the page code.

10.5Cookie overview (our website and app)

Durations are set by the provider and can change. We review this table when we change tags.

11International transfers

The product is run from Denmark. Account data, sites, pages, assets, knowledge, and the agent-run workers live in Firebase / Google Cloud in the European Union (Firestore and Storage in eur3). Model providers (Anthropic, OpenAI, and Google Gemini), Stripe, Vercel’s origin, and parts of the Google Ads and Meta APIs also process data in the United States.

When personal data leaves the EEA, we rely on one of the following, depending on the recipient:

• the recipient’s certification under the EU–US Data Privacy Framework, where they are certified
• the European Commission’s Standard Contractual Clauses
• in limited cases, a transfer that is necessary to perform the contract with you (for example you asked us to call a US model API or a US advertising API)

You can ask us for more detail on the safeguard that applies to a given provider by writing to hello@agentrix.one.

12Your rights

If we are the controller of your data (account, billing, our website, support), you have the GDPR rights below. Send the request to hello@agentrix.one. We will answer within one month, or tell you if we need more time.

• Access — a copy of the personal data we hold about you
• Rectification — correct data that is wrong
• Erasure — delete data when the GDPR allows it (see also Section 13)
• Restriction — pause some processing
• Portability — receive data you provided to us, in a structured, commonly used format, where the basis is contract or consent and the processing is automated
• Object — object to processing based on legitimate interests, including any direct marketing
• Withdraw consent — where we rely on consent, including website cookies. Withdrawal does not affect processing already carried out
• Complain — you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the supervisory authority in your own EU member state

We may need to confirm it is you before we act. Some rights have legal limits (for example we cannot delete invoices we are required to keep).

If we are only the processor (your site visitors, your ad accounts, your knowledge files), send the request to the organisation that uses Agentrix. We will help that organisation fulfil it. If you write to us and it is clear you mean a customer’s data, we will point you to them unless we are required to handle it ourselves.

Automated decisions. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you as an Agentrix user (GDPR Art. 22). Agents that write pages or ads do so as a feature you configured, acting on your marketing data, not as a decision about your legal position as a customer.

13How to delete your data

This section is also the data-deletion instructions for Google and Meta app review.

Disconnect an ad account. In Agentrix, open Integrations and disconnect Google Ads or Meta. We revoke the tokens we hold and stop calling that API. Campaign drafts and cached performance we stored for that connection are deleted from the organisation or orphaned so they can no longer be used against the live account.

Delete content. You can delete sites, pages, assets, knowledge documents, threads, and domains inside the product.

Delete an organisation. Platform or agency operators can archive an organisation. Archive lasts 90 days (you can restore in that window). After that we permanently delete organisation-scoped data: sites, pages, assets, knowledge files, domains, integrations and tokens, agent configuration and runs, analytics for that organisation’s sites, and custom-domain hosting records. User login records are not deleted by an organisation purge, because the same person may belong to another organisation.

Delete your user account. Email hello@agentrix.one from the address on the account and ask us to delete the user. We will delete the Firebase Auth user and the user profile, remove memberships, and delete or anonymise controller data we no longer need. Bookkeeping records are kept for the statutory period. If you are the only owner of an organisation, we will archive that organisation as well unless you have transferred it.

Meta / Google user-data deletion. If you connected Meta or Google and want every copy of data obtained through that connection removed, email hello@agentrix.one with the subject “Platform data deletion”, the email on the Agentrix account, and which platform (Google, Meta, or both). We will delete tokens, cached advertising objects, and derived copies we control, then confirm. Data that lives only on Google’s or Meta’s side must be deleted there.

Your site visitors. If a visitor of a site you publish wants erasure, they should contact you. You can delete that site’s measurement data in Agentrix, or ask us to do it.

14Security

We take appropriate technical and organisational measures for a product of this kind, including:

• TLS for data in transit
• encryption at rest at the infrastructure layer (Google Cloud / Firebase)
• authentication required for the application; organisation scoping on reads and writes
• OAuth tokens for Google and Meta stored server-side and not returned to the browser
• access limited to people who need it to operate or support the product
• organisation archive and purge rather than leaving deleted tenants sitting in the database

No method of transmission or storage is perfectly secure. If we become aware of a breach that is notifiable under the GDPR, we will notify Datatilsynet and affected customers as required.

15Children

Agentrix is a business product. You must be at least 18 years old to create an account or accept the Terms. We do not knowingly collect personal data from children. If you believe we have, write to hello@agentrix.one and we will delete it.

Staff of a customer may use the product under that customer’s account and responsibility.

16Changes

We will update this policy when the product or the law changes. The date at the top is the latest version.

If a change is material (new controller, new purpose that is not obvious, or a new category of recipient that changes the risk), we will tell account holders by email or in the product. Continued use after a notice of a material change means the new policy applies from the stated date, except where we need a fresh consent.

17Contact

Privacy, rights, and deletion:

Klik Til Kunder
CVR 37876674
Ole Jørgensens Gade 7, st. th., 2200 København, Denmark
hello@agentrix.one

Supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — www.datatilsynet.dk