Privacy policy

How we handle your data.

agense is an operating system for agencies. It holds the work an agency does for its clients — budgets, schedules, suppliers, correspondence — so most of what we process, we process on an agency’s instruction rather than our own. This policy says which is which.

Last updated 17 August 2026

Who we are

Experience Technical Consultants Limited (company number 11064051), registered at Fulford House, Newbold Terrace, Leamington Spa, Warwickshire, CV32 4EA, trading as agense. We are the data controller for the processing described under Data we process as controller, and a data processor for everything described under Data we process for our customers.

Data protection registration: ZC223641. Questions, requests and complaints: privacy@agense.io. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Data we process as controller

This is the small part. Visitors to this website, people who contact us about a pilot, and the named administrators of a customer account.

• This website. The marketing site renders as static files and sets no analytics or advertising cookies. Our hosting provider records standard server logs (IP address, request, user agent) to serve and secure the site.
• Enquiries. If you contact us, we keep your name, contact details and what you asked, so we can answer and so we can show the conversation happened. Lawful basis: legitimate interest in responding to an enquiry we did not initiate.
• Account administrators. Name, work email and role, to operate the account and reach a human when something breaks. Lawful basis: performance of our contract with the customer.

Data we process for our customers

When an agency uses agense, the data inside it — its projects, its people, its clients’ information, its correspondence — belongs to that agency. We process it on their documented instruction under a data processing agreement, and we do not decide what it is used for. If you are an employee of, supplier to, or correspondent with an agency that uses agense, that agency is your controller and its own privacy notice governs. We will pass any request you send us to them.

Each customer’s data is isolated at the database level and every query is scoped to a single tenant. Data is never pooled across customers, and one customer’s content is never used to answer another’s question.

Google user data

With an agency’s explicit permission, agense can connect to a mailbox so that correspondence about a project appears alongside the rest of that project’s work. This section describes that connection specifically, because Google requires us to and because it is the most sensitive thing we touch.

What we ask for

One scope: gmail.readonly. It is read-only — agense cannot send, modify, archive or delete anything in a connected mailbox, and we ask for nothing wider than we need.

What we do with it

• Show messages relating to a project in that project’s feed inside the connected agency’s own workspace.
• Draft suggestions from what a message says — a budget change someone agreed in writing, a deadline that moved — and present them to a person for review. A suggestion changes nothing until a human accepts it.

Both are features you can see in the product. We do not use mailbox data for anything that is not one of them.

Limited Use

agense’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not transfer or sell Google user data to third parties such as advertising platforms, data brokers or information resellers.
• We do not use Google user data for advertising of any kind, including retargeting and personalised or interest-based advertising.
• We do not use Google user data to determine credit-worthiness or for lending purposes.
• We do not allow humans to read Google user data, except: with the affirmative agreement of the user whose data it is; where necessary for security purposes or to comply with applicable law; or where the data has been aggregated and de-identified for internal operations.
• We do not use Google user data to train, fine-tune or otherwise improve generalised artificial-intelligence models. Where a connected agency’s own workspace becomes more useful from its own history, that stays inside that agency’s tenancy; anything that crosses it is de-identified and aggregated first, and never contains message content.

Where it is stored, and for how long

In Google Cloud, in the United Kingdom and Europe (region europe-west2), inside the connected agency’s own isolated tenancy. Message content is retained for as long as the connection is active and the agency’s retention setting allows. Disconnecting a mailbox stops all further access immediately and deletes the ingested content within 30 days.

How to revoke access

Disconnect the mailbox in agense, or remove agense’s access directly at myaccount.google.com/permissions. Either revokes our tokens. To have the ingested copy deleted immediately rather than within 30 days, write to privacy@agense.io.

Who else sees data

We use a small number of subprocessors to run the service, each under a written contract that binds them to the same obligations we owe our customers. Today that is Google Cloud (hosting, storage and databases, region-pinned to europe-west2) and the model providers behind the assistive features, which receive only the specific text needed for a task and are contractually prohibited from training on it. A current list is available on request, and customers are told before a new subprocessor is added.

We do not sell personal data. We have never sold personal data.

International transfers

Our infrastructure is pinned to the United Kingdom and Europe. Where a subprocessor processes data outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on adequacy where it applies.

Your rights

Under UK GDPR you may request access to your personal data, correction of it, deletion of it, restriction of or objection to its processing, and portability. Write to privacy@agense.io and we will respond within one month. If the data is held inside a customer’s workspace we will forward your request to that customer, who is its controller, and support them in answering it.

Security

Access to production data is restricted, logged and tied to a named person. Data is encrypted in transit and at rest. Tenant isolation is enforced by the database itself rather than by application code alone, and is covered by automated tests that fail closed. We assess our security annually against the OWASP Application Security Verification Standard as part of Google’s CASA programme.

Changes

When this policy changes materially we will tell affected customers before the change takes effect. The date at the top of this page always reflects the current version.