AgentLoom (“AgentLoom,” “we,” “us”) provides an orchestration platform that runs AI coding agents against software repositories you connect. This Privacy Policy explains what information we collect when you use the AgentLoom website, dashboard, and API, how we use it, the limited circumstances in which we share it, and the choices you have.

It applies to agent-loom.com and the authenticated AgentLoom application. It does not cover third-party services you connect (such as GitHub, Google Cloud, or Anthropic), which are governed by their own privacy policies.

We collect only what we need to operate the service:

We use the information above to:

If you connect a Google Cloud account to AgentLoom for cloud diagnostics, you grant two read-only scopes: https://www.googleapis.com/auth/cloud-platform.read-only and https://www.googleapis.com/auth/run.readonly. AgentLoom uses them solely to read diagnostic information — Cloud Resource Manager project metadata, so you can choose which of your projects to make available to a repository; Cloud Run service, job, and revision metadata; and Cloud Logging entries — so we can surface the status and failure details of your runs back to you. Cloud Run's Admin API does not accept the general read-only scope, which is why the narrower run.readonly scope is requested alongside it rather than a broader one. The effective ceiling on what AgentLoom can read is your own IAM permissions on the connected account, narrowed further by the per-repository binding you create.

We do not use this access to create, modify, or delete any resource, and we do not use Google user data for advertising or to train generalized AI models. Access tokens and refresh tokens for connected accounts are stored encrypted using envelope encryption backed by a cloud key-management service, and you can disconnect the account at any time to revoke access.

AgentLoom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect a Microsoft Azure account to AgentLoom for cloud diagnostics, you sign in with Microsoft Entra ID and grant delegated access to Azure Resource Manager (https://management.azure.com/user_impersonation) and Azure Monitor Log Analytics (https://api.loganalytics.io/Data.Read). AgentLoom uses this access solely to read diagnostic information — resource and service metadata and log-query results — so we can surface the status and failure details of your runs back to you. The effective ceiling on what AgentLoom can read is your own Azure role-based access control (RBAC).

As with other connected accounts, we do not use this access to create, modify, or delete any resource, and we do not use the data for advertising or to train generalized AI models. Access tokens and refresh tokens for connected accounts are stored encrypted using envelope encryption backed by a cloud key-management service, and you can disconnect the account at any time to revoke access.

If you connect an AWS account to AgentLoom for cloud diagnostics, you create a cross-account IAM role from a CloudFormation template we provide, scoped to read-only actions on CloudFormation, EC2, IAM, Systems Manager, and S3. AgentLoom assumes that role solely to read diagnostic information — resource and stack state and related metadata — so we can surface the status and failure details of your runs back to you. The effective ceiling on what AgentLoom can read is the policy attached to that role, which you control and can update or delete at any time.

As with other connected accounts, we do not use this access to create, modify, or delete any resource, and we do not use the data for advertising or to train generalized AI models. Every read happens only under a grant you give in the dashboard — once, for a session, or always — and payloads are scrubbed of secrets and size-capped before the assistant sees them.

We do not sell your personal information. We share information only as needed to run the service, and only with providers bound to protect it:

We retain information for as long as your account is active or as needed to provide the service, then delete or de-identify it within a reasonable period unless a longer retention is required by law. Run artifacts and logs are retained on a rolling window and expire automatically. You can request deletion of your account and associated data by contacting us.

We apply industry-standard safeguards: encryption in transit, encryption at rest for stored secrets and connector tokens via a cloud key-management service, scoped access to connected systems, isolated execution environments for agent runs, and audit logging. No method of transmission or storage is completely secure, but we work to protect your information and to promptly address issues that arise.

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can disconnect any connected account at any time from the dashboard, which revokes AgentLoom's ongoing access. To exercise other rights, contact us using the details below.

AgentLoom operates on cloud infrastructure that may process data in regions other than your own. Where we transfer personal information across borders, we rely on appropriate safeguards consistent with applicable law.

AgentLoom is a tool for software teams and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice.

Questions about this policy or your data can be sent to privacy@agent-loom.com, or through the contact form at agent-loom.com/contact.