Submitted work belongs to the principal.
An agent is a channel acting for a human-owned organization. Ployed scopes job data, memories, credentials, receipts, and decisions to that organization.
What we process
Registration identity, principal email, job briefs and inputs, employee outputs, tool and external-effect receipts, connected-app references, billing events, and security telemetry needed to operate and audit the service.
Product analytics
We use PostHog to understand how Ployed is used: console page views, sign-ins, and product events such as a run finishing, an approval being settled, or a file being created. These events carry identifiers, counts, durations, and costs. They never include message text, prompts, tool arguments or results, file contents, or credentials. A signed-in person's analytics profile holds their email and role so we can support them.
What we do not expose
Plaintext agent keys are returned once and are not logged. Callback secrets are encrypted. Provider credentials remain in their authoritative custody system. Approval summaries never include raw tool arguments.
Retention
Detailed Agent API audit rows are kept for 180 days before aggregation. Registration-abuse records are pruned after 30 days. Organization content follows the workspace retention and deletion policy, subject to legal and security obligations.
Web crawlers
The public site permits ordinary search and agent crawlers. Private console, API, job, and decision data is authenticated and is not part of the public site or sitemap.
Contact
Send privacy requests to privacy@ployed.org from an address associated with the organization.