Privacy Policy

Agent Mart (https://agentmart.dev) is run by Chalk Labs. [RAHIL: legal entity name, registered address.] Chalk Labs decides why and how your personal data is used. This makes us the "controller" under the EU and UK GDPR, the "business" under California law, and the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

• Privacy contact: [RAHIL: privacy email address]
• Grievance Officer (India): [RAHIL: name, email, postal address]. See section 12.
• EU or UK representative: [LAWYER: is an Art. 27 GDPR representative needed? We have no EU or UK establishment.]

We wrote this policy in plain English. If anything is unclear, write to us.

• You can browse Agent Mart without an account, and we do not set analytics cookies.
• We never store your IP address in our database. To count requests and stop abuse, we keep a hash of it that changes every day.
• We collect what we need to run the features you use: your account, newsletter, reviews, stacks, claims, API keys and submissions.
• We do not sell or share your personal information, and we do not show ads based on it.
• Our servers and vendors are mainly in the United States.
• You can ask to see, correct, export or delete your data. See section 11.

Each item below says what we collect, why, and our legal basis under the GDPR. The bases are:

• contract: we need it to give you what you asked for
• consent: you agreed, and you can withdraw at any time
• legitimate interests: our interests, balanced against yours
• legal obligation

Under the DPDP Act we rely on your consent, given through this notice and the forms you submit, or on a legitimate use the Act allows. [LAWYER: map each item to DPDP consent or a section 7 legitimate use; several "legitimate interests" items may need consent in India.]

Account data.
- What: when you sign in with GitHub we get your GitHub user id, username, display name, avatar, email address, account creation date and public repository count. When you sign in with an email link we get your email address.
- Why: run your account, show your name on reviews and claims, and check review eligibility (account age).
- Basis: contract; legitimate interests (preventing fake reviews).

Newsletter data.
- What: your email address, when and where you signed up, the exact consent text you agreed to, your preferences, your country (from your IP address at signup; the IP itself is not stored), and whether you confirmed, unsubscribed, bounced or complained.
- Why: send the weekly digest and security alerts you asked for, and never email people who unsubscribed.
- Basis: consent. Keeping a record of consent and of unsubscribes is a legal obligation or legitimate interest.

Email delivery events.
- What: messages from our email provider saying an email was delivered, bounced or marked as spam, including the recipient address.
- Why: stop sending to addresses that bounce or complain.
- Basis: legitimate interests.

Submissions, reports and privacy requests.
- What: what you send through our forms (suggested listings, corrections, abuse and security reports, claims, privacy requests), with your name and email if you give them.
- Why: handle your request and reply to you.
- Basis: legitimate interests; legal obligation for privacy requests.

Reviews.
- What: your rating, review text, the host and operating system you used, whether it worked, and how your review was verified (a logged-in CLI install or an established GitHub account).
- Why: publish verified reviews and keep fake ones out.
- Basis: contract; legitimate interests for moderation.
- Moderation: we check reviews automatically, including with an AI classifier run by Anthropic, and sometimes by a person. Published reviews are public with your display name and avatar.

Stacks.
- What: stacks you create (title, description, listings, visibility).
- Why: save and share them.
- Basis: contract.
- Public stacks show your name.

Claims and publisher membership.
- What: which listings you claimed, how you proved it (for example your GitHub permission on the repository, or a DNS record), and your role for a publisher.
- Why: let maintainers manage their listings and reply to reviews.
- Basis: contract.

API keys and CLI login.
- What: the keys you create (we keep only a hash of each key), their names, tier and when they were last used.
- Why: authenticate API and CLI requests and apply rate limits.
- Basis: contract.

Rate-limit and usage records.
- What: request counts per API key, per CLI install, or per hashed IP address. The hash changes every day.
- Why: enforce fair use, block abuse, and show key owners their usage.
- Basis: legitimate interests (security).

Search logs.
- What: what you searched for, filters, results count, which result you clicked, and a session id. The session id is a hash of your IP address and browser that changes every day. We do not create it if your browser sends Do Not Track or Global Privacy Control.
- Why: improve search.
- Basis: legitimate interests.
- Please do not type personal information into the search box.

MCP server call logs.
- What: which tool of our MCP server was called, a hash of the arguments (not the arguments themselves), timing, and the API key or hashed IP.
- Why: run and improve the MCP server and stop abuse.
- Basis: legitimate interests.

CLI install telemetry.
- What: only if you turn it on. A random id for your machine, the CLI version, your operating system family, the host app, the listing, and whether the install worked; and your account if the CLI is logged in. Never file paths, usernames, environment values or IP addresses.
- Why: measure whether installs succeed and stay installed, and verify reviews.
- Basis: consent. DO_NOT_TRACK=1 or --no-telemetry always turns it off.

Admin and audit records.
- What: for our own staff, admin email addresses and a log of admin actions. That log can include the data of the record that was changed.
- Why: accountability.
- Basis: legitimate interests.

Maintainer security contacts.
- What: when our scans find a serious security problem in a listed tool, we look up a private contact for its maintainer: GitHub private vulnerability reporting, a SECURITY.md or security.txt address, or a package registry contact.
- Why: tell them privately before anything is published.
- Basis: legitimate interests (the security of people who use the tool).

Public data about maintainers.
- What: listings show who publishes each tool (a name, GitHub account, website) and facts about the repository, collected from public sources such as GitHub, npm, PyPI and the MCP Registry.
- Why: run a useful public catalog.
- Basis: legitimate interests. If you are a maintainer and want a correction or removal of personal details, see section 11. [LAWYER: is this policy enough notice under GDPR Art. 14, and how does the DPDP Act's exemption for data made public by the person apply?]

Product analytics.
- What: page views and a few named events, such as a search (we record its length, not its text), viewing a listing, copying an install command, or clicking out to a repository.
- Who: PostHog (when enabled) and Vercel Web Analytics and Speed Insights.
- How: in memory only, with no cookies or local storage. Events are filtered so email addresses and free text are dropped. There is no session recording.
- Why: understand which pages help people.
- Basis: legitimate interests. See section 9.

Server and error logs.
- What: our hosting and database providers log requests: IP address, browser, the page requested (including search text in the address), status and timing. Error reports (Sentry, once set up) include similar data.
- Why: run, secure and debug the service.
- Basis: legitimate interests.

Bot checks.
- What: our public forms use Cloudflare Turnstile to block bots. Cloudflare receives your IP address, browser details and a technical fingerprint of your connection.
- Why: security.
- Basis: legitimate interests.

Cookies. See section 9.

We do not knowingly collect sensitive data (health, religion, biometrics, government ids). Please do not put any in free-text fields.

• Most data comes from you, when you use a form, sign in or use the CLI.
• Some comes from GitHub when you sign in with it, and only what you authorize.
• Data about maintainers comes from public sources (section 3).
• Email events come from our email provider.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We share it only with:

• Service providers (processors) who run parts of the service for us, under contracts that limit their use of the data. They are listed in section 6.
• The public, only for what you choose to publish: published reviews with your display name and avatar, public stacks, and the public profile of a verified publisher.
• Maintainers of listed tools, when you send a security report about their tool: we may pass on the technical details. We pass on your name or email only with your permission.
• Authorities, when the law requires it, or to protect people from harm. We will tell you unless the law or safety prevents it.
• A buyer or successor, if Agent Mart is sold or merged. This policy keeps applying to your data, and we will tell you first.

• Supabase: database, sign-in and file storage. United States (AWS us-east-1).
• Vercel: hosting, content delivery, server logs, Web Analytics and Speed Insights. United States and a global network. [LAWYER: confirm Vercel's DPA covers our plan.]
• PostHog: product analytics. United States (US Cloud). Off until we sign PostHog's DPA. [RAHIL]
• Sentry: error tracking. Not set up yet; region to be chosen. [RAHIL]
• Resend: sending email. United States. Starts once approved. [RAHIL]
• Anthropic: AI models that moderate review text and summarize public listing data. United States [LAWYER: confirm region].
• Cloudflare: Turnstile bot checks on forms. Global network.
• GitHub: sign-in with GitHub, and the API we use to check claims. When you sign in with GitHub, GitHub's own privacy statement applies to your GitHub account. [LAWYER: independent controller?]

We will update this list before adding a new provider that handles personal data. [LAWYER: is advance notice needed, and how much?]

We are based in India and our servers are in the United States. Your data will be processed in the United States and wherever our providers operate.

• From the EU, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in our providers' data processing agreements. Where a provider is certified, we also rely on the EU-U.S. Data Privacy Framework.
• Transfers out of India are allowed under the DPDP Act unless the government restricts a country. [LAWYER: confirm no restriction notified for the United States.]

• Account data, reviews, stacks, claims: while you have an account. When you delete it, we delete your profile, reviews and memberships. [LAWYER: keep published reviews in de-identified form? Keep public stacks without your name?]
• Newsletter, unconfirmed signups: 30 days (proposed).
• Newsletter, unsubscribed, bounced or complained addresses: kept only as a hashed suppression record so we never email them again (proposed). [LAWYER: period]
• Email delivery events: 30 days.
• Rate-limit counters: 2 days.
• Daily usage records: 90 days for hashed-IP records, then aggregated; for API keys, while the key exists plus 12 months (proposed).
• Search logs: session ids removed after 90 days; the search text is kept to improve search (proposed).
• MCP call logs: 90 days (proposed).
• CLI telemetry: your account link removed after 12 months; anonymous counts kept (proposed).
• Submissions: name and email deleted 24 months after the request is closed (proposed).
• Privacy requests: kept 3 years as a record (proposed). [LAWYER: periods]
• Admin audit log: 2 years (proposed).
• Security disclosure records: while the issue is open, plus 3 years (proposed).
• Server logs: Vercel keeps runtime logs for 1 day on our plan [RAHIL: confirm plan and whether longer retention is on]. Supabase and other providers keep logs for their own periods.

[RAHIL: items marked "proposed" are not yet automated; only email events (30 days) and rate-limit counters (2 days) are deleted automatically today.]

We use only the cookies needed to run the site:

• Sign-in session cookies, set by Supabase, only when you sign in.
• A short cookie (10 minutes) that remembers which page to return to after sign-in.
• Cloudflare Turnstile may use technical storage to tell people from bots on forms.

We do not use advertising cookies. Our analytics (PostHog, when enabled) runs in "memory" mode: it keeps nothing in cookies or browser storage and forgets you when you close the page. Vercel Web Analytics is also cookieless.

We decide on 2026-11-16 whether analytics stays cookieless for everyone or asks for consent first. [LAWYER: confirm that cookieless analytics without a banner is acceptable under the ePrivacy rules in the EU and UK and under the DPDP Act. If we ever turn on cookies or session replay, we will ask for consent first, with equal "Accept" and "Reject" choices.]

We honor Global Privacy Control and Do Not Track for search session ids, and the CLI honors DO_NOT_TRACK=1.

The rights you have depend on where you live. We will answer any request from anyone, wherever they live, and apply the strongest rule that fits.

Everyone. You can ask us to:

• show you your data
• correct it
• delete it
• send you a copy in a common format (portability)
• stop using it for a purpose

You can unsubscribe from email with one click in any email. You can withdraw consent for the newsletter or CLI telemetry at any time; this does not affect what we did before.

EU, UK and Swiss residents (GDPR). You also have the rights to:

• restrict processing
• object to processing based on legitimate interests
• not be subject to decisions based solely on automated processing that significantly affect you
• complain to your data protection authority

Our grades and review moderation are automated. A review held by automated checks always goes to a person before it is rejected. [LAWYER: confirm Art. 22 does not apply to grades or review moderation.]

California residents (CCPA as amended by the CPRA). You have the rights to:

• know what personal information we collect, use and disclose
• delete it
• correct it
• opt out of its sale or sharing
• limit the use of sensitive personal information
• not be discriminated against for using these rights

We do not sell or share personal information, as "sell" and "share" are defined by California law, and we have not done so in the last 12 months. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it. The categories we collect are:

• identifiers (name, email, usernames, hashed IP)
• internet activity (searches, pages, clicks)
• approximate location (country)
• user-generated content (reviews, stacks)

They are described in section 3, with sources in section 4 and recipients in sections 5 and 6. You may use an authorized agent; we may ask them for proof. [LAWYER: does the CCPA apply to us at all, given its revenue and volume thresholds? Keep the section either way?]

India (DPDP Act). As a data principal you have the rights to:

• a summary of your personal data and how we process it, and the identities of those we shared it with
• correction, completion, updating and erasure
• grievance redressal through our Grievance Officer (section 12), before you approach the Data Protection Board of India
• nominate another person to exercise your rights if you die or become unable to. Tell us the nominee's name and contact in a privacy request.

[LAWYER: confirm which DPDP Act and DPDP Rules provisions are in force on the effective date, the response time we must commit to, and whether a consent manager integration is required at our scale. We assume it is not.]

How to make a request:

• Online: use the privacy request form on this page (it records a request of type access, delete, correct, export or object).
• Email: write to [RAHIL: privacy email address].
• Grievance Officer (India): see section 12.

What happens next:

• We confirm we received your request within [LAWYER: 72 hours, or another period].
• We answer within 30 days. If a request is complex we may extend this as the law allows and will tell you why. [LAWYER: GDPR allows 1 month plus 2; CCPA 45 days plus 45; DPDP period per the Rules.]
• We may ask you to prove the data is yours, for example by replying from the email address on file or signing in. We will not ask for more than we need.
• Requests are free. We may refuse or charge for requests that are clearly unfounded or excessive, where the law allows, and will explain why.
• If we cannot do what you asked, for example because the law requires us to keep a record, we will tell you why.

Maintainers who want personal details removed from a listing can use the same form. We keep the listing as a record but remove the personal fields. [LAWYER: confirm.]

Grievance Officer (India): [RAHIL: name], [RAHIL: email], [RAHIL: postal address]. We acknowledge grievances within [LAWYER: period] and resolve them within [LAWYER: period, per the DPDP Rules and, if we are an intermediary, the IT Rules 2021].

If you are not satisfied with our answer, you can complain to:

• India: the Data Protection Board of India
• EU: your local data protection authority
• UK: the Information Commissioner's Office
• California: the California Privacy Protection Agency or the Attorney General

Agent Mart is a tool for software builders and is not meant for children. You must be at least [LAWYER: 18] to create an account or subscribe. We do not knowingly collect personal data from children, and we do not track or target ads at children. If you think a child gave us data, contact us and we will delete it. [LAWYER: the DPDP Act requires verifiable parental consent for anyone under 18; confirm an 18+ rule is the right approach.]

We protect data with measures including:

• encryption in transit
• row level security on every database table
• hashing of keys and tokens
• daily-rotating hashes instead of IP addresses
• least-privilege access for staff

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires. [LAWYER: breach notification timelines under GDPR (72 hours to the authority), DPDP and CERT-In (6 hours for certain incidents).]

We will post changes here with a new version and date. For material changes we will tell account holders and subscribers by email at least [LAWYER: 30] days before they take effect. Where a change needs your consent, we will ask for it.

[RAHIL: privacy email address] · [RAHIL: postal address] · Grievance Officer: section 12.

1. [LAWYER] Do we need an EU or UK representative under GDPR Art. 27 (section 1)?
2. [LAWYER] Map each data category to a DPDP basis (consent or a section 7 legitimate use) (section 3).
3. [LAWYER] Is this policy enough notice to listed maintainers under GDPR Art. 14, and how does the DPDP exemption for data made public by the person apply (section 3)?
4. [LAWYER] Is advance notice of new subprocessors needed, and how much (section 6)?
5. [LAWYER] Is GitHub an independent controller for sign-in (section 6)?
6. [LAWYER] Does Vercel's DPA cover our plan; Anthropic processing region (section 6)?
7. [LAWYER] Confirm no DPDP transfer restriction applies to the United States (section 7).
8. [LAWYER] Retention: de-identified reviews and orphaned stacks after account deletion; suppression list period; submissions and privacy request periods (section 8).
9. [LAWYER] Is cookieless analytics without a banner acceptable under ePrivacy (EU and UK) and the DPDP Act (section 9)?
10. [LAWYER] Confirm GDPR Art. 22 does not apply to grades or review moderation (section 10).
11. [LAWYER] Does the CCPA apply to us, given its thresholds (section 10)?
12. [LAWYER] Which DPDP Act and Rules provisions are in force; required response times; consent manager not required at our scale (section 10).
13. [LAWYER] Acknowledgement and response periods for requests under GDPR, CCPA and DPDP (section 11).
14. [LAWYER] Removing personal fields from a listing while keeping the record (section 11).
15. [LAWYER] Grievance acknowledgement and resolution periods; are we an intermediary under the IT Rules 2021 (section 12)?
16. [LAWYER] Minimum age (18) and DPDP verifiable parental consent (section 13).
17. [LAWYER] Breach notification timelines: GDPR, DPDP, CERT-In (section 14).
18. [LAWYER] Notice period for material changes (section 15).
19. [RAHIL] Legal entity name and address; privacy email; postal address (sections 1, 16).
20. [RAHIL] Grievance Officer name, email and postal address (sections 1, 12).
21. [RAHIL] Sign PostHog's DPA and turn on IP discarding before enabling PostHog (section 6).
22. [RAHIL] Sentry region and settings when created; Resend approval (section 6).
23. [RAHIL] Confirm the Vercel plan and log retention; automate the "proposed" retention periods (section 8).