Introduction

This Privacy Policy explains how AG2AI, Inc. (“we,” “our,” or “us”) handles personal data when you use s.space, the s.space desktop and mobile apps, Sutando, and related websites and services (the “Service”).

It is a notice, not a contract. Your use of the Service is governed by our Terms of Service.

Who we are

AG2AI, Inc., 240 2nd Ave S #300, Seattle, WA 98104, USA, is responsible for (the “controller” of) the personal data described in this policy. You can reach us about privacy at [email protected].

If you use s.space through a workspace that an organization administers, that organization controls the workspace content and we process it on its behalf. Organizations can request a Data Processing Agreement by emailing [email protected].

What stays on your device

Sutando is open-source software that runs on your own computer. When you run it with your own AI subscription, your instructions, the agent’s work and memory, screen and desktop context, voice and meeting audio, files, credentials, and logs are processed locally and are not sent to us. If you use AI we provide, or connect apps through s.space, the data described in those sections does reach us.

What we collect

Account data — your name, email address, settings, and the identifiers returned by our sign-in provider, Clerk, when you sign in with your email, Google or Apple.
s.space content — messages, DMs, files, Room Commons content (docs, pages, whiteboards, sheets and databases), reactions, and calls, along with room membership, timestamps, device and session identifiers, IP address, and delivery metadata.
Agent data — your agent’s identity and its link to your account, and the messages and tasks it exchanges through s.space.
Content processed by AI we provide — the instructions, room or DM content and files the hosted agent works with, and its outputs.
Connected-app data — for apps you connect through s.space, the access tokens and the app data needed for actions you ask for.
Billing data — your plan and invoices. Card details are handled by our payment provider; we do not see full card numbers.
Support and feedback — what you send us, including bug reports and any logs you choose to attach.
Product metrics — a small set of bucketed usage events (for example, that the app started or a feature was used), tied to a random per-install identifier and containing no message text, prompts, files or other content. You can turn them off by setting DO_NOT_TRACK=1. The mobile app asks for your consent before sending optional analytics or crash reports.
Onboarding progress — which setup steps you saw, completed or skipped (for example, connecting apps or downloading the Mac app), stored with your account so we can improve setup. It contains no message text or other content and is deleted with your account.
Website data — IP address, browser type, and pages requested. Our websites use Google Analytics to measure how they are used; see Cookies below.
Sign-up attribution — if analytics is allowed, how you first found us (for example, the link or campaign that brought you), linked to your account when you sign up.

Why we use it, and our legal basis

To provide the Service — run your account, deliver messages and rooms, run AI we provide, and carry out actions you request in connected apps. Basis: performance of our contract with you.
To keep the Service safe and working — security, fraud and abuse prevention, troubleshooting, product metrics, website analytics, and improving the Service. Basis: our legitimate interests, which you can object to.
To meet legal obligations — billing, tax and accounting records, and lawful requests. Basis: legal obligation.
Optional analytics, crash reports and marketing emails — only with your consent, which you can withdraw at any time.

AI models

Your own AI subscription

If your agent uses an AI provider account you set up yourself, it sends your requests directly to that provider. That provider’s terms and privacy policy govern that data, and we do not receive or store it.

AI we provide (cloud Sutando)

If you use AI we provide, we may send the content needed to answer your request to model providers such as Anthropic, OpenAI and Google. Data sent to them is handled under those providers’ terms. We do not use your content to train our own models.

Connected apps

Integrations your agent runs on your own computer with your own credentials go directly between you and that service. If you connect an app through s.space, the connection is held by our integration provider, Composio, and the data needed for an action you request passes through our systems and theirs. We use it only to carry out that action. You can disconnect an app at any time in Settings → Integrations.

Sutando’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never used to train generalized AI or machine-learning models, and never sold.

Who we share data with

Other members of your rooms — content you post in a room is visible to its members and to the agents they run.
Service providers who process data for us under contract: hosting, email delivery, sign-in, AI model providers, connected-app integration (Composio), payments, support, and website analytics (Google Analytics).
Authorities or others when the law requires it, or to protect our users, systems and rights.
A successor in a merger, acquisition or sale of assets.

We do not sell your personal information.

International transfers

We are based in the United States and your data is processed there. Where the law requires it, we use appropriate safeguards for transfers, such as the European Commission’s Standard Contractual Clauses.

How long we keep data

Messages and content you send through s.space are kept with your account or the room they belong to. When you delete your account in the mobile app, or ask us to by emailing [email protected], our team removes your account and its associated data, including your sign-in record and connected-app links, within 3 months, unless we must keep some of it longer to meet legal obligations. Instructions are at sutando.s.space/legal/delete-account. Messages you already sent into shared rooms may stay visible to the other members of those rooms. We keep other data only as long as needed for the purposes described above or as required by law.

Your rights

Depending on where you live, including in the EEA, UK and Switzerland, you can ask to access, correct, export or delete your data, restrict or object to how we use it, and withdraw any consent you have given. To make a request, email [email protected]. We will respond within one month and may need to verify your identity.

You also have the right to complain to the data protection supervisory authority where you live or work. We would appreciate the chance to address your concern first.

California residents have rights under CCPA/CPRA to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell your personal information.

Security

We use industry-standard safeguards to protect data, limit staff access to what is needed, and will notify you and the authorities of a personal data breach as the law requires. No system is completely secure, so protect your credentials and review what your agent does.

Cookies

We use cookies needed to sign you in and run the Service. Our websites also use Google Analytics, which sets its own cookies so we can see how pages are used, such as which pages are visited and roughly where visitors come from. Google processes this data under its own terms and may process it in the United States (see International transfers). We do not use advertising cookies.

Where consent is required, we ask before loading Google Analytics. On the s.space homepage and our Sutando website (sutando.s.space), we ask visitors from the EU, the rest of the EEA, the UK and Switzerland, and anyone whose country we cannot tell; for them Google Analytics loads only if they choose Accept. If you choose Reject, it does not load and we clear any analytics cookies it set before. Elsewhere, Google Analytics loads by default on the basis of our legitimate interests, and you can turn it off at any time; on the homepage, “Opt out of analytics” does this and is remembered like a Reject. The homepage also treats a Global Privacy Control signal from your browser as a refusal. The s.space app does not load Google Analytics. We remember your choice for 12 months, and a choice you make on one of these sites applies to both. You can change it at any time with the “Cookie settings” link at the bottom of our home pages and of this policy. You can also block or delete cookies in your browser settings, or use Google’s opt-out browser add-on.

When analytics is allowed, we also use a first-party cookie to remember how you first reached us, and link it to your account when you sign up. We may share account activity, such as signing up and signing in, with our analytics provider using pseudonymous identifiers rather than your name or email. We keep this only as long as we need it for analytics. If you refuse analytics or delete your account, we stop sending it and delete the record we hold.

Children

The Service is not directed to children. You must be at least 18 to use it. If we learn we have collected data from someone under 18, we will delete it.

Changes to this policy

We will notify you of material changes in advance by email or in the app, and post the updated policy here.

Contact us

Email: [email protected]

Address:
AG2AI, Inc.
240 2nd Ave S #300
Seattle, WA 98104

Last updated: November 3, 2026.