Privacy notice

1. Data controller and scope

Personal data controller and processor: AgentSea, run directly by Teddy.

Personal data contact: AgentSea Space support on Zalo.

This notice applies to the agentsea.space website, the AgentSea Space web app, the waitlist, sign-in, plan purchase and payment run directly by AgentSea.

2. Data that stays only in your browser

Your company, AI teammates, tasks, drafts and the AI key you paste into the web app are stored in the browser on your computer. AgentSea's servers do not receive, store or restore this data.

Your AI key is encrypted with your unlock password (at least 8 characters, not only digits) before it is saved. If you choose Don't save the key, it lives only in the open page. AgentSea does not keep your unlock password.

When an AI teammate drafts, the browser sends the content it needs straight to the AI provider of the key you pasted (Google Gemini, OpenAI, Anthropic, OpenRouter, DeepSeek or Groq), not through AgentSea's servers; AgentSea does not receive that content. These providers' servers are outside Vietnam; DeepSeek says it stores data in China; OpenRouter forwards requests to the provider of the model you pick. That provider processes the content under its own terms and data policy for your account. If you enter your own customers' data, you need a lawful basis to do so, and you should leave out details the task doesn't need, such as phone numbers or addresses.

3. Data AgentSea processes on its servers

Data you give us

• Waitlist: phone or Zalo number (optional on the English form), email, business type, plan of interest and the language you chose.
• Account: email, plus the name and profile picture Google provides if you sign in with Google; trial sign-up verifies your email and phone. An AgentSea Space account shares its sign-in with the AgentSea platform; when you open checkout, the account is added to AgentSea's customer group, where other members can see your name, profile picture and join date (never your email).
• Orders: the plan chosen, amount, order code and refund requests.
• Refunds: the account number, account holder name and bank you send to get your money back.
• What you send when you message Amon on Zalo for support. Amon is an AI support assistant run by AgentSea on third-party AI models (currently Google and OpenAI). Messages pass through AgentSea's systems to the model provider to draft replies; AgentSea keeps conversation notes to support you, and a person at AgentSea may read the conversation.

Data created as you use the service

• IP address (hashed for the waitlist; sign-up stores first and latest IP plus a network hash), browser and device type, access times, sign-in sessions, security logs and error logs.
• A canonical-email hash, verified phone and stable device-code hash supplied by the desktop app when pairing. These are pseudonymous, not anonymous: AgentSea can link them to an account and does not guarantee they cannot be traced.
• Order code, amount, time, status, transaction code, transfer note and the transaction description your bank sends through SePay (it may include the sender's name or account number). AgentSea never collects passwords, OTP codes or online-banking sign-in details.
• Your current plan, trial entitlement and end date.

AgentSea does not intentionally ask for sensitive personal data. Do not send passwords, OTP codes, AI keys, health records or your customers' confidential data through the waitlist or support messages. Only send a bank account number when asking for a refund.

4. Purposes of processing

AgentSea does not use data for new purposes incompatible with this notice. If a purpose changes, AgentSea will tell you and ask for consent again where the law requires.

Identity checks at sign-up

• Your verified email and phone/Zalo number, first and latest IP, country, browser type and a pseudonymous device hash are stored to prevent abuse of identities, trial invite codes and download rights.
• The link between an identity and a redeemed invite code is kept for up to 12 months from its latest successful use; an identity blocked for abuse may be kept longer to prevent its return.
• Sign-in codes and invite codes are never logged in plain form. Sign-in codes expire after 10 minutes.

5. Consent and withdrawing it

Where consent is the basis for processing, AgentSea asks for a clear action at the point of collection, such as submitting the waitlist form. Silence, pre-ticked boxes or continuing to browse the website are not treated as consent.

You can withdraw consent or leave the waitlist by messaging AgentSea Space support on Zalo. Withdrawing does not make processing already carried out unlawful; some features may stop if the data is needed to provide them.

6. Recipients of data

Google Gemini, OpenAI, Anthropic, OpenRouter, DeepSeek and Groq receive content directly from your browser with your AI key, as described in section 2; AgentSea neither receives nor sends them that content. Processors receive only the data needed for the task given to them. AgentSea may provide data to competent authorities when there is a legal basis, or to protect the lawful rights and interests of users and the system.

7. Processing and transfer of data abroad

Some parties in section 6 process or store data outside Vietnam: Cloudflare, Google, Resend and OpenAI (Google and OpenAI are Amon's AI model providers and receive content when you message Amon). For these, AgentSea is the party transferring data abroad and meets its obligations under the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP, including an impact assessment where one is required. Web app content is different: your browser sends it straight to the AI provider you chose, as described in section 2; AgentSea neither receives nor transfers it.

8. Cookies and browser storage

AgentSea uses a session cookie to keep you signed in and protect your account, plus a cookie that remembers your language and light/dark choice. The sign-up page stores a random code in the browser to compute the device hash described in section 4. The web app keeps your working data in the browser as described in section 2. AgentSea Space uses no advertising cookies or third-party analytics; if any are added, AgentSea will ask for consent before turning them on.

9. How long data is kept

• Waitlist: until you ask to leave it or AgentSea Space is no longer opening sales for that group.
• Account data: while the account is active; afterwards deleted or de-identified once there is no lawful purpose to keep it.
• Order, reconciliation and invoice data: as long as needed for the transaction, accounting, tax, fraud prevention and dispute resolution.
• Sign-up identity, email, phone and IP checks: up to 12 months from the latest successful use; an identity blocked for abuse may be kept longer.
• Email, phone and device hashes used for trial grants remain as anti-regrant tombstones; after account deletion a device hash can remain without a user ID. Deletion requests are assessed against legal duties and fraud-prevention needs.
• Security and error logs: as long as needed to detect, investigate and prevent incidents.
• Rotating backups: may exist until the end of the backup cycle, then are overwritten or securely destroyed.

Data in your browser is kept and deleted by you; AgentSea has no copy.

10. Your rights as a data subject

Under the Personal Data Protection Law you have the right to: be informed about processing; give, refuse or withdraw consent; view and correct your data or ask for it to be corrected; ask for your data to be provided, deleted or restricted, or object to its processing; complain, denounce, sue and claim compensation; and ask the competent authority to protect your rights.

Send requests through AgentSea Space support on Zalo, stating your account email, the right you want to exercise and which data. AgentSea may verify your identity to avoid disclosing or deleting data by mistake.

Requests to provide, restrict or delete data are handled within 72 hours of receiving a valid request, unless the law provides otherwise. If a correction cannot be made, AgentSea will tell you within 72 hours. A request may be refused or limited where the law allows, for example when data must be kept to meet a legal obligation or resolve a dispute.

11. Protection measures and incidents

AgentSea applies suitable measures from the start and throughout processing: encrypted connections; sign-in cookies that code on the page cannot read; input checks; access control; rate limits; signature checks on payment notifications; a web app page that only allows connections to AI providers; backups; access management and operational logs.

No system removes all risk. If a personal data breach is found, AgentSea takes steps to limit harm, keeps an incident record and notifies the specialised agency of the Ministry of Public Security within the time the law sets; it notifies affected people where needed so they can protect themselves.

12. Children's personal data

AgentSea Space is for business owners and is not intentionally aimed at children. Processing children's data must be in the child's best interest; children aged 7 or older and their parent or guardian must consent as required, unless the law allows otherwise. A guardian can contact us to stop processing or delete unsuitable data.

13. AI and automated processing

AI teammates only write drafts in your browser; you review them before use. AgentSea does not let AI make final decisions that significantly affect payments, benefits or account termination. You can ask a responsible person to review any decision made with AI help.

14. Changes to this notice

When the data, purposes, processing methods or parties involved change, AgentSea updates this document and its effective date. Important changes are announced in the service or through a suitable contact channel before they apply, where the law requires.

15. Contact and complaints

Personal data requests, withdrawing consent or reporting an incident: AgentSea Space support on Zalo. You also have the right to complain, denounce or sue before the competent authority under Vietnamese law.