Privacy Notice

Applies to: Team Asta — the website at teamasta.com and the Asta app at teamasta.com/app. Version: 2.4 · Effective: 10 November 2026

This notice explains what personal data we process when you use Team Asta, why, on what legal basis, who else sees it and what you can do about it. It is the privacy notice referred to in clause 13.3 of the Team Asta Terms and Conditions. Section 5 describes how we handle data from a Google account you connect.

1. The two roles — read this first

Team Asta processes personal data in two different capacities, and your rights run against a different organisation depending on which one applies.

1.1 We are the controller for personal data about the people who hold Team Asta accounts — account administration, security, support, billing and service communication. Section 3 describes that processing. If you have a Team Asta account, this notice is addressed to you.

1.2 We are a processor for everything a customer gives Asta to work with: the mail, calendar and contacts of the accounts they connect, their files and notes, their calls and chats with Asta, what Asta keeps for them, and their projects, including the answers Participants give. The customer — the organisation whose account holds the data — is the controller of that data. We process it only on their instructions, under our Data Processing Agreement, referred to in clause 13.2 of the Terms. Section 4 lists what it covers.

1.3 If your data reached us because you wrote to, met or are a contact of one of our customers, or because you answered an interview link — the customer is the one who can tell you what happens to it, and the one who must act on your request. Section 13 explains how to find them, and what we will do if you come to us instead.

2. Who we are

Agentic Agency ApS Gammel Kongevej 152 B, 3. 1850 Frederiksberg C Denmark CVR no. 46326458

Team Asta and Asta are offered by Agentic Agency ApS. Full company details, representation and supervisory information are in our Legal Notice / Impressum.

Privacy contact: privacy@agenticagency.dev

We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR: our core activities do not consist of large-scale regular and systematic monitoring of data subjects, nor of large-scale processing of special-category data.

3. What we process as controller, and why

3.1 Account data

If you are on the waitlist. A new account waits until we approve it. While it waits we hold only what you gave when you registered — your name and email address, whether the sign-in service has verified the address, and when you registered — and nothing else is set up: no connected accounts, no trial. We use it to decide on your access and to tell you when you are in. Legal basis: Art. 6(1)(b), steps taken at your request before entering into a contract. We keep it until we approve the account (from then on it is account data, as above) or until you ask us to delete it; we may also delete waiting registrations we do not intend to approve. To have yours deleted, write to privacy@agenticagency.dev.

3.2 Usage and operational data

We use no analytics or advertising trackers from anyone else, and we do not profile you for advertising or to decide anything about you. The customer overview above is our own.

3.3 What we do not do

• We do not sell personal data, and we do not share it for anyone else's marketing or advertising.
• We do not use your mail, calendar, contacts, files, conversations or your Participants' answers to train AI models, and our AI providers may not either (section 6).
• We take no automated decision producing legal or similarly significant effects for you within the meaning of Article 22 GDPR.

4. What we process as processor, on our customers' instructions

This is the bulk of what the service holds. The customer is the controller of all of it.

• Mail — messages of the connected mailbox, with sender, recipients, subject, body and attachments, and the drafts and messages Asta writes.
• Calendar — events of the connected calendar, with their attendees, and the changes and replies Asta makes.
• Contacts — the contacts of the connected account and the people the customer corresponds with, and the notes Asta keeps about them for the customer.
• Files and notes — documents the customer uploads, and notes, lists and files Asta writes for them.
• Conversations and calls — the customer's chats with Asta, the transcripts of voice calls with Asta, and, in projects, the full transcript of every chat and voice interview with Participants.
• Work items — to-dos, decisions and reminders Asta keeps for the customer, and the web pages and sources the customer asks Asta to watch.
• Asta's memory — what Asta notes for itself to remember about the account holder, their work and the people they deal with, across conversations (section 6.1).
• Browsing — websites Asta opens for the customer in a browser kept for them. If the customer signs in to a website there, the login and its cookies are stored for the customer in that browser's profile, on an encrypted volume.
• Projects — contacts (name, email address, optionally organisation and a note) the customer wants an Agent to reach, interview links (goal, expected result, expiry and a hash of the link token; the token itself is never stored), and the results.

We access this data only to run the service, to fix a fault, or where the customer asks us to. Our staff do not read it as a matter of routine. For those cases our team has an admin view of each customer with its log, a link to a session at Anthropic and an export of a customer's project data. Content from a connected Google account that such a session holds is looked at only as section 5.5 says.

5. Google user data

This section applies only when you connect a Google account to Team Asta.

5.1 What we access. With your consent on Google's consent screen, Team Asta requests these permissions: read, compose, send and organise mail in your Gmail account (gmail.modify); see, create, change and delete events in your Google Calendar (calendar); read your Google contacts (contacts.readonly); and your Google account's email address (openid, email).

5.2 How we use it. We use Google user data only to provide the features you see in Team Asta: Asta reads and sorts your mail, prepares and — where you have authorised it — sends replies from your own mailbox, keeps your calendar, finds the people you write to, and answers your questions about all of it. To do that, the content Asta needs for a task is sent to our AI provider Anthropic (section 6.1), and, during a voice call, to OpenAI (section 6.3), each acting only on our instructions and barred from training on it.

5.3 How we store it. We keep a working copy of your mail (from the last 90 days when you connect, and new mail as it arrives), your calendar (90 days back, 540 days ahead) and your contacts in our databases and files on our servers in Germany. Attachments are fetched when first needed and cached. The access tokens Google issues to us are stored encrypted. Mail in our copy is removed automatically every night once its thread has had no activity for 365 days, unless it is marked to be kept; it stays in your Google account. What Asta keeps of a message to sort and file it — sender, subject and an extract of the text — goes with the message: in the nightly run after the mail leaves our copy, and shortly after you delete the copy on disconnecting (5.4).

5.4 Disconnecting. You disconnect a Google account yourself, in Settings (Connections, "Disconnect") or by asking Asta. We then ask Google to revoke our access, delete the access tokens and stop syncing. You choose whether the copied mail and calendar data are deleted at once or kept: kept mail is removed by the nightly removal in 5.3, kept calendar entries stay until you delete them, delete your account or ask us to. The contacts we copied, the notes Asta keeps about them and what Asta remembers (section 6.1) stay with your account until you delete them or ask us to. You can also remove Team Asta's access at any time in your Google account settings (myaccount.google.com/permissions). Our help page Your data shows each step.

5.5 Limited Use. Team Asta's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide or improve the user-facing features of Team Asta described in 5.2;
• we transfer it only to provide those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after your explicit prior consent — never to advertising platforms, data brokers or information resellers;
• we do not use it for advertising, to determine creditworthiness or for lending;
• we do not use it, and do not allow anyone else to use it, to create, train or improve generalised AI or machine-learning models;
• no person reads it unless you have given explicit consent for specific data (for example when you ask us for help), it is needed for security purposes (such as investigating abuse), it is needed to comply with applicable law, or it is aggregated and anonymised and used for internal operations.

Our team's admin view links to Asta's sessions at Anthropic (section 4), and a session can hold content from your Gmail. People on our team look at such content only for support, when you ask us for it, and only at what your request concerns.

6. AI models, web search and voice

6.1 Language models — Anthropic. Team Asta works by sending text to large language models from Anthropic PBC (Claude). When you write to Asta, when Asta sorts new mail or prepares the work a mail brings, when it checks a source it watches for you, or when a Participant answers, the message and the context needed for the task — for example the mail, calendar entries, files or earlier conversation concerned — are sent to Anthropic to produce the reply. Anthropic acts as our processor and is prohibited by its commercial terms from training models on this content.

Asta runs on Claude Managed Agents, in which Anthropic runs the assistant in its cloud. Anthropic therefore stores the session history — the conversation and the results of Asta's tools, which can include the content of mail, calendar entries and files — and any files placed in the session, until we delete them through Anthropic's API. Anthropic also keeps, in a vault, the keys with which Asta reaches its tools in our own services. We keep a copy of the session events in our own database in Germany, except for voice calls.

Asta's memory. So that Asta remembers across conversations, it writes notes for itself about the account holder, their work and the people they deal with: one memory for each person and one shared by everyone in a workspace. The shared one also holds the workspace's rules and the notes our team takes in a set-up call. Asta reads and changes them when you chat or talk with it; when it sorts new mail or prepares the work a mail brings, it can only read them. These memories are stored by Anthropic, as memory stores of Claude Managed Agents, until we delete them through Anthropic's API, which we do when the account is deleted (section 9).

This data is stored, and models are run, in the United States; Anthropic offers no EU-only option for this. We have not yet fixed an automatic deletion schedule for it (section 9). Written interviews run on Claude Managed Agents too, in a session of their own, with a memory store for each Participant; what this section says about storage applies to them. Your chat in a project, spoken interviews and the summary of a call are answered through Anthropic's Messages API; Anthropic keeps no session for those and retains inputs and outputs only for the limited period its commercial terms allow.

6.2 Web search. When Asta or a project agent searches the web or opens a web page, the search query or address is sent to Anthropic, which runs the search and fetches the page. Pages Asta opens in its browser (section 4) and sources it watches are loaded from our own servers instead. The search queries of project agents are also logged in our metering (section 3.2).

6.3 Voice — OpenAI. When you talk to Asta, or a Participant answers by voice, your browser connects directly to OpenAI (real-time speech model), which hears the audio, speaks the answers and receives the instructions and context for the call. That context can include what Asta remembers, your agreements with it, the earlier conversation and what Asta's tools return, which can be mail or calendar content. Audio leaves your device and is processed by OpenAI in the United States as our processor. Our servers set up the call and receive the transcript, not the audio. For a task during the call, parts of the transcript go to Anthropic (section 6.1): in your calls with Asta to an agent that works with your tools and memory, in interviews through the Messages API. Under OpenAI's API terms, data sent through its API is not used to train its models unless the customer opts in; we do not opt in. The transcript of the call is stored with the customer's data under section 9.

6.4 You are told it is an AI. Participants are told they are interacting with an AI system before a conversation starts, as Article 50(1) of Regulation (EU) 2024/1689 (the AI Act) requires and clause 8.3 of the Terms promises. Asta never presents itself as a named human being.

6.5 AI output can be wrong. Nothing Asta produces should be relied on as fact, advice or a decision without a human checking it.

6.6 Asta's first call by phone. On the first-run screen you can enter a mobile number and agree that Asta phones you once, to welcome you and set up your first days. We use the number for nothing else, and we do not call without your agreement. Our telephony service, Voice Call, dials the number through Telnyx, our telephone provider (through the account of Frei Services & Consulting UG), and connects the call to OpenAI's real-time speech model, which hears you and speaks Asta's words (section 6.3). When you answer, Voice Call hands the call to Team Asta, and we conduct it the way we conduct a call with Asta in the app: an agent at Anthropic (section 6.1) takes part in the live call, works with your tools and can read and change what Asta remembers. After the call a model from Anthropic writes a short summary with the answers Asta asked for from the transcript. We do not keep a recording of the audio. What is stored: on your user record, the number and the time you agreed; once the call is ordered, a record of the order (number, language, time zone, state, when it was placed, the call's reference at Voice Call, how long the call took and how it ended) with the summary and the answers; the transcript, in your chat with Asta; and in Voice Call the record of the call — your number, when it took place, its state and length — with a copy of the transcript, the summary and the answers. Voice Call deletes its call record, with that copy, automatically 90 days after we ordered the call from it. The summary and answers on the record of the order and the transcript in your chat stay until you delete your account or ask us (section 11); the 90 days do not apply to them. The number and your agreement go, from your user record and from the record of the order, when you press "Don't call me" in Settings (Phone) or on the first-run screen, or ask us (section 11), or when you delete your account; the rest of the record of the order goes when you delete your account. A call that has not gone out yet is then called off; one that is already being dialled can still ring, and ends when you answer, without Asta speaking. Neither withdrawing nor deleting your account deletes the call record at Voice Call earlier than the 90 days. Deleting your account deletes Anthropic's session of the call (section 9). You can withdraw your agreement at any time; that does not affect a call already made.

7. Who else sees the data

We use the following processors. Each processes personal data only on our instructions and under a written data processing agreement.

For fraud prevention and its own regulatory compliance, Stripe also acts as an independent controller of the data it holds — unlike the other processors above, which act only on our instructions.

Google is not our processor. When you connect a Google account, Google is the provider of your own account; Team Asta reads from it and writes to it on your instructions (section 5). Mail Asta sends for you goes out through your own mailbox.

We will also disclose personal data where the law requires it, and to our professional advisers under a duty of confidence. We do not otherwise pass it to anyone.

Transfers outside the EU/EEA. Anthropic, OpenAI and Telnyx process data in the United States. The transfers to Anthropic and OpenAI are made under the EU–US Data Privacy Framework where the provider is certified, or otherwise the Standard Contractual Clauses (Article 46 GDPR); the transfer to Telnyx under the Standard Contractual Clauses. Both come together with the supplementary measures set out in our Data Processing Agreement. A copy of the relevant mechanism is available on request from privacy@agenticagency.dev.

8. Cookies and storage in your browser

Team Asta sets only strictly necessary cookies, so no consent banner is required under the Danish Cookie Order (cookiebekendtgørelsen) or Article 5(3) of Directive 2002/58/EC:

• a session cookie that keeps you signed in for up to 12 hours;
• a short-lived cookie, valid for up to 30 minutes, that secures the sign-in step;
• the cookies of our sign-in service while you sign in;
• while you connect a Google account, a short-lived cookie that ties the Google consent back to your account.

The app also keeps two things in your browser's local storage, only for your convenience: the workspace you chose and the last job sentences you typed.

We set no analytics, advertising or third-party tracking cookies. Interview links set no cookie at all — a Participant needs no account and gets none; the page only remembers, in the open browser tab, where the Participant was and the finished conversation.

9. How long we keep things

Team Asta has no general automatic deletion of what customers hold yet. We state this plainly rather than quote periods we do not enforce:

• Account data is kept while the account exists.
• A registration on the waitlist is kept until we approve it or you ask us to delete it (section 3.1); waiting registrations we do not intend to approve may be deleted earlier.
• Mail copied from a connected account is removed every night once its thread has had no activity for 365 days, unless it is marked to be kept (section 5.3). If our copy outgrows its storage limit, cached attachments and the HTML of the oldest mail go first; the text stays. Calendar entries and contacts are kept while the account stays connected, and on disconnect as section 5.4 says.
• Files and notes, conversations, call transcripts, work items, Asta's notes and project content are kept until the customer deletes them, deletes the account or asks us to. An expired interview link stops working, but its record and transcript remain in the customer's project. Older versions of a file beyond the newest ten can be removed for good after 30 days. Deleted files and other versions can stay restorable until the account is deleted or the customer asks us to remove them.
• Data held by Anthropic (section 6.1) — session history, session files and Asta's memory stores — stays with Anthropic, in the United States, until we delete it through its API. We delete it when the account is deleted, as described below, and otherwise on request; we have not yet fixed an automatic schedule, and we state none.
• Backups are volume snapshots taken every night in the same OVHcloud region. We keep the last four nights of each volume, so a snapshot normally goes after about four days; if a night's snapshot fails, the older ones stay until a new one works.
• The first call (section 6.6): the call record at Voice Call, with its copy of the transcript and summary, is deleted 90 days after we ordered the call from it; the transcript in your chat and the summary and answers on the record of the order stay until the account is deleted; the number and your agreement as section 6.6 says.
• The browser Asta uses (section 4): a profile is deleted automatically about 30 days after it was last used.
• Technical records of our services — change logs, runs of monitors, deliveries, connect links, sent-mail queues, queues of the Core and snapshots of databases in our file service — are removed automatically after 7 to 35 days.
• Service metering and server logs are kept for operational and security purposes. Metering goes with the account; for server logs we have fixed no period.
• Billing records stay after an account is deleted, for our bookkeeping: your customer record at Stripe and the billing events Stripe sent us, which can hold your name, email address, billing address and VAT ID. We keep them for five years, as Danish bookkeeping law requires. No job removes them yet; we delete them when that period is over.
• Proof that you accepted our texts stays after an account is deleted: only your email address, the versions of the Terms, this notice and the DPA you accepted and when, for five years (section 3.1).

Deleting your account. You can delete your account yourself, in Settings ("Delete account"). That deletes at once the account and what it holds — files and notes, conversations and call transcripts, contacts, work items, projects, connected accounts with the data copied from them, and the session history and memory stores Anthropic holds for it, including the sessions of your voice calls with Asta and of the first call — and cancels a paid subscription; a checkout you left open is closed as well. A call with Asta that is running then is ended first. Where you share a workspace with others, the workspace and what the others hold in it stay, including its sessions and shared memory at Anthropic; your membership and your own conversations go. What you wrote to everyone in it stays, with your name. What remains: billing records as above, which include your customer record at Stripe, the backups until they expire, a record that an account was deleted and what was deleted, without your name or email address, the disabled user records with your name and email address in our file service and the service behind Asta's browser, which we delete on request, the call record at Voice Call until its 90 days are over (section 6.6), the proof of acceptance as above, and the browser profile Asta used for you (section 4, "Browsing"), which is locked with the account but not yet deleted; it goes automatically about 30 days after it was last used, or earlier on request. Your sign-in record with our sign-in service is deleted automatically as well, as the last step; if that step fails, our team deletes it by hand.

To have anything else removed, ask — see section 11 — and we will remove it. Our help page Your data shows the steps.

10. How we protect it

Traffic is encrypted in transit (TLS). The app's databases and file volumes are on encrypted block storage; the database of our sign-in service is not yet (Annex II of the DPA says so). Access tokens for connected accounts are encrypted by the application itself; saved website logins lie on encrypted volumes. Passwords are stored only as hashes. Interview link tokens are stored only as hashes, so a database copy does not yield working links. Sign-in is protected against password guessing. Access to production is limited to the people who need it. Volumes are backed up nightly.

Annex II of the Data Processing Agreement describes the measures in detail, including those not yet in place. Clause 14 of the Terms sets out our security commitments, and clause 13.5 our breach notification duty — without undue delay and in any event within 48 hours of becoming aware.

11. Your rights

Where we are the controller (section 1.1), you have the right to:

• access the personal data we hold about you, and get a copy;
• rectify it if it is wrong or incomplete;
• erase it, where one of the grounds in Article 17 applies — you can also delete your account yourself at any time (section 9);
• restrict our processing, in the circumstances in Article 18;
• portability — receive the data you gave us in a structured, machine-readable form, and have it sent to another controller where technically feasible;
• object to processing we base on legitimate interests (section 3.2), on grounds relating to your particular situation;
• withdraw consent, where we rely on consent — which, as section 3 shows, is the case for the first call (section 6.6): you withdraw it with "Don't call me" in Settings (Phone) or on the first-run screen, or by writing to us. Your Google consent (section 5) you withdraw by disconnecting.

Write to privacy@agenticagency.dev. We answer within one month, and will tell you if we need the extension Article 12(3) allows. We may ask you to confirm who you are before we act, so we do not disclose your data to someone else.

12. Complaints

If you think we have handled your personal data wrongly, tell us first — we would rather fix it. You also have the right to complain to a supervisory authority, in the EU/EEA country where you live, work, or where you think the problem happened.

Ours is:

Datatilsynet (the Danish Data Protection Agency) Carl Jacobsens Vej 35, 2500 Valby, Denmark +45 33 19 32 00 · dt@datatilsynet.dk · datatilsynet.dk

13. If you are in a customer's mail, calendar or contacts, or were contacted by an Agent

If you write to, meet or are a contact of one of our customers, your messages, calendar entries and contact details may be processed by Team Asta on that customer's behalf. If you received an interview link, an organisation using Team Asta put your name and email address into a project and asked an Agent to reach you. In both cases that customer is the controller. They decide what happens to your data, and your rights under section 11 run against them, not against us.

The interview page names the person who invited you and states the purpose before the conversation starts. If you cannot work out who the customer is, write to privacy@agenticagency.dev with what you know (for example the link, or the address that wrote to you) and we will identify the customer and pass your request on without undue delay. We will act on it ourselves where the customer instructs us to, and we will tell you what happened.

You are never obliged to answer an interview. The interview page carries a decline option, and declining ends the link.

14. Changes

We will update this notice when the service changes. The version number and effective date at the top always identify the current text, and each published version is tied to the release it shipped in, so it is always possible to establish which text applied when.

We do not send a separate email about a new version. When a new version of the Terms, this notice or the DPA is published, the app shows you a screen with links to the new texts the next time you open it, and you can go on using the app only after you have accepted them. If you do not accept, you can sign out on that screen, or delete your account there (section 9). To end the agreement without deleting your account at once, write to legal@agenticagency.dev; clauses 16.4, 16.5 and 20.2 of the Terms then govern export and deletion. We will not use Google user data in a new way, or for a purpose other than the ones in section 5, before you have agreed to an updated notice.

15. Contact

Agentic Agency ApS · privacy@agenticagency.dev Gammel Kongevej 152 B, 3., 1850 Frederiksberg C, Denmark · CVR 46326458