Privacy Policy

Fullmakt ("Fullmakt", "we") is a credential broker for AI agents. It issues scoped, short-lived credentials to your agents, verifies their access, and records a tamper-proof audit of every call. This policy explains what data the hosted service handles and where it goes.

Summary: We store the data needed to run your account and broker credentials on your behalf — your account details, the upstream secrets you ask us to broker (encrypted), and audit records of agent activity. We do not run analytics, telemetry, or tracking, and we never sell, rent, or share your data for advertising.

Data we handle

1. Account details. When you sign up we store your email address and a hashed password to create and secure your account. Team and workspace membership is stored so collaborators can share configuration.
2. Brokered credentials & configuration. The upstream API keys, OAuth/OIDC client secrets, and connection details you ask Fullmakt to broker are stored encrypted so we can mint scoped, short-lived credentials for your agents. These secrets are never exposed to the AI model — agents receive only the short-lived credential.
3. Audit & activity records. Each credential issuance, agent call, and revocation is recorded in a cryptographically chained audit log so you can answer which agent did what, when, and on whose behalf. This is core to the product and cannot be disabled.
4. Contact enquiries. If you use the contact form, the email address and message you submit are emailed to our team so we can reply. They are not used for any other purpose.
5. Sandbox sessions. The no-signup sandbox creates a temporary, anonymous account seeded with demo data. Sandbox accounts and their data are automatically expired and deleted; if you claim the account, it converts to a normal account and this policy applies to it.

What we do NOT do

• No analytics, telemetry, or usage tracking.
• No third-party trackers or advertising.
• No selling, renting, or sharing of your data.
• We never expose your stored secrets to the AI model or to other tenants.

Subprocessors

We use a small number of third parties strictly to operate the service:

• Polar — payment processing for paid plans. Card details are entered with Polar and handled by them; we do not store your full card number.
• Email delivery — our email provider transmits contact-form enquiries and transactional account email.

Data retention

Account data and brokered configuration persist for as long as your account is active. When you delete your account we remove your account data and stored secrets; audit records may be retained as long as needed to meet security and legal obligations. Sandbox data is purged automatically when the session expires.

Your rights

You can access, correct, export, or delete your account data. To make a request, or for any question about this policy, contact us below.

Contact

Questions about this policy: privacy@fullmakt.ai