Privacy Policy

This Privacy Policy describes how Third Eye Technologies, Inc., a Delaware corporation (“Valet”, “we”, “us”), collects, uses, and shares information in connection with the Valet website at askvalet.ai, the dashboard, the API, and the MCP endpoint (the “Service”). We are the data controller (or “business”, under California law) for the personal information described here. Our contact details are in §13.

It applies to principals (the humans and organizations who hold accounts) and to the data generated when their agents use the Service. Where an organization holds the account, this Policy applies to the personal information of its members that we process to operate the account.

It does not govern the independent practices of third-party providers behind catalog services, or of the AI platform or host on which your agent runs. Those are governed by their own policies.

When you sign up via Google or email/password (through Firebase Authentication), we receive your email address, a user identifier, and any display name you provide. We do not receive or store your Google password. Firebase Authentication receives sign-in metadata, such as your IP address and device type, in order to authenticate you and protect your account.

For each agent you create, we store its name, description, status, budget settings, installed services, and a one-way hash of its access token (never the token itself; it is shown to you once and not retained in readable form), along with the identifier of the underlying payment account.

We store your wallet balance, your auto top-up settings, and an append-only ledger of movements (top-ups, debits, and adjustments), each linked to the agent and request involved, plus references to payment and entitlement records. Card details are handled by Stripe (see §4); we store payment identifiers and outcomes, not card numbers.

We record purchase requests your agents submit (the tool requested and the context the agent states for the request), your approval decisions, and an audit trail of significant actions (agent changes, policy changes, approvals, pauses, token rotations). The stated context is free text written by your agent; it may incidentally contain personal or other information your agent chose to include, and it is retained with the request record.

When an agent calls a tool, we record metadata about the call to operate, secure, and improve the Service: a timestamp, the service and tool name, latency, the outcome (allowed, gated, or error), the declared price and currency, how it was covered (free, budget, or entitlement), and opaque agent and principal identifiers. We do not record the arguments your agent sends or the content a service returns in this telemetry.

To fulfill a tool call, the inputs your agent provides (for example a location, a stock ticker, a URL, or a document to process) are sent to the relevant catalog service and, for third-party services, to the underlying provider. These inputs are processed to perform the call and are not stored by us beyond what is needed to complete it; their handling at the provider is governed by that provider’s terms and privacy practices.

Our servers generate operational logs (request metadata, errors, IP address, and user agent) used for security, debugging, and reliability.

We use an essential authentication cookie to keep you signed in.

On askvalet.ai we also use Google Analytics 4 to understand how the site is used: pages viewed, referring site, device and browser type, and approximate location derived from your IP address (Google Analytics does not store IP addresses). How it behaves depends on where you are:

• Outside the European Economic Area, the United Kingdom and Switzerland: Google Analytics sets first-party cookies (_ga and _ga_<id>) to tell visits apart and measures normally.
• Inside those regions: no analytics cookies are set. Google receives only cookieless, aggregated signals, and we do not show a cookie banner because none is needed for that posture.

We do not use advertising cookies, Google signals, or ad personalization, and we do not send your name, email address, or account identifiers to Google. You can opt out with Google’s Analytics opt-out browser add-on, by blocking cookies in your browser, or by sending a Global Privacy Control signal (see §11).

If you contact us, we keep the correspondence and any information you include in it.

We use the information described in §2 for the purposes below. Where GDPR or UK GDPR applies, the legal basis for each is shown.

The Service approves purchase requests automatically when they fall within a budget you set, and holds the rest for your decision. That automation runs on rules you configure for your own agents; we do not make automated decisions about you that have legal or similarly significant effects.

We do not use your information for third-party marketing, and we will not send you marketing email unless you opt in. Service and transactional messages (approvals, receipts, security and policy notices) are not marketing.

We rely on the following to run the Service:

SMS notifications and outbound webhooks are not currently live. When they are, this table will be updated to name the recipients.

When your agent uses a third-party catalog service, the inputs needed for that call are shared with the service and its underlying provider to fulfill it (see §2.6). Current third-party-backed services include weather, market data, web search, page rendering and scraping, and document OCR providers, among others. The live catalog shows which services are third-party.

If you use the Service through an organization account, the organization’s other members can see agents, spend, approvals, and audit entries for that account, including actions attributed to you.

We may disclose information to comply with law or valid legal process, to protect rights, safety, and the integrity of the Service, to enforce our Terms, and in connection with a merger, acquisition, financing, or sale of assets (subject to this Policy).

We may use and share aggregated or de-identified data, such as catalog usage statistics, that cannot reasonably be used to identify you.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights. To make a request, email privacy@askvalet.ai from the email address on your account; we verify requests by confirming control of that address and, where needed, by asking you to confirm details of your account. An authorized agent may submit a request on your behalf if they provide proof of your written authorization. We aim to respond within 30 days and will tell you if we need longer. If we decline a request, we will explain why, and you may appeal by replying to our response.

You can also act directly in the dashboard: manage and delete agents, rotate or revoke tokens, change or disable auto top-up, and export your transaction history. To close your account, email support@askvalet.ai.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) may give you additional rights. In the preceding 12 months we have collected the following categories of personal information, for the purposes in §3 and from the sources in §2: identifiers (email, user ID, IP address); commercial information (wallet, ledger, purchases, and entitlements); internet or network activity (site usage, tool-call metadata, logs); approximate geolocation derived from IP address; and the contents of support correspondence. We disclose these categories to the service providers in §5.1 and, for inputs your agents submit, to the catalog-service providers in §5.2. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. You have the right to know, to delete, to correct, to limit the use of sensitive personal information (we collect none beyond account credentials), and to non-discrimination. Exercise them as described in §8.1.

You have the rights in §8.1 under GDPR, UK GDPR, or the Swiss FADP, and the right to lodge a complaint with your local supervisory authority. Where we rely on legitimate interests (§3.1), you may object, and we will stop unless we have compelling grounds to continue.

Some records, notably the wallet ledger and audit log, are retained for financial and security integrity and may persist (in pseudonymised form) after deletion of other data, as permitted by law (§6).