How we handle personal data across Hong Kong, the EU/UK, and the United States.
Last updated: 24 June 2026
AgenticOS (“AgenticOS”, “we”, “us”) operates the agentic business-operations platform at agenticos.hk. We are based in Hong Kong SAR. For most business data you provide, we act as a data processor on behalf of your organisation (the controller); for your account and our own operations we act as a data controller. Where required, our contact for privacy matters is set out in section 15.
This policy applies to personal data processed through our website, app, and APIs. It does not cover third-party services you connect (e.g. Stripe, messaging channels, your own model keys), which are governed by their own policies.
Where the GDPR applies, we rely on: performance of a contract (to provide the service); legitimate interests (to secure, improve, and operate the platform, balanced against your rights); consent (for optional cookies and marketing, withdrawable at any time); and legal obligation (e.g. tax, accounting). For business data we process on your organisation’s instructions, your organisation is the controller and determines the legal basis.
AgenticOS uses large language models and tools (via providers such as OpenRouter and the underlying model providers, or your own key) to perform tasks. Content relevant to a task may be sent to these providers to generate a result. The assistant operates with governed autonomy: it performs read and draft steps automatically, and pauses for your approval before any send, payment, publish, or deploy action, and when over budget or scope. AI output can be inaccurate — you remain responsible for reviewing approval-gated actions before they take effect. We do not make solely automated decisions that produce legal or similarly significant effects about an individual without a human in the loop.
We share personal data only with service providers who process it on our behalf under contract, including:
We may also disclose data to comply with law, enforce our terms, or in a merger/acquisition (with notice). A current subprocessor list is available on request.
We are based in Hong Kong and our providers may process data in other jurisdictions, including the EU and the United States. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum). For Hong Kong data users, we take reasonable steps consistent with the PDPO when transferring data outside Hong Kong.
We keep personal data only as long as needed to provide the service, comply with legal, tax, and audit obligations, resolve disputes, and enforce agreements. Audit logs are retained for governance and security. When your organisation closes its account, we delete or anonymise personal data within a reasonable period, subject to legal retention requirements.
We use technical and organisational measures including encryption in transit, scoped access tokens, role-based access control, least-privilege agent permissions, spend caps, and append-only audit logging. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
Under the Personal Data (Privacy) Ordinance (Cap. 486) you may request access to and correction of your personal data, and ask about our data policies and practices. You may opt out of direct marketing at any time at no charge.
You have rights to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent. You may lodge a complaint with your local supervisory authority. Where we act as processor, please direct requests to your organisation, and we will assist it in responding.
California residents may request to know, delete, and correct personal information, and to opt out of “sale” or “sharing” of personal information and of targeted advertising. We do not sell your personal information. We will not discriminate against you for exercising these rights. Other US state laws may grant similar rights.
To exercise any right, contact us (section 15). We will verify your request and respond within the timeframes required by applicable law.
We use strictly necessary cookies for authentication and security, and limited analytics to operate the site. Where required, we request consent for non-essential cookies. You can control cookies through your browser settings.
The service is for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data, contact us and we will delete it.
We may update this policy from time to time. We will post the updated version here with a new “last updated” date and, where appropriate, notify you of material changes.
For privacy questions or to exercise your rights, contact privacy@agenticos.hk. (Placeholder — confirm your real privacy contact and, if applicable, your EU/UK representative and Data Protection Officer.)
See also our Terms of Use.