SaltsBack to site

Last updated 22 September 2026

Privacy Policy

This Privacy Policy explains how Salt Agents processes personal data in operating Salts. It is issued under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), and section 12 sets out the additional disclosures required of a business by the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code §1798.100-199).

1. Controller and contact details

We are responsible for the data described here. These are the addresses to use.

  1. 1.1The controller for the processing described in this Policy is Salt Agents, [REGISTERED ADDRESS — VERIFY] (Art. 13(1)(a) GDPR).
  2. 1.2Our data protection officer may be contacted at [DATA PROTECTION OFFICER — VERIFY, or not appointed] (Art. 13(1)(b) GDPR).
  3. 1.3Requests under this Policy, including data subject requests, should be sent to privacy@[DOMAIN].

2. Scope and your own controllership

This Policy covers the service we run. Where other people message your Agent, you are the controller and we act for you.

  1. 2.1This Policy applies to the hosted service we operate at [DOMAIN]. It does not apply to a deployment you host yourself, nor to any Connected Service, each of which publishes its own policy.
  2. 2.2Where you create an Agent that receives messages from individuals other than yourself, you determine the purposes and means of that processing. You are the controller of that content and we act as your processor under Article 28 GDPR, processing it only on your documented instructions. The obligation to inform those individuals under Articles 13 and 14 GDPR rests with you.

3. Categories of personal data processed

Your email, your Agent's settings and keys, everything sent to the Agent, and what each reply cost.

  1. 3.1We process the categories of personal data set out below. Personal data is obtained directly from you, except where the source column states otherwise (Art. 13 and Art. 14(2)(f) GDPR).
  2. 3.2Provision of account data and of the Credentials an Agent requires is a contractual requirement: without them we cannot create an Account or operate an Agent, and the Service cannot be provided (Art. 13(2)(e) GDPR).

Data categories, examples and source

Category

Account data

Data

Email address, authentication identifiers and session metadata; the access list and administrator of each Agent

Source

You; our authentication provider

Category

Agent configuration

Data

Agent name, selected model, system prompt, tuning parameters, enabled capabilities

Source

You

Category

Credentials

Data

OpenRouter API key, Telegram bot token and username, search API key, MCP server URLs and headers

Source

You

Category

Conversation content

Data

Messages, attachments (documents, images, audio), text extracted from attachments, and facts saved to memory where that capability is enabled

Source

You and anyone you permit to message the Agent

Category

Telegram data

Data

Chat, user and forum-topic identifiers, usernames, and the whitelists you configure

Source

Telegram, on receipt of a message

Category

Usage records

Data

Tokens consumed, cost in USD, latency and timestamp per reply

Source

Generated by the Service

Category

Technical data

Data

IP address, request metadata, error diagnostics and security logs

Source

Generated automatically on each request

5. Recipients and sub-processors

Cloudflare hosts it, Clerk signs you in, OpenRouter routes the model call, Telegram carries the chat.

  1. 5.1We disclose personal data to the categories of recipient listed below (Art. 13(1)(e) GDPR). Each processor acts under a written contract incorporating the terms required by Article 28(3) GDPR.
  2. 5.2You authorise these sub-processors generally under Article 28(2) GDPR. We will give notice within the Service or by email before adding or replacing a sub-processor, and you may object by writing to privacy@[DOMAIN] within 30 days; where an objection cannot be accommodated, you may terminate by deleting the affected Agent.
  3. 5.3Content sent to a Model Provider or a Connected Service is processed by that party under its own terms. Some Model Providers use inputs and outputs to improve their models; where that matters to you, select a provider whose terms exclude it. An MCP server you connect is a third party of your choosing, which we do not vet.
  4. 5.4We may also disclose personal data where required by law, court order or a binding request from a competent authority, and to a successor entity in connection with a merger, acquisition or sale of assets, in which case we will notify you.

Sub-processors and recipients

Recipient

Cloudflare, Inc.

Purpose

Hosting, storage, network and edge compute

Location [VERIFY]

United States; global edge

Recipient

Clerk, Inc.

Purpose

Authentication and session management

Location [VERIFY]

United States

Recipient

OpenRouter, Inc.

Purpose

Routing each model call to the Model Provider you selected, under your own API key

Location [VERIFY]

United States

Recipient

Model Providers

Purpose

Generating the Output for a call routed by OpenRouter; identity depends on the model you select

Location [VERIFY]

Varies by provider

Recipient

Telegram Messenger Inc.

Purpose

Delivering messages to and from a bot you connect

Location [VERIFY]

Varies; see Telegram's policy

Recipient

Brave Software, Inc., or a SearXNG instance you nominate

Purpose

Executing a web search where that capability is enabled

Location [VERIFY]

United States; or as you configure

Recipient

MCP servers you connect

Purpose

Executing tool calls you have configured; recipient and location determined by you

Location [VERIFY]

As you configure

6. Credentials

Keys are stored so the Agent can use them, never displayed back to you, and removable at any time.

  1. 6.1Credentials must be usable at the time of a call and are therefore stored in recoverable form rather than as a one-way hash. They are held with the configuration of the Agent they belong to, are never returned in full to a browser — the settings interface displays a mask — and are removed from storage when the field is cleared or the Agent is deleted.
  2. 6.2Removal from our storage does not revoke a Credential at its issuer. We recommend scoping each Credential narrowly, setting a spending limit on your OpenRouter account, and rotating any Credential you believe may be compromised.

7. International transfers

Data leaves your country, because our providers and the model providers are global.

  1. 7.1Personal data is transferred to, and processed in, countries outside the European Economic Area and the United Kingdom, including the United States (Art. 13(1)(f) GDPR).
  2. 7.2Where a transfer is made to a country not covered by an adequacy decision of the European Commission under Article 45 GDPR, we rely on the standard contractual clauses adopted by the Commission under Article 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures. A copy of the safeguards applying to a given recipient is available on request to privacy@[DOMAIN].
  3. 7.3A transfer to a Connected Service you configure, including an MCP server, is made on your instruction and under the transfer mechanism, if any, of that provider.

8. Retention

We keep things until you delete them; deleting an Agent deletes its contents.

  1. 8.1Personal data is retained in accordance with the schedule below and thereafter deleted or irreversibly anonymised (Art. 5(1)(e) and Art. 13(2)(a) GDPR).
  2. 8.2Deleting a session deletes its messages, attachments and usage records. Deleting an Agent deletes its configuration, Credentials, sessions and memories. Deleting your Account deletes the Agents you administer.
  3. 8.3Following deletion, residual copies may persist in encrypted backups and in provider logs until overwritten in the ordinary cycle, which is up to 30 days [VERIFY against provider commitments]. Data we are required to retain for a legal purpose is retained for the period of that requirement and processed for no other purpose.

Retention schedule

Category

Account data

Retention period

Life of the Account

Trigger

Account deletion

Category

Agent configuration and Credentials

Retention period

Life of the Agent, or until the field is cleared

Trigger

Agent deletion

Category

Conversation content and attachments

Retention period

Until the session or Agent is deleted; no automatic expiry

Trigger

Session or Agent deletion

Category

Memories

Retention period

Until deleted by you or the Agent is deleted

Trigger

Agent deletion

Category

Usage records

Retention period

Life of the session

Trigger

Session deletion

Category

Technical and security logs

Retention period

[VERIFY — provider default, typically 30 days]

Trigger

Elapse of the retention window

Category

Backups

Retention period

Up to 30 days after deletion

Trigger

Backup rotation

9. Security

Encryption in transit, per-Agent isolation, and access checked on every request.

  1. 9.1We implement technical and organisational measures appropriate to the risk, as required by Article 32 GDPR, including encryption of personal data in transit, isolation of each Agent's storage, authentication of every request against a cryptographically signed session token, and authorisation against the Agent's access list, which is held separately from the configuration it governs.
  2. 9.2No system is perfectly secure. Where a personal data breach occurs, we will notify the competent supervisory authority in accordance with Article 33 GDPR and affected individuals in accordance with Article 34 GDPR where the thresholds are met.

10. Your rights

Access, rectification, erasure, restriction, portability, objection. Email us; we answer within 30 days.

  1. 10.1Subject to the conditions in the GDPR, you have the right to request access to your personal data (Art. 15), its rectification (Art. 16), its erasure (Art. 17), restriction of processing (Art. 18) and portability of data you provided to us (Art. 20), and to object to processing based on Article 6(1)(f) (Art. 21). We extend these rights to all users as a matter of policy, wherever they reside.
  2. 10.2Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 13(2)(c) GDPR).
  3. 10.3Many of these rights are exercisable directly: settings display and amend your configuration, sessions may be exported and deleted, and deleting an Agent erases its contents. For anything else, write to privacy@[DOMAIN]. We respond within one month of receipt and may extend that period by two further months where the request is complex, notifying you of the extension and its reasons (Art. 12(3) GDPR).
  4. 10.4You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 13(2)(d) and Art. 77 GDPR). Our lead supervisory authority is [LEAD SUPERVISORY AUTHORITY — VERIFY].
  5. 10.5We do not carry out automated decision-making producing legal or similarly significant effects, or profiling, within the meaning of Article 22 GDPR. An Output is generated automatically but produces no decision of that character; what you do with it is your own decision (Art. 13(2)(f) GDPR).
  6. 10.6We do not process personal data for any purpose other than those stated in section 4. Should we intend to do so, we will inform you beforehand and provide the information required by Article 13(3) GDPR.

11. Cookies and local storage

Only what is needed to sign you in and remember your interface settings.

  1. 11.1We use strictly necessary cookies and equivalent browser storage. We do not set advertising cookies, do not operate cross-site tracking, and do not run third-party analytics that profile you. No consent banner is required for strictly necessary storage under Article 5(3) of Directive 2002/58/EC.

Cookies and equivalent storage

Type

Authentication

Purpose

Maintains your signed-in session

Duration

Session, and as set by our authentication provider

Type

Security

Purpose

CSRF protection and abuse prevention

Duration

Session

Type

Preferences

Purpose

Remembers interface settings such as the last Agent opened

Duration

Local storage, until cleared

12. California residents

We collect the categories below, sell nothing, share nothing for advertising, and will not penalise you for asking.

  1. 12.1This section applies to California residents and supplements the rest of this Policy. Terms used have the meanings given in Cal. Civ. Code §1798.140.
  2. 12.2In the twelve months preceding the date of this Policy we collected the categories of personal information set out below, for the business purposes described in section 4, from the sources described in section 3, and disclosed them for a business purpose to the recipients listed in section 5.
  3. 12.3We do not sell personal information (§1798.140(ad)) and do not share it for cross-context behavioural advertising (§1798.140(ah)). We have not done so in the preceding twelve months, including in respect of consumers under 16 years of age. No "Do Not Sell or Share My Personal Information" link is therefore required.
  4. 12.4We collect the contents of your communications with an Agent, which constitutes sensitive personal information under §1798.140(ae)(1)(D). We use it solely to provide the Service you requested, which is a permitted purpose under §1798.121(a), and we do not use or disclose it to infer characteristics about you.
  5. 12.5You have the right to know (§§1798.100, 1798.110, 1798.115), to delete (§1798.105), to correct (§1798.106), to limit the use of sensitive personal information (§1798.121), to opt out of sale or sharing (§1798.120) and to non-discrimination for exercising any of them (§1798.125). Submit a request to privacy@[DOMAIN]; we confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 days where reasonably necessary.
  6. 12.6An authorised agent may submit a request on your behalf with written permission signed by you, and we may require you to verify your identity directly. We verify requests by reference to control of the email address on the Account.

Categories collected in the preceding 12 months (§1798.140(v))

Statutory category

Identifiers

Collected

Yes

Examples

Email address, account identifier, IP address

Statutory category

Commercial information

Collected

No

Examples

—

Statutory category

Biometric information

Collected

No

Examples

—

Statutory category

Internet or other electronic network activity

Collected

Yes

Examples

Request metadata, feature usage, error logs

Statutory category

Geolocation data

Collected

No

Examples

Precise geolocation is not collected; IP address may imply coarse region

Statutory category

Audio, electronic, visual or similar information

Collected

Yes

Examples

Voice notes and images you attach to a message

Statutory category

Professional or employment information

Collected

No

Examples

Only where you choose to put it in a message

Statutory category

Education information

Collected

No

Examples

—

Statutory category

Inferences

Collected

No

Examples

We draw no profile from your data

Statutory category

Sensitive personal information

Collected

Yes

Examples

Contents of your communications with an Agent (§1798.140(ae)(1)(D)); account credentials held by our authentication provider

13. Children

The Service is not for anyone under 16.

  1. 13.1The Service is not directed at children and may not be used by anyone under 16 years of age [VERIFY against the age set under Art. 8(1) GDPR in your Member State, which may be as low as 13]. We do not knowingly collect personal data from children under that age.
  2. 13.2Where you operate an Agent in a conversation that may include children, you are responsible as controller for any consent required. If you believe a child's personal data has reached us, write to privacy@[DOMAIN] and we will delete it without undue delay.

14. Self-hosted deployments

Host it yourself and this Policy does not apply — you become the controller.

  1. 14.1Salts may be deployed on infrastructure you control. In that case personal data does not reach our systems, we are neither controller nor processor in respect of it, and this Policy does not apply. The providers listed in section 5 continue to process data under the accounts you configure, and you are the controller in respect of that processing.

15. Changes to this Policy

We date each version and tell you when a change is material.

  1. 15.1We may amend this Policy. The "Last updated" date identifies the current version. Where an amendment materially affects the processing of your personal data, we will notify you within the Service or by email before it takes effect.

16. Contact and complaints

Where to write, and who to complain to if we get it wrong.

  1. 16.1Salt Agents, [REGISTERED ADDRESS — VERIFY]. Data protection officer: [DATA PROTECTION OFFICER — VERIFY, or not appointed].
  2. 16.2Privacy and data subject requests: privacy@[DOMAIN]. Other enquiries: support@[DOMAIN].
  3. 16.3You may lodge a complaint with [LEAD SUPERVISORY AUTHORITY — VERIFY] or with the supervisory authority of your habitual residence. We would ask that you raise the matter with us first.