Privacy Policy
Last updated: November 2, 2026
This policy explains what Agent Verify (run by AI Blockchain Ventures LLC, "we") collects, why, and the choices you have. The short version: we don't store the raw code you scan, we don't sell data, and analytics only run if you accept them.
What we collect and why
| What | Details | Why |
|---|---|---|
| Account | Email, name (from Google sign-in), and a password stored hashed by Firebase. We never see your password. | Sign-in and account emails. |
| "About you" (optional) | Name, company, role, team size, frameworks you use, and how you heard about us. You can skip it. | Understanding who uses Agent Verify, and support. |
| Scan results | Verdict, score, findings, short evidence snippets (with secrets redacted), file name and platform. We do not store the raw code you submit. | Your reports, history and share links. |
| Free public scan (no account) | The code you paste is scanned and not stored. Results for identical code may be cached for up to 6 hours so repeat scans are instant. Your network address is used briefly to enforce limits. | Running the demo and preventing abuse. |
| Fix & re-check (Pro) | The code you check or ask AI to fix is sent to our server and, for AI fixes, to Cloudflare Workers AI. It is not stored. We keep a daily count of AI fixes per account. | Re-scoring your changes and writing AI fixes, and enforcing daily limits. |
| "Ask" questions | Your question is sent to Cloudflare Workers AI to write an answer and is not stored. We keep a daily count per account, or per hashed network address. | Answering, and enforcing daily limits. |
| Repository connections | GitHub installation ID, repository names, scores and pull-request numbers. GitLab and Bitbucket access tokens are encrypted. | Pull-request checks and monitoring. |
| Slack | Your Slack workspace ID. | The /agentverify command. |
| Alerts | An email address or Slack webhook address you choose. | Sending alerts. |
| Agent Guard | Tool name, decision, and a short preview of arguments with secrets masked. Deleted after 30 days. | The Agent Guard dashboard. |
| Prompt-injection tests | Target address, request headers (encrypted), and short reply excerpts with secrets masked. | Showing which attacks worked on your own agent. |
| Billing | Plan, Stripe customer ID and seats. Card details are handled by Stripe; we never see them. | Billing. |
| Referrals | Who invited whom. | Giving referral rewards. |
| Weekly email | Your preference (off unless you turn it on). | Sending the Monday summary. |
| Getting-started emails | Up to three short tips emails in your first week (for example, how to connect a repo), only after you verify your email. Every one has a one-click "stop these tips" link. | Helping new accounts get set up. |
| Feedback you send | Your message, the type (bug, idea, other), the page you were on, and your account email so we can reply. | Fixing problems and improving the product. |
| Error reports | If a page or our API crashes: the error message, technical details (a stack trace), the page path (never the rest of the address), and your browser type. No page content or anything you typed. Deleted after 90 days. | Finding and fixing bugs quickly. |
| Analytics | Usage data from Google Analytics for Firebase — only if you click Accept on the cookie banner. | Understanding how the product is used, in aggregate. |
Who processes data for us
We use these service providers only to run Agent Verify:
- Google Firebase — sign-in, report storage, and analytics if you accept it
- Cloudflare — our API, database, and Workers AI for "Ask"
- Stripe — payments
- GitHub, GitLab, Bitbucket and Slack — only when you connect them
- Resend — email, only when alerts or the weekly email are on
We do not sell your data and do not use it for advertising.
Who at Agent Verify can see it
A small number of staff can see account details (email, plan, signup answers and scan counts) in an internal admin panel, to run billing and support. Access requires a verified staff email.
How long we keep it
- Reports and account data: until you delete them or close your account.
- Agent Guard events: 30 days.
- Error reports: 90 days after the error was last seen.
- Free-scan results for identical code: up to 6 hours in cache.
- You can delete reports, repository connections and injection-test targets yourself in the dashboard.
- To close your account and delete its data, email hello@aiblockchainventures.com. We do this within 30 days, except billing records we must keep by law.
Your rights
Depending on where you live (for example the EU, UK or California), you can ask to access, correct, export or delete your data, and object to some uses. Email hello@aiblockchainventures.com and we will respond within 30 days.
Cookies and browser storage
We use your browser's storage for sign-in, your theme and cookie choice, and to remember your free demo scan. Analytics cookies are only set if you accept them, and the product works the same if you decline.
Security
Everything is sent over HTTPS. Stored access tokens and injection-test headers are encrypted, and secrets found in scanned code are redacted before results are saved. More in our Trust Center.
Children
Agent Verify is not intended for anyone under 16.
Changes to this policy
If we make important changes, we will update this page and let signed-in users know.
Contact
AI Blockchain Ventures LLC, Sarasota, Florida, USA — hello@aiblockchainventures.com