Privacy policy.

01Who this covers

Portal is software and services for businesses. This policy covers the businesses we work with, the people who work there, visitors to this website, people who send us an inquiry, and (when we act for a client) that client's own customers. Portal is run by Portal Agentic Cloud LLC, based in Montana, United States. The LLC is responsible for the information this policy describes.

02What we store

Client data lives on a server we control, in files that belong to your business alone. Nothing is pooled with another business's data.

• What you tell us about your business: how you sound, what you sell, who buys it, what you're aiming at, and what you've decided against. You can read and edit it in your Portal.
• Your requests and their results: the request, which agents worked on it and why, every draft, and whether it was approved, changed or skipped. This record is how Portal learns what you like.
• An activity log: a line for each thing that happened, so the record can be audited. It is append-only: entries are never edited.
• People at your business: a sign-in name, a display name, an email, an optional phone number, a role, and a password stored as a one-way scrypt hash. We never store a readable password.
• Billing details: invoices, what you agreed to pay, and a reference to your saved payment method. Card numbers are held by Stripe; Portal never sees or stores them.
• Messages you send us from your account or Settings, with your sign-in name attached.
• Connected account details: see section 6.

If you send an inquiry through this website, we keep what you typed, your email, any phone number you entered, and the browser you used. We send one confirmation email and alert our team so we can review it. We do not store the IP address of anyone who fills in that form.

03Your customers' data

When we run something that talks to your customers (Magnus on your site, automations, or your customer app), we process their information on your behalf and on your instructions. Your business decides why it is collected; we act as your processor.

• Magnus: the questions visitors ask, the answers given, and any contact details a visitor chooses to leave, so your team can follow up. Magnus tells visitors it is an AI assistant.
• Automations: the names, contact details and message history needed to send the replies, reminders and requests you set up.
• Customer app: each customer's account, bookings, purchases, rewards and messages. Each customer sees only their own information and can ask your business to export or delete it.

We never sell your customers' data or use it for anyone else. If you need a data processing agreement, ask and we will sign one with you.

04This website

This website has no advertising trackers. It asks before sending anonymous, first-party measurement. If you allow it, Portal records only named actions (such as arriving, viewing prices or starting an inquiry), a temporary random session reference, a broad source category, and a campaign label when one is present. It does not record form answers, contact details, a full web address or an IP address in this measurement.

If you choose “No thanks”, those optional events are not sent. Sending an inquiry still creates an operational record tied to the inquiry, because receiving it is the service you asked for. The website stores your choice in your browser so it doesn't ask again.

05AI providers

Portal's agents run on AI models from providers we choose for each task, such as Anthropic (Claude) and OpenAI, sometimes routed through OpenRouter, or on a provider key you bring. When you ask Portal for something, the context needed to do it (what you've told us about your business, your goals and recent requests) is sent to that provider so the work can be drafted.

• Nothing you give Portal is used to train an AI model, ours or anyone else's. Portal has no model of its own. We use providers whose business terms forbid training on customer data.
• Through OpenRouter, we request zero data retention and turn off data collection, so prompts are only routed to providers that agree to both.
• Every send has one purpose: producing the specific thing you asked for. We don't send your data anywhere to build a product, improve a model or study how businesses behave.
• We control what we send, not how long a provider keeps it. Anthropic's business terms, for example, delete API inputs and outputs within 30 days. Each provider's own policy applies.
• Two things are never sent: your rules (spending limits, caps and what needs approval) and your own contact details. No draft needs them.

06Connected accounts

You can connect outside accounts, such as Google, Meta (Instagram and Facebook), Shopify or your calendar, so your agents work from what is really happening. When you connect one, we receive and keep:

• an access token and the list of permissions you granted, encrypted on disk and kept out of anything sent to an AI provider;
• the account's username and id, so we know whose account it is;
• the data those permissions allow, used only for the features you turn on. For Instagram, for example: follower counts and the reach, likes, comments and saves on posts you've published.

We never receive your password to that service. Connected accounts are read-only unless you turn on a feature that acts in them, and customer-facing AI drafts wait for a person's approval or a standing rule you set.

Meta. Data from a connected Meta account is used only to provide the features you use, under Meta's Platform Terms. To have it deleted, follow how to delete your data or email us.

You can disconnect at any time from your Portal or from that service's own settings. Disconnecting stops us reading anything new and deletes the token and everything we pulled from it.

07Email and texts

We use Resend to deliver email, including inquiry confirmations, team alerts and support notices. Resend receives the address and message needed to deliver it. Once sent, an email sits in a mailbox and in Resend's logs, and we can't recall it. Our inquiry confirmation includes a link to stop later automated follow-up emails.

If you check the optional text box on our inquiry form, Portal may send one text confirming that inquiry. Replying 1 opts you in to up to 4 follow-up texts per month about it. Reply STOP to stop or HELP for help. Message and data rates may apply. We use Twilio to send and receive texts; Twilio receives the mobile number and message needed to deliver them.

08Who else handles data

These companies process data for us, only to provide our services:

We don't sell data or share it with advertisers. We may disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of the business, in which case this policy still applies to it.

09How long we keep it

10Deleting your data

Email solomon@portalagentic.cloud from an address we can recognise, or send a message from your account, and ask for your data to be deleted.

• We do it within 7 days, across the live system: your business context, requests and drafts, the activity log, your people and sign-ins, connected-account tokens, your customers' data and your messages.
• Backups are the honest caveat: they can hold your data until they roll off, as above. We don't edit them, because that would put every other client's recovery at risk.
• We can't recall what has already gone to an AI provider or to an email inbox.

Step by step: how to delete your data.

11Your rights

You can ask what we hold about you, get a copy, correct it, or have it deleted. Much of it you can read and edit yourself inside Portal. For anything else, email us and we answer within 7 days. Depending on where you live (for example California, Connecticut, Montana or the EU), you may have further rights under local law, and we honour them. We do not sell personal information or share it for cross-context advertising.

If you are one of our client's customers, contact that business first. We help them answer your request.

12Security

• Traffic is encrypted in transit (HTTPS).
• Passwords are stored as scrypt hashes, never in readable form.
• Sign-in sessions use signed cookies, and a person's role is checked on every request, so removing someone takes effect immediately.
• Your rules (spending limits, send caps and what needs approval) can only be changed by a person through a confirmed step. No agent can change them.
• Each business's data is stored separately, and every read is scoped to the business you signed into.
• Backups are taken nightly and copied off the server to a separate machine.

If a security incident affects your data, we tell you without unreasonable delay, along with anyone the law requires us to notify.

13Children

Portal is for businesses and is not directed at children. We don't knowingly collect information from anyone under 13. If you think we have, email us and we will delete it.

14Changes

If this policy changes in a way that matters, we tell clients directly at least 30 days before it takes effect, rather than quietly editing it. The date at the top is always the last change. Questions: solomon@portalagentic.cloud.