Effective Date: 2026-10-13
Operator: HeyMall, Inc., a Delaware corporation (operating AgentGold), [email protected]
Contact: [email protected]
This Privacy Policy describes how AgentGold (agentgold.us) collects, uses, stores, and shares information about you when you use the Platform.
1. Who We Are
AgentGold is a marketplace for PII-scrubbed AI-agent session logs, operated by HeyMall, Inc., a Delaware corporation (operating AgentGold). For the purposes of GDPR, HeyMall, Inc., a Delaware corporation (operating AgentGold) is the data controller for personal data it collects directly from users. Trace contents are Seller-provided data, not personal data collected by AgentGold about the Seller.
2. Information We Collect
Account information. When you register, we collect your email address and a hashed password. We do not store plaintext passwords.
Payout details (Sellers). If you are a Seller requesting a payout, we collect the payment details you provide (PayPal address, bank account details, or blockchain wallet address).
Tax documents. We may collect a completed IRS Form W-9 or W-8 series form for tax-withholding compliance.
Wallet and transaction ledger. We maintain records of your wallet balance, top-ups, purchases, sales, and payout requests.
Access logs. We collect IP addresses, timestamps, HTTP method and path, user agent strings, and referrer information in standard server access logs for security and abuse-prevention purposes.
Session cookies. We use a session cookie to keep you logged in. This cookie is deleted when you close your browser. We do not use persistent advertising cookies.
Analytics. We may use a privacy-respecting analytics tool to understand aggregate Platform usage (page views, feature use). Analytics data is not linked to your identity for marketing purposes.
Support communications. If you contact us by email or through the Platform, we keep your message and our replies.
Real-name seller profiles. Seller accounts are real-name. Your LinkedIn name and photo, and any headline, background, LinkedIn link and highlights you add, are shown to buyers on your seller profile and next to your listings. Trace contents are still scrubbed of personal information before upload.
ID check (Gold sellers only). If you choose to apply for Gold, you authorize an identity check run by Stripe Identity: you upload a government ID and a selfie to Stripe. Stripe stores the images under its own privacy policy; AgentGold receives only whether the check passed and the name on the ID, which we compare with your LinkedIn name. We never see or store your document images or ID number. You can delete your ID check at any time from your profile: we ask Stripe to redact the verification, clear our copy, and remove your Gold status.
If you sign in with LinkedIn. We receive your LinkedIn member ID, name, email address and profile photo through LinkedIn's OpenID Connect sign-in. We use them to create and verify your account and, for sellers, to show your real name and photo on your seller profile and listings (see "Real-name seller profiles" above). We never post to LinkedIn. Sign-in with LinkedIn is required for every account.
Waitlist. If you leave your email on the sign-up page before sign-up opens, we use it only to tell you once that sign-up is open, and we delete it on request (write to [email protected]).
3. Trace Contents
Traces are Seller-provided content that Sellers upload after running the AgentGold Scrubber. We store Trace contents in encrypted form and treat them as confidential. We do not access Trace contents except:
- For automated processing: indexing, label extraction, format validation, and integrity checks.
- For trust-and-safety review: when a complaint or takedown request is filed, we may have a named reviewer inspect the flagged Trace to evaluate the complaint.
We do not use raw Trace contents to train our own models, share them with any party other than the purchasing Buyer, or use them for any purpose not described above.
4. How We Use Your Information
We use the information we collect to:
- Operate your account, authenticate you, and provide the Platform.
- Process payments, maintain your wallet and transaction ledger, and pay out earned balances.
- Detect, investigate, and prevent fraud, abuse, and violations of our Terms.
- Comply with legal obligations, including tax-reporting and law-enforcement requests.
- Send transactional communications: purchase confirmations, payout notifications, takedown notices, and security alerts.
- Improve the Platform using aggregated, non-identifying usage data.
We do not sell your personal information to third parties.
5. Third-Party Service Providers
We share data with the following providers only as necessary to operate the Platform. Each is bound by contract to use your data solely for the services they provide to us.
Stripe. Payment processing. When you add funds by card, your card data is handled directly by Stripe under Stripe's Privacy Policy. We store a Stripe customer ID and wallet balance but do not store card numbers.
AWS SES and Resend. Transactional email delivery; AWS SES is the primary provider and Resend may be used as a fallback. We share your email address and the content of transactional messages (confirmations, notices) with Resend to deliver those messages.
Cloudflare. Network infrastructure, DDoS protection, and CDN. Cloudflare processes IP addresses and HTTP metadata as part of routing and security. Cloudflare's data-processing practices are governed by its Data Processing Addendum.
We do not use advertising networks, data brokers, or social-media tracking pixels.
6. Data Retention
We keep account data for as long as your account is active and for up to two years after account deletion to meet legal and financial record-keeping obligations. Tax documents are retained for seven years. Access logs are retained for 90 days. Traces remain on the Platform until a Seller withdraws them or a takedown removes them; already-purchased Traces remain with Buyers under their license until deleted.
You may request earlier deletion of your personal data by emailing [email protected]. We will process deletion requests within 30 days, subject to legal holds.
7. Security
We use encryption in transit (TLS) and at rest for Traces and sensitive account data. Access to Trace contents is limited to automated systems and, during investigations, named personnel. We follow industry-standard security practices but cannot guarantee absolute security. Notify us promptly at [email protected] if you discover or suspect a security incident.
8. International Data Transfers
The Platform operates from the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States. For transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on [Standard Contractual Clauses / adequacy decisions / consent — select as applicable] as the legal basis for transfer.
9. Your Rights
California residents (CCPA/CPRA). You have the right to: know what personal information we hold about you; request deletion, subject to legal exceptions; correct inaccurate personal information; and opt out of the sale or sharing of personal information (we do not sell or share personal information). To exercise these rights, email [email protected].
EU and UK residents (GDPR/UK GDPR). You have the right to: access your personal data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent at any time where processing is consent-based. You may also lodge a complaint with your national data-protection supervisory authority. To exercise your rights, email [email protected].
We respond to all rights requests within 30 days.
10. Children
The Platform is not directed at anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has registered an account, contact us at [email protected] and we will remove the account.
11. Changes to This Policy
We will post material changes to this policy on the Platform and email registered users at least 14 days before the changes take effect. The updated effective date will be noted at the top of the policy.
12. Contact
HeyMall, Inc., a Delaware corporation (operating AgentGold)