Effective date: August 13, 2026
Agencica ("we," "us," "our") operates a software platform for creative and social media agencies to manage clients, tasks, content, and billing (the "Service"). This Privacy Policy explains what personal data we collect, how we use and protect it, who we share it with, and the rights you have over it.
This policy applies to visitors of our website, and to users of the Service — including agency owners, team members, and the client contacts your agency invites to our client portal. If you're an agency using the Service, you act as the "data controller" for your own clients' data, and we act as your "data processor" — see Section 9 for what that means.
Account data — name, email address, job title, role, profile photo, and authentication credentials. Passwords are handled entirely by our authentication provider (Supabase Auth); we never see or store raw passwords.
Agency data — organization name, billing/payment details, bank details used for your own invoicing to clients, service pricing, business address, and contact information.
Client data — names, contact details, billing or retainer amounts, task briefs, captions and copy, uploaded creative files (images and video), approval history, and any notes your team adds about a client.
Payment data — we do not store full payment card numbers. Card payments are processed directly by Stripe, our payment processor, which is PCI-DSS compliant. We retain only limited billing metadata (such as subscription status and invoice history).
Usage & device data — login timestamps, IP address, browser and device type, and general usage patterns, collected for security, fraud prevention, and service reliability.
We use the data described above to: operate and maintain the Service; authenticate accounts and enforce access controls; process subscription payments; send essential service communications (invitations, task notifications, billing receipts, security alerts); provide customer support; detect and prevent fraud or abuse; and improve the Service using aggregated, de-identified usage patterns. We do not sell your data or your clients' data to third parties, and we do not use the content you upload to train AI or machine learning models.
Where data protection law requires a legal basis for processing (such as under GDPR for EU-based users), we rely on: performance of our contract with you (providing the Service you signed up for); our legitimate interests (security, fraud prevention, service improvement); your consent, where specifically requested (such as for optional marketing emails); and compliance with legal obligations.
Your organization's data — including your clients' data — is isolated from every other organization using the Service. This isolation is enforced at the database level using row-level security policies, not only in the application interface, so even in the event of an application-level bug, one organization's data cannot be queried through another organization's account. Agencica staff do not routinely access customer data. Access occurs only: (a) when you explicitly request support and grant access; (b) as strictly necessary to investigate a security incident, technical issue, or suspected violation of our Terms; or (c) where required by valid legal process.
Data is hosted on Supabase (PostgreSQL database and file storage) with underlying infrastructure on Amazon Web Services. Data is encrypted in transit using TLS and encrypted at rest.
We use only essential, first-party session cookies required to keep you logged in and to protect against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies. Because we don't use non-essential tracking, a cookie consent banner is not required under most regulations, though this may change if we introduce analytics tools in the future — we'll update this policy if so.
We share data with the following service providers, each engaged solely to help us operate the Service:
• Supabase — database, authentication, and file storage
• Vercel — application hosting and content delivery
• Stripe — subscription billing and payment processing
• Resend — transactional email delivery (invitations, notifications)
• Mux — video hosting and streaming, where applicable
We will update this list if our sub-processors change, and will notify active customers of any material change.
If your agency is a "data controller" under GDPR or a similar law for your own clients' personal data, you may request a Data Processing Agreement (DPA) from us by emailing support.agencica@gmail.com. The DPA sets out our obligations as your data processor.
If you or your clients are located outside the region where our infrastructure operates, your data may be transferred internationally. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect data transferred in this way.
We retain your data for as long as your account remains active. If you close your account, we will delete your organization's data within a reasonable period, unless we're required to retain certain records longer to comply with legal, tax, or accounting obligations. You may request earlier deletion at any time.
Subject to applicable law, you have the right to: access the personal data we hold about you; correct inaccurate or incomplete data; request deletion of your data ("right to be forgotten"); export your data in a portable format; object to or request restriction of certain processing; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at support.agencica@gmail.com. We'll respond within the timeframe required by applicable law.
The Service is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We'll notify active customers by email of any material change at least 14 days before it takes effect.
If you have questions about this Privacy Policy or how we handle your data, contact us at support.agencica@gmail.com.