Privacy Policy

1. Who is responsible

The controller under the GDPR for this website and the agentfenster app is:

Ilse Grabner
St. Martin 20
9212 Techelsberg am Wörther See
Austria
[email protected]

We are not required to appoint a data protection officer. Write to the address above for anything about your data.

2. The short version

• This website uses no cookies, no analytics and no tracking pixels.
• The app runs on your PC. Your screens, files, credentials and the text the agent reads stay there. The app has no account.
• The app contacts our server in exactly three cases: a session report you can switch off, the licence check, and the update check. Each is listed below with every field.
• The AI model you connect is your contract with its provider, not ours.

3. Visiting this website

This site is a static website served by Cloudflare, Inc. (as our processor). To deliver a page and to protect it against attacks, Cloudflare necessarily processes your IP address, the requested address, time and browser type. We do not receive logs with this data and do not combine it with anything else. Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare may process data in the USA; the transfer is covered by the EU-US Data Privacy Framework and standard contractual clauses.

If you press play on the demo video, the player loads from youtube-nocookie.com, and Google receives your IP address. Nothing is loaded from YouTube before you press play.

4. Waitlist

If you join the waitlist on /buy, we store exactly four things: your email address, whether you prefer monthly or yearly billing (or “not sure”), the time you signed up, and which version of the consent sentence you agreed to. No IP address, no browser details, no cookie.

• Purpose: one email when agentfenster can be downloaded and bought. No newsletter, never passed on or sold.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to us.
• Where: Cloudflare Workers KV, the same processor that serves this website.
• How long: until the launch email is sent, then the list is deleted; at the latest 12 months after you signed up, and earlier whenever you ask.

5. In the app: session report

After each run and each MCP session the app can send a small report to our server so we find bugs. It contains metadata only:

• app version, Windows version, display scaling and interface language;
• a device id: a one-way hash of your Windows machine id and user name, which cannot be turned back into either;
• your licence tier (trial, free, paid);
• run counters: which mode and model ran, number of steps, duration, tokens used, success or failure, and the kinds of errors that occurred.

It never contains screenshots, window titles, element trees, text from your screen, tool answers, clipboard or file contents, typed text, or anything from the credential vault.

• Switch: on by default, shown during setup, and one click to turn off in Settings → Reporting. Turning it off stops the next report before it is built.
• When it leaves the PC: only from an installation with an activated key. Without a key, reports are kept locally (at most 50 files, at most 7 days) and never sent.
• Legal basis: our legitimate interest in finding and fixing faults (Art. 6(1)(f) GDPR). The switch is your right to object, and it takes effect immediately.
• Transport and storage: encrypted (TLS) to our own server, rented from Hetzner Online GmbH, Germany, as hosting processor; the app checks the server’s pinned certificate. Reports are deleted after 90 days.

6. In the app: licence check

When you enter a licence key, the app sends the key and the hashed device id (see above) to our server once to activate it, and about once a month after that to confirm it. This lets one key cover up to three PCs and lets you free a PC again. Without a key the app never contacts the licence server. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Activation records are kept while your subscription runs and for 12 months after it ends.

7. In the app: update check

The app asks our server for a signed update manifest for its channel (Stable or Alpha). The request carries no device id and no licence key; like any connection it reveals your IP address, which the server uses for rate limiting. Legal basis: legitimate interest in delivering security fixes (Art. 6(1)(f) GDPR).

8. Your AI model

The app sends the agent’s prompts, element trees and, where needed, window pictures to the model endpoint you configure: Claude Code, Codex, a hosted API or a local model. That traffic goes directly from your PC to that provider under your own account and its privacy terms; we never see it. With a local model, nothing leaves your PC.

9. Buying a licence

The checkout is run by Polar as merchant of record. Polar collects your payment and billing details as an independent controller under its own privacy policy; we never see card details. We receive your email address, country, order number and plan, to send and manage your licence key. Legal basis: performance of the contract and legal retention duties (Art. 6(1)(b) and (c) GDPR). Order records are kept for seven years, as Austrian tax law requires.

10. Emails to us

If you write to [email protected], we use your message only to answer it and delete it when the matter is closed, unless tax law requires us to keep it.

11. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time. Write to [email protected]; we answer within one month. For an activation, include the email address your key was sent to so we can find it.

You can also complain to a supervisory authority, in Austria the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

12. Changes

If what the app sends changes, this page changes first, and the app shows the change before it sends anything new. Controller: Ilse Grabner.