Privacy Policy
Last updated: October 8, 2026
1. Overview
shield-agent (“we,” “our,” or “us”) is a Know Your Agent (KYA) governance platform for AI agents. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, console, and API.
2. Data We Collect
Account data: name, email address, company name, and billing information.
Agent activity data: tool-call events, session metadata, and policy verdicts sent by the AI agents and hosts you register, via the API keys and MCP connections you configure.
Usage data: IP address, browser type, pages viewed, and actions taken in the console.
3. How We Use Your Data
We use your data to provide agent-governance services - enforcing policy on agent tool calls, maintaining the hash-chained audit trail, and routing approval requests - plus transactional notifications, improving our AI models, and complying with legal obligations.
4. Data Security
We encrypt data in transit (TLS 1.3) and at rest (AES-256). Personal data in agent payloads is redacted before processing and is never sent to third-party language models.
5. Third-Party Services
We receive data from the AI-agent hosts and MCP connectors you configure, solely to enforce policy and maintain the audit trail. We do not sell your data to advertisers.
6. Your Rights
You may access, correct, export, or delete your account data at any time by contacting [email protected].
7. Open-source CLI usage statistics (opt-in)
The open-source kya command-line tool can send anonymous usage statistics,
but only if you say yes when it asks (the default answer is No) or run
kya telemetry on. It never asks or sends anything in CI or non-interactive
runs, and DO_NOT_TRACK=1 and KYA_TELEMETRY=0 switch it off.
What is sent: a random install ID (not derived from your machine or
account), a random per-session ID, whether a session started, is still running, or ended,
which KYA component is running (MCP gate, report, gateway, or hook), the KYA version, operating
system and CPU architecture, the Node.js major version, the name of the host integration,
the gate mode, and a yes/no for whether a hosted API key is configured.
What is never sent: file paths, repository or project names, host or user
names, environment variables, command arguments, tool names, prompts, code, audit-trail
contents, API keys, or email addresses. Run kya telemetry show to see the exact
payload. The hook component sends at most one such message per day, from a detached
background helper, so the hook itself never waits on the network.
IP address: we do not store your IP address with these statistics. As with any HTTPS request, your IP is visible to our network infrastructure in transit, and operational logs may record it as for any website; those logs do not contain your install ID.
Why and how long: to learn how many installs are active and which versions
and platforms to support. Never for advertising, and never sold. Session records are kept 90
days, install records are deleted after 180 days without activity, and hourly aggregate
counts (which contain no identifiers) are kept 400 days. The legal basis is your consent,
which you can withdraw at any time with kya telemetry off. To erase what we hold
for your install immediately, run kya telemetry off --purge or email
[email protected].
8. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or through the dashboard.