Privacy Policy

Agent Serve is a product of Valnora & Elric Private Limited. In these documents, "Valnora & Elric", "we", "us" and "our" mean Valnora & Elric Private Limited.

Which entity you deal with: if you are a customer, your contract is with the Valnora & Elric entity named in your order form or agreement. If no entity is named, it is Valnora & Elric Private Limited. For visitors to our website and people who contact us or request access, Valnora & Elric Private Limited is responsible for your personal data unless we tell you otherwise.

This policy covers www.valnoraelric.com, agentserve.valnoraelric.com, the Agent Serve desktop and web apps we operate, and our sales and support communications. It does not cover a copy of Agent Serve that a customer hosts in its own cloud; that customer decides how its data is handled.

Valnora & Elric Private Limited is the controller (the party that decides why and how data is used) for personal data about website visitors, people who request access or contact us, and the account and billing details we need to run customer relationships.

When Elric Works engineers work in a client’s systems or with its data during an engagement, our role and what we may access are set in the signed agreement for that engagement. We use that data only for the engagement.

For content a customer organization puts into Agent Serve, such as workflows, chats, files, tables, knowledge bases, transcripts and call recordings it uploads, and the inputs and outputs of AI models, we act as a processor. We handle that data only to provide the service, under the customer’s agreement and instructions. If you use Agent Serve through your employer or another organization, that organization is your first point of contact for privacy requests about that content.

Information you give us

• Request-access form: your name, work email, company, role, what you want to build and the products you are interested in.
• Contact and help forms: your name, email, company, topic, message and any screenshots you attach.
• Account details: name, email address, profile picture, organization and role, and either a password (stored only as a hash) or the identity your single sign-on provider shares with us.
• Emails and calls with our team, including support and sales conversations.

Content in Agent Serve

Everything your organization creates or uploads: workflows, Relays, chats, files, tables, knowledge bases, dashboards, transcripts and call data, connected-integration data, and the prompts sent to and responses received from AI models. This content can include personal data about you or other people.

Information collected automatically

• Sign-in sessions: session identifiers, IP address and browser details.
• Run logs and traces: the inputs, outputs and errors of each workflow and agent run.
• Audit logs: who did what in a workspace or organization, and when.
• Usage and billing data: features used, model usage and credits, and plan or contract details.
• Server and security logs: IP address, request details, errors and timestamps.
• Cookies and similar storage: see the Cookie Policy.

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the legal bases below. Where India’s Digital Personal Data Protection Act, 2023 applies, we process personal data for the purposes you give it to us for, for legitimate uses the law allows, or with your consent.

We do not sell personal data. We do not use your data to train AI models, and we do not use workspace content for advertising.

When an agent, workflow or Chat uses an AI model, the prompt and the context it needs are sent to that model’s provider, and the response comes back to Agent Serve. A customer can use Agent Serve’s own provider accounts, its own provider keys, or models it hosts itself.

Agent Serve works with providers that offer zero data retention. Zero data retention depends on the customer’s own provider keys and agreements, self-hosted models, retention settings and PII redaction. Some provider features keep data on the provider’s side by design. For example, Gemini Deep Research requires stored interactions, so it falls outside zero data retention.

We do not use your data to train AI models. To keep prompts and outputs out of a provider’s systems, use zero data retention with a supported provider, your own provider keys and agreements, or a self-hosted model.

We offer a Data Processing Agreement (DPA) for customers that need one. It covers how we process personal data in Agent Serve on your behalf. Email systems@valnoraelric.com to request it.

• Service providers that run parts of Agent Serve for us, listed on our Subprocessors page. They may use the data only to provide their service to us.
• Integrations and model providers your organization connects with its own accounts. Your organization chooses these, and their own terms apply.
• Other members of your organization, in line with the roles and permissions your administrators set.
• Professional advisers, auditors and authorities, where the law requires it or to protect rights, safety and security.
• A buyer or successor if our business is reorganized, merged or sold, under the same protections described here.

Our cloud deployment of Agent Serve stores data on Amazon Web Services in Frankfurt, Germany (eu-central-1). Valnora & Elric is based in India, and some of our providers, including AI model providers, process data in other countries such as the United States. When we transfer personal data across borders, we use the safeguards the applicable law requires. Customers that need data to stay inside their own network can host Agent Serve in their own cloud.

• Account data: while the account exists. You can delete your own account from your settings; organization administrators can remove members.
• Workspace content: until the customer deletes it or the agreement ends. Administrators can set how long run logs, deleted items and task data are kept, from one day to five years.
• Sign-in sessions: up to 30 days.
• Server logs: 14 days. Database backups: 7 days.
• Request-access, contact and help messages: as long as needed to handle the request and any relationship that follows.
• Your cookie choice, where we ask for one: 12 months.
• Records we must keep by law, such as invoices: for the period the law requires.

Agent Serve includes single sign-on with SAML and OIDC, SCIM provisioning, roles and permission groups, row-level security, audit logs, approvals before external actions, PII redaction and invite-only access. Stored secrets and credentials are encrypted with AES-256-GCM, the database and file storage are encrypted at rest, and traffic is encrypted in transit with TLS. Read more on our Security page. No system is perfectly secure; report a vulnerability to systems@valnoraelric.com.

Depending on where you live, including under the GDPR, the UK GDPR and India’s Digital Personal Data Protection Act, 2023, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• receive your data in a portable format;
• object to or restrict some processing, including processing based on legitimate interests;
• withdraw consent at any time, without affecting earlier processing;
• name someone to exercise your rights on your behalf, where the law allows it;
• complain to a data protection authority or other regulator.

To exercise a right, email systems@valnoraelric.com. We may need to confirm your identity first, and we reply within the time the law sets. If your request is about content in a customer’s workspace, we will pass it to that customer and help it respond. We will not treat you differently for using your rights.

Agent Serve is a business product for organizations. It is not meant for children, and we do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, contact us and we will delete it.

We will update this policy when our practices change. The date at the top shows the latest version. If a change is significant, we will tell customers in advance by email or in the product.

Privacy questions, requests and legal notices: systems@valnoraelric.com. Post: Valnora & Elric Private Limited, A5, S. No. 16/2, 1st Floor, Swapnamandir Society, Deccan Gymkhana, Pune 411004, Maharashtra, India.