Agoras Privacy Policy
Version 1.0, effective 18.09.2026
Agoras processes personal data only to provide the Service. This Policy explains what data is collected, why, who receives it, and the rights of the persons concerned under the EU General Data Protection Regulation (GDPR). Capitalised terms have the meaning given in the Terms of Service.
1. Controller
Agoras, a sole proprietorship (eenmanszaak) under Dutch law, Grote Gracht 54 D 09, 6211 SX Maastricht, the Netherlands, KVK no. 42158792, is the controller. Privacy contact: mail@agor.as. No data protection officer has been appointed.
2. Data we collect
| Category | Data | Legal basis |
|---|---|---|
| Account | E-mail address, hashed password, registration date, Discord username if linked; if the User signs in with Google or Discord, the account identifier, e-mail address and display name that Google or Discord provides | Contract performance |
| Billing | Plan, billing history, tokenised payment method (card details are held by Stripe, never by Agoras), billing country | Contract performance / legal obligation (tax law) |
| Configuration | Filters, flags, Autobuy and Negotiation settings, encrypted credentials of designated Marketplace or Proxy Service accounts | Contract performance |
| Usage | Login logs, Features used, Listings opened, orders and messages submitted through Autobuy or Negotiation | Contract performance / legitimate interest (service improvement, abuse prevention) |
| Chat | Messages posted in the Members Chat | Contract performance |
| Support | Messages exchanged with Agoras by e-mail or Discord | Contract performance / legitimate interest |
| Alerts | Push token or phone number used for phone alerts | Contract performance |
| Technical | IP address, browser and device type, language preference, error logs | Legitimate interest (security) |
Agoras does not collect special categories of personal data and does not use personal data for advertising or profiling.
3. How we use the data
To create and manage the Account; to provide the Features, including submitting orders and messages on the User's instruction; to process payments and manage the Plan; to send transactional messages (renewal, fee changes, security, service changes); to provide support and moderate the Members Chat; to prevent fraud and abuse; and to comply with legal obligations. Product news is sent by e-mail only with consent or under the existing-customer exception, always with an unsubscribe link.
4. Recipients
Data is shared only with the following categories of recipients, to the extent necessary, each bound by a data processing agreement:
- Payment processor: Stripe (payment processing, invoicing, VAT calculation)
- Hosting and infrastructure provider
- Transactional e-mail provider
- Phone-alert delivery provider
- Authorities, only where required by law
When the User uses Buy via dashboard, Autobuy or Negotiation, the data needed for the order or message goes to the Marketplace or Proxy Service the User designated, which processes it under its own privacy policy. The Lens Button opens Google Lens in the User's own browser; Agoras sends nothing to Google. Discord processes community messages under Discord's own policy. Sign in with Google and Sign in with Discord are optional. When the User chooses one of them, Google or Discord confirms the User's identity and passes the account identifier, e-mail address and display name to Agoras, under Google's or Discord's own privacy policy.
5. Marketplace listings
The Feed displays listings published by Sellers on public Marketplaces, which may contain a Seller's username, profile picture, photographs, description, average review score, price and location. Agoras processes this data on the basis of its legitimate interest, and that of its Users, in finding items publicly offered for sale (art. 6(1)(f) GDPR). Listings are shown only to logged-in Users, are used only for sourcing, and are deleted 3 days after they were last seen on the Marketplace, except in the User’s own Account history. Because Agoras cannot identify or contact individual Sellers, this Policy serves as the notice under art. 14 GDPR. A Seller who objects to the display of their listings may write to mail@agor.as with the Marketplace and username.
6. International transfers
Stripe (payments), Google (sign-in) and Discord (community, support and sign-in) are established in the United States and certified under the EU-US Data Privacy Framework. Any other transfer outside the EEA takes place under the European Commission's Standard Contractual Clauses.
7. Retention
- Account, configuration and usage data: duration of the Account plus 12 months
- Billing records: 7 years (Dutch tax retention obligation)
- Members Chat messages: Up to one year
- Technical logs: 6 months
- Support communications: 2 years after closure
- Marketplace listings: removed from the Feed within minutes after they are no longer current and not stored beyond 3 days. Listings the User opened or bought, and Sellers the User flagged, are kept in the User's own Account history for the duration of the Account.
After these periods data is deleted or irreversibly anonymised.
8. Rights
Everyone whose data Agoras processes may request access, rectification, erasure, restriction and portability, may object to processing based on legitimate interest, and may withdraw consent at any time. Requests go to mail@agor.as and are answered within 30 days. Complaints may be lodged with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority of the person's own EU state.
9. Security
Passwords are stored hashed, designated account credentials are stored encrypted, all connections use TLS, and access to production data is restricted to Agoras. In the event of a breach likely to result in a high risk to the persons concerned, Agoras notifies them without undue delay. The User is responsible for choosing a strong password and keeping the credentials confidential. Unauthorised access resulting from the User's own conduct is not a data breach by Agoras; section 5.1 of the Terms of Service applies.
10. Cookies
Strictly necessary cookies only: session cookie (login), security token, language and theme preference. No consent is required. Agoras uses no analytics or advertising cookies.
11. Children
The Service is for persons aged 18 and over. Agoras does not knowingly process data of minors and deletes such data promptly on becoming aware of it.
12. Changes
Material changes are announced by e-mail or in the Service at least 15 days before they take effect. The current version is at https://agor.as/privacy.
13. Contact
Privacy requests: mail@agor.as. Support: mail@agor.as. Discord: https://discord.gg/Jsn8cMg4Qq.