"I'm watching you, Wazowski. Always watching." — Monsters, Inc.
Last updated: August 16, 2025
Overview
Agent Heights ("we", "our", or "the Service") is an AI agent platform that lets users hire and manage AI agents connected to external services via Model Context Protocol (MCP) servers. This Privacy Policy explains what data we collect, how we use it, and the choices you have.
Information We Collect
Account Information
Email address (for authentication and account management)
Display name and profile preferences
Agent and Usage Data
Agent configurations, prompts, and conversation history
API usage records for billing and rate limiting
WebSocket session data for real-time agent communication
OAuth Tokens (Google Workspace and other MCP integrations)
When you connect an external service (e.g., Gmail, Google Calendar, Google Drive), we store OAuth access and refresh tokens encrypted in our database
These tokens are used solely to authenticate API requests to the connected service on your behalf
We never share your OAuth tokens with third parties
You can revoke access at any time from your account settings or the provider's security settings
Payment Information
Subscription and payment processing is handled by Stripe — we do not store your full credit card number
We store transaction records and billing history for account management
How Google Workspace MCP Servers Access Your Data
When you connect a Google Workspace agent (Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, Google Calendar, Google Chat, or Google Contacts), the agent accesses your Google data through Google's official MCP servers using OAuth 2.0. The specific data accessed depends on the scopes you authorize:
Gmail: Read email threads and create drafts (does not send emails automatically)
Google Drive: Search, read, and manage files you've opened or created through the app
Google Docs: Read and update documents
Google Sheets: Read and update spreadsheet data and formulas
Google Slides: Read and update presentations
Google Calendar: List, search, create, update, and delete events
Google Chat: Read and send messages in spaces the bot is added to
Google Contacts: Read your contacts, profile, and directory (read-only)
All data access is performed through Google's official MCP servers. We do not store the content of your Google Workspace data — only the OAuth tokens needed to make authenticated requests.
How We Use Your Data
To provide and maintain the Service
To authenticate you and manage your account
To process payments and manage subscriptions
To communicate with you about your account and the Service
To monitor and improve Service performance and reliability
To comply with legal obligations
Data Security
Data is stored in Supabase (PostgreSQL) with row-level security policies
OAuth tokens and API keys are encrypted using AES-256-GCM
All traffic is served over HTTPS
Access to sensitive data is restricted to authenticated users only
Data Retention
Account data is retained while your account is active
You can request account deletion at any time — data is permanently removed within 30 days
OAuth tokens are removed when you disconnect a service or delete your account
Billing records may be retained for legal compliance purposes
Your Privacy Rights
Access, correct, or delete your personal data
Revoke OAuth access for any connected service
Export your agent configurations and conversation history
Cancel your subscription at any time
Third-Party Providers
The Service integrates with the following third-party providers: