Welcome to Agent Heights. We see everything. But in a good way.
Agent Heights ("we", "our", or "the Service") is an AI agent platform that lets users hire and manage AI agents connected to external services via Model Context Protocol (MCP) servers. This Privacy Policy explains what data we collect, how we use it, and the choices you have.
What We See
Don't worry — we're not actually hiding in your closet. We just need a few things to run the office.
Account Information
Email address (for authentication and account management)
Display name and profile preferences
Agent and Usage Data
Agent configurations, prompts, and conversation history
API usage records for billing and rate limiting
WebSocket session data for real-time agent communication
OAuth Tokens (Google Workspace and other MCP integrations)
When you connect an external service (e.g., Gmail, Google Calendar, Google Drive), we store OAuth access and refresh tokens encrypted in our database
These tokens are used solely to authenticate API requests to the connected service on your behalf
We never share your OAuth tokens with third parties
You can revoke access at any time from your account settings or the provider's security settings
Payment Information
Subscription and payment processing is handled by Stripe — we do not store your full credit card number
We store transaction records and billing history for account management
How Google Workspace MCP Servers Access Your Data
When you let an agent peek at your Google stuff, here's exactly what it can see.
When you connect a Google Workspace agent (Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, Google Calendar, Google Chat, or Google Contacts), the agent accesses your Google data through Google's official MCP servers using OAuth 2.0. The specific data accessed depends on the scopes you authorize:
Gmail: Read email threads and create drafts (does not send emails automatically)
Google Drive: Search, read, and manage files you've opened or created through the app
Google Docs: Read and update documents
Google Sheets: Read and update spreadsheet data and formulas
Google Slides: Read and update presentations
Google Calendar: List, search, create, update, and delete events
Google Chat: Read and send messages in spaces the bot is added to
Google Contacts: Read your contacts, profile, and directory (read-only)
All data access is performed through Google's official MCP servers. We do not store the content of your Google Workspace data — only the OAuth tokens needed to make authenticated requests.
Why We're Watching
It's not creepy. We promise. It's mostly just... keeping the lights on.
To provide and maintain the Service
To authenticate you and manage your account
To process payments and manage subscriptions
To communicate with you about your account and the Service
To monitor and improve Service performance and reliability
To comply with legal obligations
The Surveillance Room
All footage stored in a secure, encrypted vault. No interns with clipboards.
Data is stored in Supabase (PostgreSQL) with row-level security policies
OAuth tokens and API keys are encrypted using AES-256-GCM
All traffic is served over HTTPS
Access to sensitive data is restricted to authenticated users only
How Long We Keep Watching
We don't hold grudges. Or data. Once you're out, you're out.
Account data is retained while your account is active
You can request account deletion at any time — data is permanently removed within 30 days
OAuth tokens are removed when you disconnect a service or delete your account
Billing records may be retained for legal compliance purposes
Your Right to Be Un-Watched
You can walk away at any time. We'll stop watching. We might miss you though.
Access, correct, or delete your personal data
Revoke OAuth access for any connected service
Export your agent configurations and conversation history
Cancel your subscription at any time
Who Else Has Eyes On You
We work with some trusted partners. They have their own eyes. And their own rules.
The Service integrates with the following third-party providers: