Privacy policy

Effective October 9, 2026Applies to the agaria web application and the “Agaria extension” Chrome extension.

agaria is an AI sales outreach tool: you describe who you want to reach, and agaria helps you find prospects, write outreach, and track replies. This policy explains what data we handle to provide that service, and nothing else. We do not sell your data, we do not serve ads, and we only use data for the outreach features you operate.

What we collect

Your account. Name, email address, and sign-in credentials, managed by our authentication provider (Supabase Auth).

Prospect data you capture. When you save a prospect from LinkedIn, we store the public profile information you chose to capture: name, headline, role, company, location, public posts, and, when you request it, a business email address or phone number.

Conversations. When you use the reply assistant on a LinkedIn conversation, the visible messages of that thread are read and sent to our servers to generate a draft. When you enable reply tracking, recent messages from your LinkedIn inbox are processed to match replies to your campaigns. Messages are only ever sent from your account by the campaigns you set up in agaria, whether you approved each one yourself, let agaria approve and send them automatically, or pressed Send yourself. Email conversations are covered in the Gmail and Outlook section below.

Your LinkedIn profile. To show your connected account in the app, the extension reads the basics of your own LinkedIn profile: name, profile URL, photo, and connection count.

Authentication state. The extension reads your own agaria session cookie to sign you in, and checks whether you are logged into LinkedIn so it knows when actions can run. It never reads other cookies and never collects your LinkedIn password.

Tools you connect. When you connect a CRM (HubSpot, Salesforce, Attio, Pipedrive, Breakcold, Close, or Zoho), we store the credentials you paste, encrypted at rest. CRM credentials are used only to write the contacts, companies, and notes of the leads you approved; we never read your CRM data back, and disconnecting the tool deletes the token. A connected Gmail or Outlook mailbox and a connected Google calendar are covered in their own sections below.

How we use it

Solely to provide agaria’s features: capturing and enriching the prospects you choose, drafting outreach and replies with AI, executing the actions you approve, and tracking campaign results. We never use your data to train models, determine creditworthiness, or for any purpose unrelated to your outreach.

Gmail and Outlook

You can connect Gmail, Google Workspace, Outlook or Microsoft 365 mailboxes to send the email steps of your campaigns. Connecting one gives agaria these permissions, and agaria uses each only for what is described here:

  • Send email (Gmail: gmail.send; Outlook: Mail.Send), to send the campaign emails and the replies you set up or approve, from your own mailbox. agaria sends nothing else from it.
  • Read email (Gmail: gmail.readonly; Outlook: Mail.Read), to find replies from the people your campaigns contacted, their requests to unsubscribe, and bounce notices for emails agaria sent, so a sequence stops and the reply shows in the app; to read back the identifier of each email agaria sends, so follow-ups stay in the same thread; and, for Gmail, to read your sender name and signature so your mailbox settings start filled in.
  • Your address (Google: userinfo.email; Microsoft: User.Read), to know which mailbox you connected and, for Outlook, the sender name set in your Microsoft account.

What agaria reads. agaria checks a connected mailbox for new messages. It reads the sender, recipients, subject and delivery headers of new messages, leaving out sent mail and drafts. It opens the content of a message only when the message answers an email agaria sent from this mailbox, or comes from a person your campaigns contacted, by email or on LinkedIn. It also opens delivery failure notices, which it recognises by their headers, to find the ones about emails it sent, and drops the others. For a message it does not open, agaria keeps only the message identifier, for up to 30 days, so it does not check it twice. In your sent mail, agaria reads only message identifiers, to confirm that the emails it sent went out.

Replies. The replies agaria finds are stored in agaria, shown to you and to your teammates on that campaign, and copied to your CRM if you connected one. The text of each reply, with agaria’s last message to that person, is sent to Google Gemini to label it, for example as a meeting request, interest or a request to stop. Gemini drafts an answer only when you ask for one (Draft reply with AI, or Gari, agaria’s assistant) or when you turned on automatic replies for that campaign. A draft uses the conversation so far, the person’s profile and the campaign’s settings. agaria sends an answer only after your approval or, if you turned that on, automatically. On the Pay per reply plan, a reply labelled positive creates a charge, and the first 280 characters of that reply are kept with the charge record. Gemini runs under Google’s paid API terms, which do not allow Google to use this text to improve its products. Gmail and Outlook data is never used to develop, improve or train generalized or non-personalized AI or machine learning models, by agaria or by the providers it works with.

After you disconnect. Imported replies stay in agaria after you disconnect the mailbox. Removing a lead from a campaign hides its replies, and deleting the campaign erases them. The first 100 characters of a reply also stay in your notifications, and the 280-character excerpt of a billed reply stays with its charge record. To have any of these erased, write to support@agaria.ai.

Access. Connecting a mailbox gives agaria ongoing access (Microsoft lists it as offline_access) until you disconnect the mailbox or revoke that access. Its tokens are encrypted at rest, and disconnecting the mailbox in agaria deletes them. If no other agaria connection uses the same Google account, disconnecting a Gmail mailbox also revokes agaria’s access at Google. Otherwise that access stays until the last connection is removed, or until you remove agaria in your Google Account. You can revoke access at any time in your Google Account or your Microsoft account (personal accounts, work or school accounts).

People. No one at agaria reads your email, except with your permission (for example to help with a support request), when needed for security (such as investigating abuse), or to comply with the law.

Sharing. agaria does not sell Gmail or Outlook data, does not use it for advertising, and does not transfer it to anyone except as needed to provide the features you use (such as syncing a conversation to the CRM you connected) or to comply with the law.

Agaria’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, including Gmail and Google Calendar, will adhere to the Google Workspace User Data and Developer Policy, including the Limited Use requirements. Agaria does not use data obtained through Google Workspace APIs to develop, improve, or train generalized or non-personalized AI or machine learning models.

Google Calendar

You can connect a Google calendar in Settings, under Calendar Integration, to receive the meetings you book with agaria. Connecting it gives agaria two permissions:

  • Add events (calendar.events.owned), used only to add an event to your primary calendar for each meeting you confirm in agaria, with its title, time and a short description. The description can quote the time and the booking link your contact wrote.
  • Your address (userinfo.email), to know which account you connected.

agaria only adds events. It never reads, changes or deletes events, and never reads your other calendars. It stores the address of the connected account, its tokens encrypted at rest, and the ID of each event it created. Disconnecting the calendar in agaria deletes its tokens and leaves the events it added in your calendar. If no other agaria connection uses the same Google account, disconnecting also revokes agaria’s access at Google. Otherwise that access stays until the last connection is removed, or until you remove agaria in your Google Account, where you can revoke it at any time.

People who receive emails sent with agaria

If you received an email from someone who uses agaria, this section is for you. The agaria user who emailed you decides how your address is used, and agaria processes it on their behalf.

What is kept. Your address, the messages exchanged with you, and what the sender saved about you as a prospect. When the sender turns on open or click tracking, agaria also records when the email was opened or a link in it was clicked, with the IP address and browser (user agent) that did it.

Unsubscribing. Every campaign email has an unsubscribe link. You can also reply with the word unsubscribe. Either way, the sender’s campaigns in agaria stop contacting you, by email and on LinkedIn.

Not contacted again. When you unsubscribe or ask to stop, or when an email to you bounces because the address does not exist, agaria adds your address to a block list so you are not contacted again. To have your data deleted, write to support@agaria.ai. We then delete it and keep only a one-way hash of your address on the block list, so you are not contacted again.

Who processes it

Data is stored in Supabase (authentication and database), our backend runs on Fly.io, and the web app runs on Cloudflare. To provide specific features we share the minimum necessary data with service providers: message, profile and reply text is sent to Google (Gemini) to write drafts and read replies; LinkedIn searches, public profile reads and business email lookups run through Apify; an email lookup started from the Chrome extension can send a prospect’s name and company domain to Hunter; and search queries are sent to Tavily for web context. These providers process data on our behalf and are not permitted to use it for their own purposes. When you connect a CRM, the leads you approved, their company, and the messages exchanged with them are sent to that CRM on your instruction; it then holds that data under its own terms.

The Chrome extension

The extension only operates on linkedin.com and on our own app domain. It adds the assistant to LinkedIn messaging, captures the profiles you ask it to, and performs the outreach actions you approved in agaria, inside your own browser session. It contains no remote code, collects nothing from other websites, and does not track your browsing history, clicks, or keystrokes.

Retention and deletion

We keep your data while your account is active. You can remove leads and delete campaigns in the app at any time. The app has no button to delete your account. To delete your account and its data, write to support@agaria.ai from the address you sign in with, and we delete it from our systems. Disconnecting a mailbox or a calendar deletes its tokens. Replies imported from a connected mailbox stay after you disconnect it, as the Gmail and Outlook section describes. When someone who received your emails has their data deleted, agaria keeps only a one-way hash of their address on the block list, so they are not contacted again. Manage and delete your data explains each step. For deletion requests or any privacy question, contact us at support@agaria.ai.

Changes

If this policy changes, we will update this page and its effective date. Material changes will be announced in the app.