Privacy policy
This document sets out what personal data this site collects, why, who receives it, how long we keep it and how you take control of it. It describes what the site actually does, not a generic template.
Last updated 2026-09-04
Data controller
We have not appointed a data protection officer: our activity falls outside the cases where the law requires one. Your requests are handled directly at the address above.
What we collect, and why
Contact forms. Your email address, your message, the page you wrote from, your language and where your visit came from (campaign parameters and referring site). Purpose: to reply to you and prepare a possible engagement. Legal basis: steps taken at your request prior to entering a contract.
Scoping assistant. If you use the assistant that drafts a functional specification, we keep your email address, the conversation messages, the resulting document and the context you provide (company, scope, budget). Purpose: to qualify your need and hand you the document. Legal basis: steps taken at your request prior to entering a contract.
Newsletter. Your email address and your language, collected only where you sign up for it. Legal basis: your consent. Nothing else on the site subscribes you: unlocking a tool records the unlock, writing to us gets you a reply, and neither adds you to the list.
Address verification. To keep automated sign-ups out, the address you enter is checked: format, whether it belongs to a disposable-address service, whether the domain exists. No email is sent during that check.
Audience measurement. We measure site traffic with PostHog, in cookieless mode: no persistent identifier, no individual profile, no session recording, nothing stored in your browser. We see page views and aggregate journeys, never a person. Legal basis: our legitimate interest in knowing our own audience.
Abuse protection. Sensitive entry points (the scoping assistant, the private area login) are protected by Arcjet, which inspects the IP address and request characteristics to block bots and repeated attempts. Legal basis: our legitimate interest in protecting the service. That data serves no other purpose.
Server logs. Our host keeps technical logs containing IP addresses, for diagnostics and security.
Cookies
This site sets no analytics, advertising or social-network cookie. There is no Google Analytics, no Meta pixel, no tracking share button. That is why you see no consent banner: we have nothing to ask you to accept.
The only cookie we set is a strictly necessary session cookie, on the private area reserved for our team. A visitor to the public site never receives one.
Your visit attribution (campaign, referring site) is held in your browser session memory for the duration of your visit and disappears when you close the tab. It reaches us only if you choose to write to us.
Who receives your data
We neither sell nor rent any data. It leaves us only for the technical providers below, which act on our instructions.
Transfers outside the European Union
Postmark, Anthropic and Arcjet are established in the United States. Transfers to them are framed by the European Commission standard contractual clauses, supplemented where applicable by their certification under the EU, US Data Privacy Framework.
What that means in practice: do not type anything into the scoping assistant that you would not want leaving the European Union. Describe your need, not your trade secrets or your own customers data.
How long we keep it
One point of transparency: the purge at the end of those periods is not yet automated in our system. It is done by hand. If you ask us to erase your data, we do it within one month, without waiting for the deadline.
Your rights
You have the right to access, correct, erase, object to, restrict and port your data, and to withdraw your consent at any time where the processing rests on it.
To exercise them, write to hello@theagentictribe.com. We answer within one month. We may ask you for something that confirms it is really you, but only where a reasonable doubt exists.
To leave the newsletter, use the unsubscribe link in any email we send, or write to us: we remove you from the list immediately.
If our answer does not satisfy you, you can lodge a complaint with the French data protection authority, CNIL, 3 place de Fontenoy, 75007 Paris, or at cnil.fr. You may also contact the supervisory authority of the country where you live.
Security
The site is served over HTTPS only. The database is not exposed to the public internet, and application access is limited to our team. Technical secrets live in a dedicated vault, never in the code.
Changes
This document changes as the site does. The last-updated date sits at the top of the page. A change that would widen the use of your data beyond what is described here would be flagged to you before it took effect.