Privacy Notice

Last updated: 2026-10-24

This notice explains how MedoMatic, LLC ("MedoMatic", "we", "us") collects, uses and shares personal information when you use Agent Authority at agentauthority.org, its API, its MCP server and its emails (the "Service"). It also serves as our notice at collection under California law, and as our public biometric data policy.

Short version

• Agent Authority is a public registry of who owns each AI agent and who can sign for it. Some information is public on purpose. For personal owners, your legal name is not public.
• Persona checks your government ID and selfie. Persona holds the ID images, the selfie and the face scan. We do not receive or store them.
• We keep a one-way fingerprint of your ID number to stop one person from opening two verified accounts. We cannot turn it back into the number.
• We do not sell your personal information, share it for targeted advertising, or use advertising or analytics trackers.

Information we collect

Account information. Your name and email address, which you give when you sign up through WorkOS; whether you use a personal or company account; and your WorkOS user ID. WorkOS handles your password, email confirmation and two-step sign-in.

Identity verification information. The state or territory you declare as your primary residence; the outcome of your Persona check; the Persona inquiry ID; the country and state read from your ID; and a keyed one-way fingerprint (HMAC-SHA256) of your ID's country, type, issuing state and number. We do not store your ID images, your selfie, your face geometry, your ID number or your date of birth. Persona collects and holds those (see the biometric notice below).

Company information. The company's legal name, its state or territory of formation, its domain, the status of its daily domain check, its representatives and their permissions, and each representative's confirmation of authority. For the DNS check we store only a one-way digest of the record value.

Agent and registry records. Agent display names, public signing keys, ownership agreements and acceptances, signing custodians, key changes, disclosure requests and grants, disputes and responses, and an append-only audit log of these actions. The audit log uses salted commitments instead of raw personal details.

Billing information. Your Stripe subscription ID, plan, status, renewal date and number of agents, and a record of which renewal reminders we sent. Stripe collects your card details on its own pages. We never see or store your full card number.

Email information. Addresses you confirm for registry alerts, delivery and bounce records, and suppression records (stored as hashes of the address).

Technical information. Your IP address is used in memory to apply rate limits; we do not store it in the registry database. Our hosting provider, Vercel, keeps request logs that can include IP address, browser type and request time. We use cookies only to keep you signed in and to finish sign-in and identity steps safely. Your browser also stores unfinished changes and verification progress on your own device. These are all strictly necessary. We use no advertising cookies and no analytics tools.

How we use information

• to create and secure your account;
• to verify owners and companies, and to stop duplicate or fraudulent accounts;
• to run the public registry and sign its records;
• to bill you and manage your plan, including renewal reminders sent to your account email;
• to send you service emails, such as confirmations, billing notices, domain check failures and dispute notices;
• to handle disputes, disclosure requests and account recovery;
• to protect the Service, enforce our Terms of Service, and meet legal duties.

We do not use your information to make decisions about you that have legal or similar effects, except the identity and domain checks described here. If a check fails, you can contact us to ask for a review.

What is public

The public registry shows, for each registered agent: its display name, its owner's registry ID, owner type and verification status, its public keys, acceptance history, agreements, signing custodian and published disputes. For a company, it also shows the legal name, the state or territory, and the domain check status. For a personal owner, it does not show your legal name.

Public records are signed and can be copied by anyone. We cannot recall copies made outside the registry.

Identity disclosure. Another verified owner can ask to see who owns an agent. Your identity is shared with them only under the registry's disclosure process, for a limited time, and each request and grant is recorded. Information may also be shared in a published dispute when that is needed to resolve it.

Biometric data notice and policy

This section is our written policy for biometric identifiers and biometric information, including under the Illinois Biometric Information Privacy Act (BIPA), the Texas and Washington biometric laws, the Colorado Privacy Act and the California Consumer Privacy Act.

Notice version: 2026-10-24

• What is collected. During the identity check, Persona captures images of your government ID and a live selfie. From these it creates a scan of face geometry to compare your face with the photo on your ID.
• Why. Only to confirm that you are the person on the ID, to detect fraud, and to prevent one person from holding two verified accounts.
• Who holds it. Persona collects and processes this data for us as our service provider. We do not receive or store your ID images, your selfie or your face geometry. We receive only the outcome of the check and the limited fields listed above.
• Consent. We ask for your consent before the check starts. You give it by ticking a box and typing your full name as your signature. We store a record of your consent: your account ID, the name you typed, the time you agreed and the notice version shown above. The check does not start unless we hold that record for the current version. If this notice changes, we ask again. You can decline. If you decline, you cannot become a verified owner, and you can cancel your plan as set out in the Terms.
• Retention and destruction. Persona deletes the ID and selfie images 2 days after the check. In every case, biometric data is permanently destroyed when the purpose of the check is complete, or within 3 years of your last interaction with us, whichever comes first, unless a law or court order requires us to keep it longer.
• No sale. We do not sell, lease, trade or otherwise profit from biometric data. We share it only with Persona as our service provider, or when a law, subpoena or court order requires it.
• Security. Biometric data is protected with at least the same care as other sensitive information.

Who we share information with

We share personal information only with these service providers, who process it for us under contract, and as described above:

• WorkOS - sign-up, sign-in, email confirmation and two-step sign-in.
• Persona - identity verification (government ID and selfie).
• Stripe - payments and subscriptions.
• AgentMail - sending and receiving service emails.
• Vercel - hosting, request logs, scheduled jobs and private backup storage.
• Turso - the registry database.
• Cloudflare and Google public DNS - receive the company domain names we check each day. No personal details are sent.

We may also share information when a law, subpoena or court order requires it, to protect people or the Service, or as part of a merger, acquisition or sale of assets, under this notice.

How long we keep information

• Registry records and audit log: for the life of the registry. They are append-only so that anyone can check the history. Identity verification outcomes and the audit log are kept for at least 7 years.
• ID fingerprint: as long as your verified account exists, so that duplicate checks keep working, and for 3 years after the account closes.
• Account, company and email details: while your account is open, and for 3 years after it closes.
• Billing records: 7 years, for tax and accounting law. This includes refunds for declined identity checks.
• Biometric consent records: kept with the identity verification outcomes, for at least 7 years. They hold the name you typed but no biometric data.
• Sessions: a sign-in session expires after 8 hours.
• Backups: one daily copy of the database, replaced by the next day's copy.
• Persona data: see the biometric notice above.

Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct it;
• delete it;
• opt out of sale, sharing for targeted advertising, and profiling (we do none of these);
• limit our use of sensitive personal information (we use it only to provide the Service and keep it secure);
• appeal our decision on your request.

To make a request, email support@agentauthority.org from your account email. We may need to confirm your identity first. An authorized agent may make a request for you with your signed permission. We will not treat you differently for using these rights. If we deny a request, we will tell you why and how to appeal.

Limits on deletion. Registry records are append-only and public by design, so that anyone can check who owned an agent at a given time. We cannot delete records that others rely on, such as acceptances, published disputes and the audit log. We can close your account, remove your contact details, and delete what the law and the registry's integrity allow. Your legal name is never part of the public record for a personal owner.

California notice at collection

In the last 12 months we collected these categories of personal information, for the purposes and with the retention described above:

• identifiers (name, email, account and registry IDs);
• customer records (billing status, plan);
• commercial information (plan purchases);
• internet activity (request logs);
• geolocation limited to your declared state of residence;
• sensitive personal information: government ID details (stored only as a one-way fingerprint) and biometric information (held by Persona), and account sign-in credentials (held by WorkOS).

We collect this information from you, from Persona, WorkOS and Stripe, and from public DNS. We do not sell or share personal information, and we have no actual knowledge of selling or sharing information of anyone under 16.

Children

The Service is not for anyone under 18. We do not knowingly collect information from children. If you think a child gave us information, contact us and we will delete it where we can.

Security

We use encryption in transit, keyed hashes, append-only audit records, rate limits and access controls. No system is perfectly secure. Report security problems to support@agentauthority.org.

Where data is stored

We and our service providers store and process data in the United States. The registry database is hosted by Turso in the AWS us-east-1 region (Virginia).

Changes to this notice

We will post changes here and update the date at the top. For a material change, we will email account holders before it takes effect.

Contact

• MedoMatic, LLC
• Email: support@agentauthority.org