Get Free Guide

Privacy Policy

Last updated: March 14, 2026

1. Introduction

Agent Builder Academy ("we", "our", "us"), a brand of NEGELE Digital Services, takes the protection of your personal data seriously. This Privacy Policy explains what data we collect, how and why we process it, who we share it with, and what rights you have under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

This policy applies to all services offered at agentbuilderacademy.com and any associated digital products.

2. Data Controller

The party responsible for the processing of your personal data (data controller) is:

NEGELE Digital Services
Owner: Michael Negele
Schneeglöckchenstr. 10, 10407 Berlin, Germany
Email: hello@agentbuilderacademy.com
Phone: +49 151 1944 6361

3. Overview of Data We Collect

Depending on how you use our website and services, we may collect the following categories of personal data:

  • Identity data: Name, username
  • Contact data: Email address, phone number (if provided voluntarily)
  • Account data: Login credentials managed via our authentication provider
  • Usage data: Pages visited, features used, clicks, session duration, diagnostic tool inputs and results
  • Device & technical data: IP address, browser type, operating system, referrer URL, timestamps
  • Payment data: Transaction confirmation, billing country (full payment data processed by Stripe — we do not store card numbers)
  • Communications data: Messages or enquiries submitted via contact forms
  • Consent data: Records of your cookie and marketing consent choices

4. Legal Bases for Processing

We process your personal data on one or more of the following legal bases under Art. 6 GDPR:

  • Art. 6(1)(a) — Consent: Where you have given explicit consent (e.g. newsletter sign-up, analytics cookies)
  • Art. 6(1)(b) — Contract: Where processing is necessary to provide a service you have requested (e.g. account management, purchases)
  • Art. 6(1)(c) — Legal obligation: Where we are required to process data to comply with law (e.g. tax/accounting obligations)
  • Art. 6(1)(f) — Legitimate interests: Where we have a legitimate business interest that is not overridden by your rights (e.g. fraud prevention, website security, service improvement)

5. Hosting — Vercel

Our website is hosted by Vercel Inc. (340 Pine Street, Suite 701, San Francisco, CA 94104, USA). Vercel automatically collects server log data including IP addresses, request timestamps, browser type, and referring URLs for the purpose of ensuring the security and stability of the service.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable hosting).
Data transfer: Vercel is a US-based provider. Data transfers are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission. Vercel's privacy policy: vercel.com/legal/privacy-policy.

6. User Accounts — Clerk

Account registration and authentication is handled by Clerk Inc. (548 Market St #71333, San Francisco, CA 94104, USA). When you create an account, Clerk processes your email address, name, and — if you use social login — your OAuth tokens from Google, GitHub, or LinkedIn. Clerk manages session cookies and multi-factor authentication on our behalf.

Legal basis: Art. 6(1)(b) GDPR (necessary for contract performance — account provision).
Data transfer: Clerk is US-based. We have entered into a Data Processing Agreement (DPA) with Clerk and data transfers are covered by SCCs. Clerk's privacy policy: clerk.com/legal/privacy.

Social login providers (Google, GitHub, LinkedIn) operate under their own privacy policies when you authenticate through them.

7. Database — Supabase

We store user account data and diagnostic tool results (AI Setup Snapshot) using Supabase (Supabase Inc., 970 Toa Payoh North, Singapore). Our Supabase database is hosted in the EU (Ireland) region, ensuring your data remains within the European Economic Area.

Data stored includes: user ID (linked to Clerk), email, account creation date, and your APL/AAL diagnostic results.

Legal basis: Art. 6(1)(b) GDPR (contract performance — service delivery). Supabase privacy policy: supabase.com/privacy.

8. Analytics & Tracking

8a. Umami Analytics

We use Umami Cloud for privacy-friendly website analytics. Umami does not use cookies and does not collect personally identifiable information. It tracks aggregate metrics such as page views, referrer sources, and session counts using anonymised data only.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding website usage). No consent required as no personal data is processed.

8b. Google Analytics

We use Google Analytics (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to analyse website traffic and user behaviour. Google Analytics uses cookies to collect data including your IP address (anonymised), browser type, pages visited, and session duration.

Legal basis: Art. 6(1)(a) GDPR (consent). Google Analytics is only activated after you provide consent via our cookie consent banner. You may withdraw your consent at any time by changing your cookie preferences.
Data transfer: Google LLC is US-based; transfers are covered by SCCs and Google's EU Data Processing Terms. Google's privacy policy: policies.google.com/privacy.

8c. Google Tag Manager

We use Google Tag Manager (Google LLC) to manage and deploy tracking scripts on our website, including Google Analytics and other marketing tags. Google Tag Manager itself does not collect personal data — it acts as a container that fires other tags based on your consent preferences set via our cookie consent banner.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) for the Tag Manager container itself; Art. 6(1)(a) GDPR (consent) for any tags it fires.

9. Email & Newsletter — Resend

Our newsletter and transactional emails are sent via Resend (Resend Inc., San Francisco, CA, USA). When you subscribe to our newsletter, we store your email address with Resend for the purpose of sending you updates about frameworks, tools, and guides.

Legal basis: Art. 6(1)(a) GDPR (consent). You may unsubscribe at any time via the unsubscribe link in every email.
Data transfer: Resend is US-based; transfers are covered by SCCs. Resend's privacy policy: resend.com/legal/privacy-policy.

We may also store your email in our own database (Supabase, EU) for account-linked communications.

10. Contact Forms — Web3Forms

Our contact, advertiser, and job posting enquiry forms use Web3Forms to forward submissions to our inbox. When you submit a form, Web3Forms processes the data you enter (name, email, message) to deliver it to us. Web3Forms may retain form submissions on their servers for a limited period.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in receiving and responding to enquiries). We will not use form-submitted data for any purpose other than responding to your enquiry.

11. Payments — Stripe

All payment processing is handled by Stripe Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA). When you make a purchase — for sponsor ads, job listings, or premium content — Stripe processes your payment card data, billing address, and transaction amount directly. We receive only a payment confirmation and do not store your card details.

Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(c) GDPR (legal obligation for invoice/tax records).
Data transfer: Stripe is US-based; covered by SCCs and Stripe's Binding Corporate Rules. Stripe's privacy policy: stripe.com/privacy.

We retain invoice and transaction records for 10 years in accordance with German tax law (§ 147 AO).

12. Automation — n8n (Planned)

We may use n8n workflow automation to process data between our systems (e.g. syncing form submissions to Supabase, triggering emails via Resend). Where n8n processes personal data on our behalf, it acts as a data processor under a Data Processing Agreement.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational efficiency) / Art. 6(1)(b) where processing serves contract performance.

13. Cookies

We use cookies and similar technologies. Based on their purpose, cookies fall into the following categories:

  • Strictly necessary cookies: Required for the website to function (e.g. authentication session cookies from Clerk). These do not require consent and cannot be disabled. Retention: session or up to 1 year.
  • Analytics cookies: Used to understand how visitors interact with the site (Google Analytics). Activated only with your consent. Retention: up to 2 years.
  • Marketing / preference cookies: Set by Google Tag Manager upon firing marketing tags. Activated only with your consent.

You can manage or withdraw your cookie consent at any time via our cookie consent banner, accessible from any page. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.

Theme preferences (dark/light mode) are stored in your browser's localStorage — this is a technical feature, not a cookie, and does not involve any personal data.

14. Third-Country Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), primarily in the United States. In each case, we ensure an adequate level of protection through one or more of the following safeguards:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Data Processing Agreements (DPAs) with each processor
  • The processor's participation in recognised certification frameworks

Providers subject to US data transfers: Vercel, Clerk, Resend, Stripe, Google (Analytics, Tag Manager), Web3Forms.

15. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

  • Account data: Retained for the duration of your account. Deleted within 30 days of account deletion.
  • Diagnostic results (AI Setup Snapshot): Retained for the lifetime of your account, or deleted on request.
  • Newsletter subscriptions: Retained until you unsubscribe.
  • Contact form submissions: Retained for up to 3 years for correspondence records.
  • Payment/invoice records: 10 years (German tax law, § 147 AO).
  • Server logs (Vercel): Typically up to 30 days.
  • Analytics data (Google Analytics): Up to 26 months.

16. Your Rights Under GDPR

As a data subject, you have the following rights. To exercise any of them, contact us at hello@agentbuilderacademy.com.

  • Right of access (Art. 15 GDPR): Request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17 GDPR): Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
  • Right to restriction (Art. 18 GDPR): Request that we limit processing of your data in certain circumstances.
  • Right to data portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): Object to processing based on legitimate interests or for direct marketing purposes.
  • Right to withdraw consent (Art. 7(3) GDPR): Withdraw consent at any time without affecting lawfulness of prior processing.

We will respond to your request within 30 days. We may ask you to verify your identity before processing the request.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for our business is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Website: datenschutz-berlin.de

You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work.

18. Changes to this Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our services, legal requirements, or data processing practices. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically. Continued use of our services after changes constitutes acceptance of the updated policy.