This notice explains what personal data we process when you use Agilo (agilo.app), why we process it, and what rights you have. Agilo is an inventory management platform for fashion businesses: it reads supplier documents, builds a product catalog, and syncs it with connected sales channels.
Data controller
The data controller is the operator of the Agilo service. For any request about your data, write to us through the contact form. We reply through the same channel within the legal deadlines.
What data we process
Account data. Email and password (stored only as a hash, never in plain text) when you create an account.
Business data you upload. Supplier documents (delivery notes, invoices, orders, price lists, catalogs), products, variants, prices and stock. These documents normally contain business data, not personal data; if a document does contain personal data (say, a contact name), it stays visible to your account only.
Orders from connected channels. If you connect a sales channel (such as Shopify or About You), we import orders with the data needed for fulfillment: the recipient's name, address and contact details. For this data you act as the data controller and Agilo as the processor under Art. 28 GDPR: we process it only to provide the service and on your instructions. A data processing agreement (DPA) is available on request.
Try-without-signup demo. If you upload a document in the homepage demo, we keep the processed file, the extraction result and your IP address (for abuse prevention only). Demo uploads not linked to an account are deleted within 30 days.
Site analytics. With your consent we use Google Analytics to understand how the site is used (page views, referral source). We don't run ads or profiling. You can decline in the banner with no effect on your use of the site.
Why we process it (legal bases)
- Providing the service: performance of a contract (Art. 6.1.b GDPR): account, document processing, catalog, channel sync, orders.
- Preventing abuse of the public demo: legitimate interest (Art. 6.1.f).
- Site usage statistics: consent (Art. 6.1.a), revocable at any time.
Artificial intelligence
Data extraction from documents is performed by third-party AI models, accessed through OpenRouter. Only the document content needed for extraction is sent to the models; your documents are not used to train our systems and are never shared with other customers.
Where your data lives
The database, authentication and file storage run on Supabase, and the application on Vercel, in European Union data centers (Frankfurt). AI model providers may process document excerpts outside the EU; in that case the transfer is covered by the providers' standard contractual clauses (SCCs).
How long we keep it
Account and business data are kept while the account is active; on closure they are deleted or anonymized within 90 days. Unclaimed demo uploads are deleted within 30 days. Technical logs are kept for up to 30 days.
Cookies
We use technical cookies required for authentication (login does not work without them) and, only with your consent, the Google Analytics measurement cookie. To change your choice, clear the site data in your browser: the banner will appear again on your next visit.
Your rights
You have the right to access your data, rectify it, erase it, restrict its processing, object to processing, and receive it in a portable format (Arts. 15-22 GDPR). Exercise these rights by writing to us through the contact form. You also have the right to lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali, gpdp.it).
Changes
If this notice changes substantially, we will flag it on the site and, for account holders, by email. The date of the latest update is shown at the top of the page.