Privacy Policy

This policy explains what personal data AgenticMart collects when you use agenticmart.org, why we use it, who we share it with, how long we keep it, and the rights you have. We keep data collection to what we need to run the service. We do not show ads and we do not sell your personal data.

Who is responsible for your data

The controller of your personal data is Esha Sabir, a sole proprietor trading as AgenticMart, Pakistan. For any privacy question or request, email eshasabir17@gmail.com or use the contact page.

What we collect

• Account data. You sign in with GitHub. We receive your GitHub username, display name, avatar URL and the email address on your GitHub account. You can also choose a handle and add a bio.
• Listing data. Repositories you submit or claim, and the descriptions, images and files you add to listings.
• Reviews. Star ratings (1 to 5) and review text you post, linked to your account.
• Purchase data. Orders you place or receive: item, price, date and status. Card details are collected by Stripe; we never see or store your full card number. If you sell, Stripe collects the identity and bank details needed to verify you and pay you.
• Messages. What you send us through the contact, report, takedown and security forms, including your email address.
• Newsletter. If you subscribe, your email address and the record of your confirmation.
• Scan data. Results of automated security scans of listed repositories. Secret-detection findings are stored with the secret values redacted.
• Analytics. Aggregate page-view statistics from Vercel Web Analytics, which does not use cookies or build profiles of individual visitors.
• Public GitHub data about maintainers. For the directory, we import public information about repositories through the GitHub API, including the owner's GitHub login and avatar. The source of this data is GitHub, where it is already public. We do this even if you have never visited AgenticMart.

Why we use it, and our legal bases

• To provide the service you asked for (performance of a contract): running your account, publishing your listings and reviews, processing purchases and delivering downloads, paying sellers, and answering your messages.
• Our legitimate interests, balanced against your rights: operating a searchable directory of public open-source repositories, running automated security scans so users can make safer choices, preventing fraud and abuse, keeping the service secure, and understanding aggregate usage. You can object to this processing at any time (see below).
• Your consent: sending you the newsletter. You can withdraw consent at any time with the unsubscribe link in every email.
• Legal obligations: keeping payment and tax records, and responding to lawful requests.

Who processes your data

We use a small number of service providers who process data on our behalf under contracts with them:

• Vercel — website hosting and cookieless web analytics.
• Supabase — database and sign-in (authentication).
• Stripe — payments, seller onboarding and identity checks, payouts and tax calculation.
• GitHub — sign-in, public repository data, and the virtual machines that run security scans.
• Resend — sending account, receipt and newsletter emails.

When you buy an item, the seller receives the order details needed to support you. We may also disclose data if required by law, or to protect the rights and safety of users and the service. We do not sell or rent your personal data, and we do not share it for advertising.

International transfers

Our providers process data in the United States and other countries. Where data from the EU, UK or other regions with transfer rules is sent abroad, the providers rely on recognised safeguards such as the standard contractual clauses approved for that purpose.

How long we keep it

• Account and profile data — until you delete your account.
• Order and payment records — 7 years, to meet tax and accounting rules.
• Contact, report and takedown messages — 2 years from our last reply.
• Newsletter address — until you unsubscribe.
• Scan reports — for as long as the project is listed.
• Imported listings — while the public repository remains available, or until the maintainer asks us to remove it.

Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you and get a copy.
• Correct data that is wrong or incomplete.
• Delete your data.
• Restrict how we use your data.
• Object to processing based on our legitimate interests — including objecting to an imported listing of your repository, which we will remove.
• Receive data you gave us in a portable, machine-readable format.
• Withdraw consent at any time, without affecting processing before the withdrawal.
• Complain to the data protection authority in the country where you live or work.

To use any of these rights, email eshasabir17@gmail.com or use the contact page. We may ask you to confirm your identity, for example by signing in with the GitHub account concerned. We reply within 30 days. Some data, such as order records we must keep for tax purposes, may be kept even after a deletion request, and we will tell you if so.

Creator links

If you follow a creator's link, the page address carries their code and we count the click against it. We store no IP address, cookie or device data for this. If you apply to the creator programme, we keep your handle, the details you send and your clips' links to run the programme.

Cookies

We use only strictly necessary cookies that keep you signed in. They are required for the service to work, so we do not show a cookie banner. Vercel Web Analytics does not use cookies. We do not use advertising or cross-site tracking cookies. Stripe may set its own cookies on its checkout and billing pages for fraud prevention, under Stripe's own privacy policy.

Children

AgenticMart is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child under 16 has given us personal data, contact us and we will delete it.

How we protect your data

All traffic to the site is encrypted in transit (HTTPS). Access to our systems is limited to what is needed and protected with strong authentication. Our database uses row-level security so that users can only read and change the records they are allowed to. Security scans run on disposable virtual machines that are destroyed after each run, and secret values found by scans are redacted before storage. No system is perfectly secure, but we work to keep your data safe and welcome reports under our security policy.

If something goes wrong

If a personal data breach is likely to put your rights at risk, we will notify the relevant authority where required by law and tell affected users without undue delay, explaining what happened and what we are doing about it.

California residents

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information for purposes other than providing the service. California residents have the rights described above, including to know, correct and delete personal information, and we will not treat you differently for using them. You can make a request using the contact details above, or through an authorised agent.

Changes to this policy

We will update this policy when our practices change and change the date at the top of the page. If the changes are significant, we will tell signed-in users by email or with a notice on the site.

Contact

Esha Sabir, trading as AgenticMart, Pakistan. Email eshasabir17@gmail.com or use the contact page.