How Agents Pack handles your data

Who is responsible

MBEN DEV, 60 rue François Ier, 75008 Paris, France, is the data controller for Agents Pack.

Data we use

Depending on how you use the service, Agents Pack may process:

• your optional display name, required email address, password hash and secure login session;
• when you sign in with Google, Google's stable account identifier (subject), verified email address and chosen display name;
• publisher profile, business country, team membership, Stripe account identifier and payout status if you choose to publish;
• pack, order, payment-status and access records when commerce opens;
• when you submit a buyer review, the ratings, optional text, selected Target runtime and covered Release, Buyer-declared experience date, publication or moderation status, refund status, and the internal Entitlement and issued protected-download-access record used to verify eligibility; a published review exposes the generic label ‘Verified purchase’, ratings, optional text, selected Target runtime, Release version, declared experience date, publication date and any partial or full refund status, which are public and may be indexed by search engines, but it does not expose your name or email address;
• the manifest you submit for validation and, when pack uploads open, the ZIP archive, filenames, declared size and related storage or delivery records; the current manifest validator checks the manifest without adding it to the catalog;
• the recipient address, service-message content and delivery events when transactional email is enabled;
• when you join the early-access waitlist, the email address you enter, the audience you choose (buyer or publisher), the optional agent runtime you name, your language and the date of your consent;
• the Cloudflare Turnstile challenge token and request IP address on protected forms, IP-derived rate-limit records, and other technical or security data needed to diagnose errors and prevent abuse.

What is required

Email and password are required when you create a password account. Signing in with Google is an alternative and requires a verified Google email address. A display name is optional. A successful Turnstile check is required to submit protected production forms. Publisher, Stripe, manifest and pack-file details are needed only when you choose to use the matching seller feature. Submitting a review is optional; if you choose to do so, an overall rating, a declared experience date and the verified purchase, issued protected-download access, Release and selected Target runtime records are required, while the detailed ratings and written comment are optional. Transactional email data is generated only when a service message is sent. Without required information, MBEN DEV cannot provide that part of the service.

Why we use it

We use this data to operate accounts, publisher workspaces, catalog access, pack review and delivery, purchases, verified buyer reviews, transactional messages and support; to authenticate, moderate and publish reviews; to prevent fraud and secure the service; and to meet accounting or legal duties when they apply.

A waitlist entry is used only to send the opening or early-access notification you asked for, based on your consent. It is not added to any newsletter, and you can withdraw at any time at the address below.

The legal basis is the performance of the service you request, our legitimate interest in keeping it secure, your consent for the waitlist notification, and legal obligations for payment and accounting records.

Service providers

Hetzner hosts the service. Stripe handles seller setup and card payments when those features are enabled. Sentry receives error diagnostics; before transmission, Agents Pack removes the user, request body, headers, cookies, query string and URL, and disables default personal-data collection. Error messages, stack traces and non-console breadcrumbs may still be included. Session replay and performance tracing are disabled.

Cloudflare Turnstile is active in production on sign-up, sign-in, waitlist and manifest-validation forms to detect automated abuse. Its widget evaluates technical and browser signals. On submission, Agents Pack sends the challenge token and request IP address to Cloudflare for verification; that verification request does not include the form fields.

Google provides the optional social sign-in service and is the source of the stable account subject, verified email address and chosen name received by Agents Pack. The OAuth access token is used transiently on the server to obtain that identity; Agents Pack stores neither the OAuth token nor Google's raw profile. Google's own privacy rules apply to its service.

Cloudflare R2 is planned for private pack storage when ZIP uploads and delivery open. The planned flow separates uploads awaiting validation from release artifacts and uses time-limited upload and download links. R2 will receive the archive content and object metadata needed to store and serve those files.

Resend is planned for transactional service email, such as account, security, purchase or delivery messages. When enabled, it will receive the recipient address, message subject and content, and technical delivery events. It is not currently planned for newsletters or advertising.

Umami audience measurement is disabled unless a site identifier is configured. Before enabling it publicly, MBEN DEV must confirm whether its configuration qualifies for a consent exemption or collect consent first. Some providers may process data outside the European Economic Area under an adequacy decision or contractual safeguards. Agents Pack does not sell personal data.

Retention

Account data is kept while the account is open. A published review and its authenticity-report link remain public for no more than five years from publication, unless the review is hidden or withdrawn sooner. After public removal, the minimum moderation, purchase and protected-access evidence may remain access-restricted for up to five years where needed to handle fraud, a complaint or a legal claim, then it is deleted or anonymised. The current Turnstile flow uses its short-lived token to decide whether a request may proceed and does not create a token record in the Agents Pack database. A waitlist entry is deleted once the notification it was created for has been sent, or earlier at your request. When R2 and Resend are enabled, pack files and transactional-email records will be kept according to delivery, access, moderation, security and support needs. You can delete your account and its data yourself from your account page (Delete my account); if that is not possible, request deletion at the address below. MBEN DEV will remove data that is no longer required, subject to legal obligations. Payment and accounting records will be kept for the period required by law. Precise production periods and deletion procedures for commerce, file storage and email must be finalised before those features open.

Your rights

You may ask to access, correct, export, restrict or delete your data, object to certain processing, or withdraw consent where consent applies. MBEN DEV will answer requests at the address below and may need to verify your identity first. You may also lodge a complaint with the French data-protection authority, the CNIL, at cnil.fr.