Privacy Policy
Last updated: 27 July 2026 Applies to: https://pyxero.ai - the Agent Gate marketing website (the "Site")
Scope. This policy covers our public marketing website only: the pages you can browse without an account (home, Platform, Connectors, FAQs, Pricing, Docs), the demo request form at
/demo, the connector request form at/request-connector, and the analytics we run across them. It does not cover the Agent Gate platform itself - the gateway, connectors, credential storage, audit logs, or any data your AI agents process through us. Those are governed by a separate agreement and will have their own privacy documentation when the platform becomes available.
1. Who we are
Agent Gate is a product of Pyxero d.o.o. ("Pyxero", "we", "us", "our"). We are the data controller for the personal data described in this policy.
- Legal entity: Pyxero d.o.o.
- Company registration number: 22098462
- Registered address: «FILL: street, city, postal code, Serbia»
- Privacy contact: office@pyxero.ai
We have not appointed a Data Protection Officer. We are not required to, given the limited scope of processing described here, and you can raise any privacy matter directly with us at the address above.
2. What we collect
2.1 Demo request form (/demo)
| Field | Required |
|---|---|
| Work email address | Yes |
| Company size (employee band) | Yes |
| What you want to accomplish with Agent Gate | Yes |
| Free-text description of your stack, integrations and AI clients | No |
| How you heard about us | No |
We use this to understand your situation, prepare for the demo, and contact you to arrange it.
2.2 Connector request form (/request-connector)
| Step | Field | Required |
|---|---|---|
| 1. Contact information | First name | Yes |
| 1. Contact information | Last name | Yes |
| 1. Contact information | Email address | Yes |
| 1. Contact information | Company | No |
| 2. Connector & use case | Which connector you would like us to build | Yes |
| 2. Connector & use case | A description of your use case | Yes |
| 3. Stay in the loop | Your choice to receive updates on that connector's development | No |
We use this to prioritise our connector roadmap. Step 3 is optional and narrow: if you opt in, we will email you about the progress and availability of the specific connector you requested, and nothing else. It is not a general marketing list. Declining has no effect on whether we build the connector, and every message includes a one-click unsubscribe link.
2.3 A note on the free-text fields
Both forms include a free-text box. Please keep your description general. Do not include credentials, API keys, tokens, customer data, internal hostnames, architecture diagrams, or anything covered by an NDA. We do not need that level of detail to prepare a demo or scope a connector, and we would rather you did not send it.
2.4 Information collected automatically
- Server and delivery logs. Our hosting provider records IP address, user agent, requested URL, referrer, response status and timestamp as a normal part of serving the Site, for delivery, security and troubleshooting.
- Google Analytics 4. Pages viewed, session duration, approximate location, device and browser type, and traffic source. Only after you consent.
- Hotjar. Anonymised session recordings and aggregated heatmaps showing mouse movement, clicks, scrolling and navigation. Only after you consent. See Section 3.3 for the limits we apply.
See our Cookies Policy for the specific cookies involved.
2.5 What we do not collect on this Site
No accounts, no passwords, no payment details. The "Sign up for free" call to action is not yet active. We do not collect special categories of personal data - health, biometrics, political opinions and the like - and we do not knowingly collect data from children. There are no hidden form fields on this Site: everything we collect is a field you can see and choose to complete.
3. Analytics and session recording
Google Analytics and Hotjar are non-essential. Neither loads until you accept analytics cookies in our consent banner. If you reject, or simply ignore the banner, neither script runs at all.
3.1 Google Analytics 4 (Google Ireland Limited / Google LLC)
Measures traffic volume and which content people find useful. GA4 does not store your IP address; it is used momentarily to infer coarse location and then discarded. We have not enabled Google Signals, so no cross-device or ads-personalisation profile is built from your visit, and we have not linked Google Ads. Our GA4 data retention is set to 14 months.
3.2 Hotjar (Hotjar Ltd., part of the Contentsquare group)
Shows us where visitors hesitate, what they scroll past, and which parts of a page confuse people. Hotjar assigns a random identifier to your browser. It does not tell us who you are, and we do not connect it to anything you submit through a form. Recordings and heatmaps are retained for 365 days.
3.3 Limits we apply to session recording
Session recording captures interaction, not just page views, so we constrain it deliberately:
- The
/demoand/request-connectorpages are excluded from session recording entirely. No recording is made while you are filling in either form. - Across the rest of the Site, Hotjar's keystroke suppression is enabled, so text typed into any input is masked in the browser before it is transmitted.
- We do not use Hotjar's user-attributes, feedback-widget or survey features, so recordings are never tied to an identity.
You can object to session recording at any time (Section 8), and Hotjar honours the browser Do Not Track signal.
4. Why we process your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to a demo request and arranging the demo | Art. 6(1)(b) - steps taken at your request prior to a contract |
| Handling a connector request and assessing it for our roadmap | Art. 6(1)(b) - steps taken at your request; Art. 6(1)(f) for aggregate roadmap planning |
| Emailing you about the development of a connector you requested | Art. 6(1)(a) - your consent, given at step 3 of that form |
| Follow-up correspondence about Agent Gate with someone who contacted us | Art. 6(1)(f) - legitimate interest in business-to-business correspondence; you may object at any time |
| Google Analytics and Hotjar | Art. 6(1)(a) - your consent, via the cookie banner |
| Keeping the Site available, secure and free of abuse | Art. 6(1)(f) - legitimate interest in network and information security |
| Meeting legal, accounting and regulatory obligations | Art. 6(1)(c) - legal obligation |
Withdrawing consent is as easy as giving it and does not affect processing that already took place.
5. Who we share it with
We do not sell personal data and we do not share it for third-party advertising.
| Provider | Role | Processing location |
|---|---|---|
| Vercel Inc. | Site hosting, edge delivery, server logs | United States and global edge network |
| Google Ireland Limited / Google LLC (Google Workspace) | Delivering and storing form submissions in our email inbox | European Union and United States |
| Google Ireland Limited / Google LLC (Google Analytics 4) | Website analytics | European Union and United States |
| Hotjar Ltd. | Heatmaps and session recording | Ireland, European Union |
Submissions from both forms are delivered to a Pyxero email inbox hosted on Google Workspace, where they are read by the members of our team who handle demo and connector requests. Each provider above acts as a processor under a data processing agreement.
We may also disclose data where legally compelled by a competent authority, or to establish, exercise or defend legal claims. If Pyxero is acquired or merges, data may transfer to the successor entity under equivalent protections, and we will notify you before your data becomes subject to a different policy.
6. International transfers
Pyxero d.o.o. is established in Serbia. Vercel and Google involve transfers to the United States. Google LLC self-certifies under the EU–US Data Privacy Framework, and we rely additionally on the European Commission's Standard Contractual Clauses with both providers. Hotjar processes within the European Union. For any transfer outside the EEA we rely on an adequacy decision, Standard Contractual Clauses, or another lawful mechanism under Chapter V of the GDPR. Write to office@pyxero.ai for details or a copy of the safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Demo request submissions | 24 months from last contact |
| Connector request submissions | 24 months from submission, or until the connector ships and you have been notified |
| Consent records for connector update emails | Until you unsubscribe, plus 24 months as proof of consent |
| Correspondence arising from either form | 24 months after the conversation ends |
| Server and security logs | 30 days |
| Google Analytics event data | 14 months; aggregated reports may be kept longer |
| Hotjar recordings and heatmaps | 365 days |
After these periods data is deleted or irreversibly anonymised.
8. Your rights
Under the EU General Data Protection Regulation and, in Serbia, the Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti), you have the right to:
- Access - obtain a copy of the personal data we hold about you
- Rectification - have inaccurate data corrected
- Erasure - have your data deleted where no overriding ground applies
- Restriction - have processing paused while a dispute is resolved
- Portability - receive data you provided in a structured, machine-readable format
- Object - object at any time to processing based on legitimate interest, including our follow-up correspondence and any session recording
- Withdraw consent - for analytics via Cookie settings in the footer, and for connector update emails via the unsubscribe link in any message
- Lodge a complaint - with a supervisory authority
Write to office@pyxero.ai. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need that extension. We may ask you to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.
Supervisory authority (Serbia): Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11000 Belgrade - office@poverenik.rs
If you are in the EEA, you may instead complain to the supervisory authority where you live, where you work, or where you believe an infringement occurred.
9. Security
The Site is served over HTTPS. Access to form submissions is limited to the team members who need it. We select providers that maintain recognised security certifications and review that periodically. No internet transmission is perfectly secure, so while we apply appropriate technical and organisational measures, we cannot guarantee absolute security.
10. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not profile visitors to this Site.
11. Links to other services
The Site links to our LinkedIn and Instagram profiles, and to our documentation. Those services have their own privacy practices and this policy does not apply to them. Following such a link means the destination site may set its own cookies and collect its own data.
12. Changes
We will update this policy as the Site and the product develop, revising the "Last updated" date each time. Material changes - in particular the launch of the Agent Gate platform, which introduces a substantially different data relationship - will be announced through a prominent notice on the Site before they take effect.
13. Contact
Pyxero d.o.o. - office@pyxero.ai - Belgrade, Serbia