Agentro — Privacy Policy

Last updated: 8 August 2026

Agentro ("the App", "we", "us") is a platform operated by Moomkin (a company registered in Uzbekistan). Agentro lets a business connect its own social media accounts (Instagram, Facebook, YouTube) and use an AI assistant to manage the comments and direct messages on those accounts on the business's behalf. This policy explains what data we access, how we use it, how we protect it, and how it can be deleted.

1. Information we access

Through the official Meta (Instagram/Facebook) and YouTube APIs, and only for accounts connected by an authorized account owner, we access:

Public comments left on the connected account's posts, reels, and videos — including the comment text, the commenter's public username/display name, the comment timestamp, and the post or video the comment belongs to;
Direct messages sent to the connected account, where the account owner has enabled messaging, to respond on their behalf;
Metadata of the connected account's own media (caption, description, permalink) used as context to draft an accurate reply.

We do not access data of accounts that have not been connected by their owner, and we do not collect data beyond what is needed to respond to comments and messages.

1.1 YouTube API Data specifically

For a connected YouTube channel, the exact data we access, collect, store and use through the YouTube API Services is:

Comment data — the text of a comment left on the channel's own videos, the YouTube comment id, the id of the thread it belongs to, the commenter's public display name and public channel id, and the time it was posted;
Video data — the video id, title, description, publish date and public link of the connected channel's own videos, together with the channel's own pinned comment where present. We also generate and store a short written summary of the video, used only to keep a reply accurate;
Channel data — the connected channel's id and the id of its uploads playlist, so that we know whose videos to read;
Credentials — the OAuth access and refresh tokens issued when the owner authorizes the channel.

We use this data for one purpose only: to show the business the comments left on its own videos and to publish the replies it approves. We do not request or store any YouTube statistics (view counts, subscriber counts, likes or any other metric), we do not download or re-host video content, we do not build advertising or user profiles, we do not use it to train generalized artificial intelligence or machine learning models, and we do not sell it or share it with any third party other than the service providers named in Section 6.

2. How we use it

To read comments and messages on the connected account and publish helpful replies on its behalf (community management and customer support);
To route negative, sensitive, or complaint interactions to a human operator instead of replying automatically.

3. AI processing

To draft a reply, the comment or message text and the related post information are sent to Google's Gemini API, which generates a suggested response. Google processes this data solely as a service provider to provide that functionality, under its API terms. We do not use this data to build advertising profiles and we do not use it to train generalized artificial intelligence or machine-learning models.

4. How we protect your data (data security)

We apply the following safeguards to all data we access, including any sensitive data:

Encryption in transit: all data is transmitted over encrypted connections (HTTPS/TLS) between the platforms' APIs, our servers, and the dashboard.
Secure storage: data is stored on access-controlled servers and object storage hosted in secure, professionally operated data centers, with encryption at rest applied by the hosting provider.
Access controls: access to stored data is restricted to authorized personnel on a least-privilege, need-to-know basis and is protected by authentication. The dashboard is available only to authenticated users, and each business can access only its own account's data.
Credential protection: OAuth access/refresh tokens and API secrets are stored securely, are never displayed in the dashboard, and are never shared publicly or with third parties.
Minimization: we access and retain only the data needed to respond to comments and messages, and nothing more.

5. Data retention and deletion

Comments, messages, and generated replies are retained only as long as needed to provide community-management and support features and to maintain quality, and are then removed. When a business disconnects its account, or on request, we delete the associated data. You may request deletion at any time (see Section 9). We do not sell or rent personal data to anyone.

YouTube API Data is capped at 30 days. In line with the YouTube API Services Developer Policies, data obtained through the YouTube API is stored for no longer than 30 calendar days. An automated daily process erases it once it reaches that age: the comment text, the commenter's display name and channel id, the thread and video identifiers, and the cached video title, description, pinned note and summary are all removed. What remains afterwards is only our own content — the reply text the business published and the internal record of what it cost. Data that is still in active use is re-read from the YouTube API rather than kept, so what we hold is never older than that window, and authorization tokens are kept only while the channel remains connected. YouTube statistics are never stored at all, for any length of time.

6. Data sharing

We share data only with the parties strictly needed to operate the service: the Meta (Instagram/Facebook) and YouTube platforms themselves; our hosting and object storage provider (Hetzner Online GmbH); and the Google Gemini API described above. Each acts as a service provider on our behalf. No other sharing occurs, and we do not sell personal data.

7. YouTube API Services

Agentro uses YouTube API Services to read and reply to comments on connected YouTube channels. By connecting a YouTube channel and using these features, you agree to be bound by the YouTube Terms of Service. For information on how Google handles your data, please review the Google Privacy Policy. You can review and revoke Agentro's access to your Google account data at any time via the Google security settings page.

8. Google API Services — Limited Use

Agentro's use and transfer of information received from Google APIs (including data obtained through YouTube via the youtube.force-ssl scope) adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, Google user data is used only to provide and improve the app's user-facing features (reading and replying to comments on the connected YouTube channel); it is not used for advertising, is not sold, and is not used to train generalized AI/ML models. Humans do not read this data except: (a) with the user's consent; (b) for security, abuse prevention, or to comply with applicable law; or (c) where the data has been aggregated and anonymized.

9. Your rights and data deletion

You may request access to, or deletion of, any data we hold about you. Email info@moomkin.uz and we will delete it within 7 calendar days of the request. You can also delete your comment directly on the platform, which removes it from our system on the next sync, and a business can disconnect its channel at any time from the Agentro dashboard, which immediately erases the stored credentials for it. See our data deletion instructions.

10. Cookies and storage on your device

The Agentro dashboard stores a small number of cookies on the browser of the signed-in business user. All of them are first-party, strictly necessary for the service to function, and contain no advertising or tracking identifier:

sb_session — an opaque sign-in session token, so you stay logged in. Removed when you log out;
sb_oauth_state, sb_yt_state, sb_ig_state — short-lived random values used to protect the Google and Meta authorization flows against cross-site request forgery. Each is deleted as soon as the flow it protects completes.

We do not use advertising, analytics, profiling or third-party cookies; we embed no third-party tracking scripts or pixels on our website or dashboard; and we neither read nor place anything else on your device, nor allow any third party to do so. We do not use cookies or any similar technology to collect information about viewers who leave comments — we never see their browsers at all.

11. Children

The App is not directed to children and we do not knowingly collect their data.

12. Changes

We may update this policy; the "Last updated" date above reflects the latest version.

13. Contact

Agentro / Moomkin — info@moomkin.uz