DRAFT — for attorney review. Not yet final. Final text pending attorney sign-off.

Privacy Policy

Privacy Policy.

How Digital Currensy Inc. handles personal information for AGENTIC+SPA. Effective November 2, 2026. We do not sell or share personal information.

1. Scope · 2. Information we collect · 3. Feature status · 4. How we use information and legal bases · 5. Cookies, local storage and analytics · 6. How we share information · 7. Subprocessors · 8. Do not sell or share (California) · 9. California privacy rights · 10. EEA, UK and Swiss rights · 11. International transfers · 12. Security · 13. Retention · 14. Breach notification · 15. Children · 16. Contact and changes

1. Scope

This Privacy Policy explains how Digital Currensy Inc., a Delaware corporation (“DCI,” “we”), operating the AGENTIC+SPA brand, collects, uses and shares personal information through agentic-spa-door.vercel.app and the AGENTIC+SPA services (the “Service”). Where we process Customer Data for a business customer under a Written Agreement, we act as that customer’s service provider or processor and the customer’s own notice governs; guest data stays in the client’s own rails.

2. Information we collect

Information you give us. The fit-check and rate-card forms ask for your name, email, company (optional), workflow, desired result, tasks and access notes. The on-site chat agents receive the messages you type. Staff sign-in collects a staff email and password.

Information stored in your browser. The fit-check form saves a copy of your request text in your browser’s local storage so you can download it; it stays on your device until you clear it. Staff sign-in sets a signed, HttpOnly session cookie.

Information collected automatically. Our hosting provider receives standard request data such as IP address, user agent, URL, referrer and timestamps. Our endpoints use the IP address in memory for short-term rate limiting and do not store it. To check that an email domain can receive mail, the fit-check endpoint performs a DNS lookup of the domain (not of you).

We do not intentionally collect sensitive personal information, and we do not scrape reviews or listings or harvest inboxes.

3. Feature status

Some features in the site’s code are switched off in production today, and while they are off they do not send your information anywhere: email delivery of form submissions, mailing-list sign-up, the on-site AI chat agents, calendar scheduling, bot-check challenges and conversation logging. While those features are off, form submissions are refused with an error and are not stored. Before we switch any of them on, we will update Section 7 to name the provider and the data it receives.

4. How we use information and legal bases

We use personal information to: respond to requests and evaluate fit (steps at your request; legitimate interests); provide, secure and improve the Service (contract; legitimate interests); prevent spam, abuse and fraud (legitimate interests); run staff accounts (contract; legitimate interests); comply with law and enforce our terms (legal obligation; legitimate interests); and send communications you ask for or consent to (consent, which you may withdraw at any time).

5. Cookies, local storage and analytics

We use only a strictly necessary session cookie for staff sign-in and the local-storage copy described in Section 2. The site does not load advertising or tracking scripts. The page includes a reference to Vercel Web Analytics, which is not enabled for this site; if we enable it or any other analytics, we will update this policy and ask for consent where required.

6. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose it only to the service providers in Section 7 under contracts limiting their use; professional advisers; authorities or others when required by law or to protect rights, safety and security; and a successor in a merger, acquisition, financing or sale of assets, subject to this policy.

7. Subprocessors

Based on the site’s code and its production configuration, these providers process personal information for us today:

Legal notices and privacy requests sent through the AGENTIC+SPA contact form at agentic-spa.vercel.app are handled under that site’s Privacy Policy (Vercel and Resend).

8. Do not sell or share (California)

We do not sell or share (as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, “CCPA”) personal information, and have not done so in the prior 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16. We do not use sensitive personal information for purposes that would require a right to limit.

9. California privacy rights

California residents may have the right to know the categories and specific pieces of personal information collected, its sources, purposes and recipients; to delete it; to correct it; to opt out of sale or sharing (which we do not do); to limit use of sensitive personal information (which we do not use for restricted purposes); and not to receive discriminatory treatment. In the prior 12 months we collected identifiers and professional information, the content of your requests and messages, and internet activity (request logs), from you and your device, for the purposes in Section 4, and disclosed them for business purposes to the providers in Section 7. You or an authorized agent may submit a request through the contact method in Section 16; we will verify it by matching information you provide to what we hold and respond within the time the law requires.

10. EEA, UK and Swiss rights

If the GDPR or UK GDPR applies, DCI is the controller of personal information collected through the site. You may have the right to access, rectify, erase, restrict or object to processing, to data portability, to withdraw consent at any time without affecting prior processing, and to complain to your local supervisory authority.

11. International transfers

DCI and its providers are based in the United States, and personal information is processed there and wherever providers operate. Where required, transfers from the EEA, UK or Switzerland rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK Addendum, or a provider’s certification under the EU-U.S. Data Privacy Framework and its extensions.

12. Security

We use reasonable administrative, technical and physical measures designed to protect personal information, including HTTPS, signed HttpOnly session cookies, constant-time credential comparison, server-side validation, disposable-domain and honeypot spam checks, and rate limiting. No method of transmission or storage is completely secure, and we cannot guarantee security.

13. Retention

While email delivery is off, form submissions are not retained. When it is on, request emails are kept as long as needed to respond and keep business records, generally no longer than 24 months after our last interaction unless law or a Written Agreement requires longer. Hosting request logs are kept by Vercel under its retention periods. Rate-limit data is held in memory only. Staff session cookies expire on their own. Customer Data is retained as the Written Agreement provides.

14. Breach notification

If we become aware of a security incident that compromises personal information, we will investigate, contain it, and notify affected individuals, customers and regulators as and when applicable law requires.

15. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

16. Contact and changes

Contact us about privacy or to exercise your rights through the contact form at agentic-spa.vercel.app/#contact or by email to info@digitalcurrensy.com, addressed to Digital Currensy Inc., Attention: Privacy. We may update this policy; we will post the new version with a new effective date and give notice of material changes where required. Effective November 2, 2026.