Privacy.
Version 1.0 · Effective 4 September 2026
Applies to: www.teamasta.com and the Team Asta service provided through it. Version: 1.0 · Effective: 4 September 2026
This notice explains what personal data we process when you use Team Asta, why, on what legal basis, who else sees it and what you can do about it. It is the privacy notice referred to in clause 13.3 of the Team Asta Terms and Conditions.
1. The two roles — read this first
Team Asta processes personal data in two different capacities, and your rights run against a different organisation depending on which one applies.
1.1 We are the controller for personal data about the people who hold Team Asta accounts — account administration, security, support, billing and service communication. Sections 3 to 11 describe that processing. If you have an Team Asta account, this notice is addressed to you.
1.2 We are a processor for everything a customer puts into their projects: uploaded documents, mission definitions, contact lists, and the answers Participants give. The customer — the organisation whose account holds the project — is the controller of that data. They decide who is contacted, what is asked and why. We process it only on their instructions, under our Data Processing Agreement (available on request), referred to in clause 13.2 of the Terms.
1.3 If you answered an Asta interview link and want to know why you were contacted, what happens to your answer, or want it deleted — the organisation that sent you the link is the one who can tell you, and the one who must act on your request. Section 12 explains how to find them, and what we will do if you come to us instead.
2. Who we are
Agentic Agency ApS
Gammel Kongevej 152 B, 3.
1850 Frederiksberg C
Denmark
CVR no. 46326458
Full company details and representation are available on request.
Privacy contact: privacy@agenticagency.dev
We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR: our core activities do not consist of large-scale regular and systematic monitoring of data subjects, nor of large-scale processing of special-category data.
3. What we process as controller, and why
3.1 Account data
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Identity and credentials | Name, email address, password hash (we never hold the password itself) | Creating and running your account, signing you in | Art. 6(1)(b) — performance of the contract |
| Email verification and password reset | Single-use tokens, their expiry and whether they have been used | Proving you control the address; letting you recover access | Art. 6(1)(b) |
| Session state | A signed session cookie and a server-side session version that lets us revoke every session at once | Keeping you signed in; cutting off sessions after a password reset | Art. 6(1)(b) and Art. 6(1)(f) — security |
| Legal acceptance | Which version of the Terms and of this notice you accepted, and when | Proving the contract was accepted; meeting our accountability duty | Art. 6(1)(c) and Art. 6(1)(f) |
3.2 Usage and operational data
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Service metering | Per-call token counts for the AI models, tied to a project and a session | Understanding cost, detecting misconfiguration and abuse, planning pricing | Art. 6(1)(f) — our legitimate interest in running a viable service |
| Server logs | Request paths, status codes, timestamps, error traces | Keeping the service up, diagnosing faults, security | Art. 6(1)(f) |
| Support correspondence | What you write to us and our reply | Answering you | Art. 6(1)(b) and Art. 6(1)(f) |
We do not use analytics or advertising trackers, and we do not profile you.
3.3 What we do not do
- We do not sell personal data, and we do not share it for anyone else's marketing.
- We do not use your content, your Participants' answers or your transcripts to train AI models, and our model providers are contractually prohibited from doing so (clause 12.3 of the Terms).
- We take no automated decision producing legal or similarly significant effects for you within the meaning of Article 22 GDPR.
4. What we process as processor, on our customers' instructions
For completeness, because it is the bulk of what the system holds:
- Project files — documents customers upload or Team Asta writes, stored in our EU hosting.
- Contacts — name, email address, and optionally organisation and a free-text note, entered by the customer about the people they want an Agent to contact.
- Interview links — the mission goal, the expected result, an expiry, and a hash of the link token. The token itself is never stored.
- Conversations — the full transcript of every chat and every voice interview, typed and spoken, kept as part of the customer's project.
The customer is the controller of all of it. We access it only to run the service, to fix a fault, or where the customer asks us to. Our staff do not read project content as a matter of routine.
5. AI models and voice
5.1 Team Asta works by sending text to a large language model. When you or a Participant writes a message, the message, the relevant project context and the conversation so far are sent to an AI model provider to produce the reply. The provider acts as our processor and is contractually prohibited from using the content for training.
5.2 When you speak to Asta on the phone, or an interview happens by voice, the audio is processed in real time by our voice and telephony providers and an AI model provider. Audio therefore leaves your device. We do not record call audio: Asta keeps a written note and transcript of the call, held in the customer's project as described in section 4.
5.3 Participants are told they are talking to an AI system before the conversation starts. This is required by Article 50(1) of Regulation (EU) 2024/1689 (the AI Act), which has applied since 2 August 2026, and is promised in clause 8.3 of the Terms. Asta never presents herself as a named human being.
5.4 AI output can be wrong. Nothing Team Asta produces should be relied on as fact, advice or a decision without a human checking it.
6. Who else sees the data
We use the following categories of processors. Each processes personal data only on our instructions and under a written data processing agreement.
| Category | Purpose | Where it processes |
|---|---|---|
| Cloud hosting | The servers Team Asta runs on and the storage that holds account data, project files, call notes and transcripts | EU |
| AI model providers | Producing replies, sorting and drafting mail, interviews, summaries and extraction | United States |
| Voice and telephony providers | Phone numbers, connecting calls, and real-time speech for calls and voice interviews | United States |
| Messaging providers | Text and iMessage conversations with Asta | United States |
| Email delivery | Transactional email — verification, password reset, invitations, reminders, notifications | EU |
| Connected services you choose to link | Your mail or accounting system (for example Gmail or e-conomic), used only where you connect it | EU and United States, depending on the service |
| Website hosting | Serving www.teamasta.com — visitor IP addresses and request logs | EU and United States |
A list of our sub-processors is available on request at privacy@agenticagency.dev.
We will also disclose personal data where the law requires it, and to our professional advisers under a duty of confidence. We do not otherwise pass it to anyone.
Transfers outside the EU/EEA. Some of our processors handle personal data in the United States. Those transfers are made under Article 46 GDPR safeguards — the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework where the provider is certified. A copy of the relevant mechanism is available on request from privacy@agenticagency.dev.
7. Cookies
Team Asta sets one cookie: a signed session cookie that keeps you logged in. It is strictly necessary for a service you asked for, so no consent banner is required under section 9 of the Danish Cookie Order (cookiebekendtgørelsen) or Article 5(3) of Directive 2002/58/EC.
We set no analytics, advertising or third-party tracking cookies. The public interview links set no cookie at all — a Participant needs no account and gets none.
8. How long we keep things
Team Asta has no automated deletion yet. We state this plainly rather than quote periods we do not yet enforce:
- Account data is kept while the account exists.
- Project content, contacts, interview links and conversation transcripts are kept until the customer deletes them or asks us to. There is no automatic expiry. An expired or closed interview link stops working, but its record and its transcript remain in the customer's project.
- Service metering and server logs are kept for operational and security purposes.
Until enforced retention periods are in place, if you want something removed, ask — see section 10 — and we will remove it.
9. How we protect it
Traffic is encrypted in transit (TLS). Passwords are stored only as hashes. Interview link tokens are stored only as hashes, so a database copy does not yield working links. Sessions can be revoked centrally. Access to production is limited to the people who need it. Data is backed up regularly.
Clause 14 of the Terms sets out our security commitments, and clause 13.5 our breach notification duty — without undue delay and in any event within 48 hours of becoming aware.
10. Your rights
Where we are the controller (section 1.1), you have the right to:
- access the personal data we hold about you, and get a copy;
- rectify it if it is wrong or incomplete;
- erase it, where one of the grounds in Article 17 applies;
- restrict our processing, in the circumstances in Article 18;
- portability — receive the data you gave us in a structured, machine-readable form, and have it sent to another controller where technically feasible;
- object to processing we base on legitimate interests (section 3.2), on grounds relating to your particular situation;
- withdraw consent, where we rely on consent — which, as section 3 shows, we currently do not.
Write to privacy@agenticagency.dev. We answer within one month, and will tell you if we need the extension Article 12(3) allows. We may ask you to confirm who you are before we act, so we do not disclose your data to someone else.
11. Complaints
If you think we have handled your personal data wrongly, tell us first — we would rather fix it. You also have the right to complain to a supervisory authority, in the EU/EEA country where you live, work, or where you think the problem happened.
Ours is:
Datatilsynet (the Danish Data Protection Agency)
Carl Jacobsens Vej 35, 2500 Valby, Denmark
+45 33 19 32 00 · dt@datatilsynet.dk · datatilsynet.dk
12. If you were contacted by Asta
You received a link because an organisation using Team Asta put your name and email address into their project and asked an Agent to reach you. That organisation is the controller. They chose to contact you, they decide what happens to your answer, and your rights under section 10 run against them, not against us.
The interview page names the organisation and states the purpose before the conversation starts. If it does not, or you cannot work out who is asking, write to privacy@agenticagency.dev with the link and we will identify the customer and pass your request on without undue delay. We will act on it ourselves where the customer instructs us to, and we will tell you what happened.
You are never obliged to answer. The interview page carries a decline option, and declining ends the link.
13. Changes
We will update this notice when the service changes. The version number and effective date at the top always identify the current text, and each published version is tied to the release it shipped in, so it is always possible to establish which text applied when.
Where a change materially affects how we process your personal data, we will tell account holders by email before it takes effect.
14. Contact
Agentic Agency ApS · privacy@agenticagency.dev
Gammel Kongevej 152 B, 3., 1850 Frederiksberg C, Denmark · CVR 46326458