Legal

Privacy policy

Last updated 15 November 2026

agent-32 (a32.es) runs private cloud machines ("instances") for Claude Code and Codex. This page explains what we collect when you use the website, the console at app.a32.es and the API, why, who else handles it, and how long we keep it.

Questions or requests: privacy@a32.es.

What we collect

Your account

• Email address and sign-in identifier. You sign in with Google or with an email and password through Firebase Authentication (Google). We receive your email address and a Firebase user ID. We never see your password.
• Workspaces and roles. The workspaces you own or belong to, your role in each, and invitations you send or receive (the invited email address and role).
• API keys. A name you choose and a one-way hash of the key. We can't recover a key after showing it to you once.
• Emails we send you: billing warnings (low credit, paused or deleted instances), invitations and security notices (for example a new sign-in), and, only if you turn them on on the Account page, an instance going into error or a job you started finishing. We keep your email preferences and a copy of each email we send. We don't track whether you open emails or click their links.

Sessions and security

• Console sessions: the browser's user-agent string, IP address, and when the session started and was last used, so you can review and sign out your sessions on the Account page.
• Access log: for each instance, who did what (for example opened the terminal, ran an agent, changed files or environment variables), when, how (console, API key, instance web address) and from which IP address. Members of the workspace can see it.
• Country: if a workspace limits where it can be used from, we check the country of each request, as reported by our network provider (Cloudflare), against that list. We don't store it.
• Browsers you sign in from: the console sets a random cookie in your browser (stored by us only as a one-way hash), so we can tell you by email when someone signs in to your account from a browser it hasn't used before.
• Browser check: the console loads a script from Fingerprint on the sign-in page and the Billing page, and uses it to check the browser when you sign in and when you redeem a promo code. Loading the script already sends Fingerprint your IP address and basic browser details. A check looks at the browser's and device's configuration (for example browser version, screen, fonts and other settings), your IP address and approximate location, and stores an identifier in the browser. Fingerprint tells us an identifier for the browser (a "visitor ID"), how sure it is of it, and whether the browser looks automated or suspicious. We keep these with the time, the action (sign-in or promo code), your account and your IP address. We use them only to stop abuse: automated browsers can't sign in or redeem codes, a promo code can be redeemed once per browser, and our staff can see which accounts were used from the same browser. We don't use them for advertising or analytics. Our Fingerprint account is also used for other websites; agent-32 only accepts and keeps checks made on app.a32.es and doesn't ask Fingerprint about your visits anywhere else.

Your instances

• Files and settings you put on an instance: the contents of its disk (your code, tool logins, history), environment variables you set, and jobs and agent runs with their output. These belong to you. We don't look at them, except where needed to keep the service running or when the law requires it.
• Usage: per instance and hour, how long it was awake and what it cost.
• Job emails (optional, off by default): if you ask to be emailed when a job you started finishes, we keep that job's instance and job ID until it ends, so we can tell you its status and how long it ran. The command, prompt and output are never put in an email.

Payments

• Top-ups are paid through Stripe Checkout. Stripe collects your card details and billing information; we never see your card number. We keep the Stripe customer ID, the amount and date of each top-up and the running balance of the workspace.

What we don't do

• No advertising, no tracking or analytics cookies, no selling or sharing of personal data for marketing.
• We don't send your prompts or code to Anthropic or OpenAI. Claude Code and Codex run inside your instance under your own Anthropic or OpenAI account; what they send to those companies is governed by your agreement with them.

Why we use it

• To provide the service you signed up for (performance of a contract): accounts, sign-in, running and billing your instances, workspaces and API access.
• To keep it secure and fix problems (legitimate interest): sessions, the access log, rate limits, new sign-in alerts and abuse prevention, including the browser check. Our interest is keeping accounts and free credit from being abused by automated or duplicate accounts; the script loads only on the sign-in and Billing pages. You can block it (for example with a content blocker): signing in still works, but promo codes can't be redeemed without the check. You can also object by email (see "Your rights"): we'll delete the checks we keep for your account, and promo codes stay unavailable to you.
• To meet legal obligations: payment and accounting records.

Who else processes it

The console, the API and your instances run on servers we operate. Some of these providers may process data outside the European Economic Area; they do so under the European Commission's standard contractual clauses or an equivalent safeguard.

How long we keep it

• Console sessions: up to 30 days, or until you sign out.
• Emails we sent you: 30 days. Job email watches: until the job ends, its instance stops, or 7 days at most.
• Browser checks (visitor ID and the check's results, time, action, account, IP address): 400 days, then deleted. A promo code's redemption keeps the visitor ID it was redeemed from as long as the redemption record. Fingerprint keeps its own copy of a check for up to 30 days.
• Sign-in browser cookie (hashed): until the browser hasn't been used to sign in for 400 days.
• Access log: 180 days.
• Instances: until you delete them. If a workspace runs out of credit, its instances are paused, and deleted with their disks 7 days later unless credit is added.
• Account, workspaces and API keys: while your account exists.
• Payment and credit records: as long as accounting and tax law requires.

Cookies and browser storage

The console sets two cookies of its own: a session cookie that keeps you signed in (30 days), and a random browser cookie for new sign-in alerts (400 days). Fingerprint's script, on the sign-in and Billing pages, stores an identifier in cookies and local storage (names starting with _vid). All of these are used only for security; none is used for advertising or analytics. Firebase keeps your sign-in state in the browser tab's session storage, and the console remembers a few preferences (such as the selected workspace) in local storage. This website sets no cookies.

Your rights

You can ask us for a copy of your personal data, to correct it, to delete it (including your whole account), to restrict or object to its use, or to receive it in a portable format. Email privacy@a32.es from the address on your account. You can also complain to your data protection authority; in Spain that is the Agencia Española de Protección de Datos (aepd.es).

Changes

If we change this policy, we'll update this page and its date. For significant changes we'll also tell account holders by email.