Privacy Policy
This Privacy Policy explains how A22 (“we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you use the A22 platform at a22team.com. We are committed to protecting your privacy and handling your data responsibly, in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
1. Who We Are
A22 operates the AI Employee marketplace at a22team.com. For the purposes of GDPR and other applicable data protection laws, A22 is the data controller for personal data collected through the platform.
Contact for all data protection matters: info@a22team.com
2. Information We Collect
We collect information you provide directly, information collected automatically when you use our platform, and information from third-party services you connect.
3. Account Information
You provide directly when creating an account:
- Email address (used for login, transactional emails, and account recovery);
- Password (stored as a secure cryptographic hash — never readable by anyone);
- Full name (optional, used for personalisation);
- Legal consent record: the date and version of Terms of Service you accepted;
- Marketing preference: whether you opted in to receive product updates (optional).
Creators additionally provide:
- Business or creator name;
- PayPal payout email address;
- AI Employee listing content (name, description, tasks, pricing, integrations, support email).
4. Authentication
Authentication is handled by Supabase Auth, which stores your email and hashed password securely. When you sign in, Supabase issues a signed JWT (JSON Web Token) that is stored in your browser and used to authenticate requests to the platform API.
We never store your plaintext password. Password reset emails are sent through our email provider (Resend) using your verified domain. If you believe your account has been compromised, contact us immediately at info@a22team.com.
6. Analytics
We currently collect basic server-side usage data (pages visited, features used, timestamps, IP addresses, browser type) for the purpose of operating and improving the platform. This data is not linked to third-party advertising systems and is not sold.
We do not currently use client-side analytics scripts (e.g. Google Analytics). If this changes, we will update this policy and, where required by law, seek your consent before enabling any non-essential analytics.
7. Payment Processing
All payments are processed by PayPal. A22 does not receive, store, or transmit payment card numbers, bank account details, or PayPal passwords. When you complete a payment, you interact directly with PayPal's secure checkout interface.
A22 receives payment confirmation data from PayPal (subscription ID, amount, currency, status) via PayPal webhooks, which we use to activate or cancel your subscription and to calculate creator payouts. This data is stored in our database as part of your billing record.
8. How We Use Your Data
- To create and manage your account and provide access to the platform;
- To process payments, manage subscriptions, and route creator payouts via PayPal;
- To send transactional emails (account confirmation, subscription receipts, listing approval decisions, payment alerts);
- To send marketing emails about new AI Employees, product updates, and A22 news — only if you opted in during registration or in your account settings (you can unsubscribe at any time);
- To detect fraud, abuse, and security incidents;
- To operate, maintain, and improve the platform;
- To comply with our legal obligations.
We do not sell personal data. We do not use your data to train AI models. We do not use your data for cross-site advertising.
9. Legal Bases for Processing (GDPR)
Where GDPR applies, we rely on the following legal bases:
- Contract (Art. 6(1)(b)): processing your account information and payment data to fulfil your subscription and our obligations to you;
- Legitimate interests (Art. 6(1)(f)): security, fraud prevention, abuse detection, and platform improvement — where these interests are not overridden by your rights;
- Legal obligation (Art. 6(1)(c)): retaining billing records as required by applicable tax and accounting law;
- Consent (Art. 6(1)(a)): sending optional marketing emails (you may withdraw consent at any time from your account settings or by clicking "Unsubscribe" in any email).
10. Third-Party Providers
We share personal data only with the following categories of third parties, and only to the extent necessary to operate the platform:
- Supabase — database and authentication provider (operated on AWS, SOC 2 Type II certified). Data processing agreement (DPA) in place. Supabase Privacy Policy.
- Vercel — web hosting and serverless functions. Vercel Privacy Policy.
- PayPal — payment processing. Your payment data is governed by PayPal's User Agreement and Privacy Statement. PayPal Privacy Statement.
- Resend — transactional and marketing email delivery. Resend Privacy Policy.
- Law enforcement: we may disclose personal data when required by valid legal process (court order, subpoena, lawful request) or to protect the rights, property, or safety of A22, its users, or the public.
We do not sell, rent, or trade personal data to any third party for their own marketing purposes.
11. Data Retention
We retain personal data for as long as your account is active. After you delete your account:
- Your profile data is deleted within 30 days;
- Anonymised billing records are retained for up to 7 years as required by applicable tax and accounting law — these records do not contain personal data once anonymised;
- Server access logs are retained for up to 90 days for security and operational purposes;
- Creator listing data may be retained in anonymised form for marketplace integrity purposes.
To request account deletion, contact us at info@a22team.com.
12. Security
We implement the following technical and organisational measures to protect your data:
- In transit: TLS 1.3 encryption on all connections;
- At rest: AES-256 encryption via Supabase (AWS infrastructure);
- Database: Row-Level Security (RLS) on all Supabase tables ensures each user can only access their own data;
- HTTP headers: HSTS, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options on all pages;
- Authentication: Secure bcrypt-hashed passwords, JWT tokens with expiry, signed webhook verification;
- Access control: Principle of least privilege; production credentials managed via Vercel environment variables, not committed to code.
No method of transmission over the internet is 100% secure. While we use best practices to protect your data, we cannot guarantee absolute security. In the event of a breach, we will notify you as required by applicable law.
13. Your Rights
Regardless of your location, you have the right to:
- Access: request a copy of the personal data we hold about you;
- Correction: request correction of inaccurate or incomplete data;
- Deletion: request deletion of your personal data (subject to legal retention requirements);
- Data portability: receive your data in a structured, machine-readable format;
- Marketing opt-out: unsubscribe from marketing emails at any time from your account settings or by clicking "Unsubscribe" in any email we send.
To exercise any of these rights, contact us at info@a22team.com. We respond within 30 days (or 45 days for California residents).
14. EU / EEA Users — Additional Rights
If you are located in the European Union or European Economic Area, you have additional rights under GDPR:
- Right to object (Art. 21): You may object at any time to processing based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
- Right to restrict processing (Art. 18): You may request restriction of processing in certain circumstances.
- Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint (Art. 77): You have the right to lodge a complaint with your national data protection authority (DPA). A list of EU DPAs is available at edpb.europa.eu.
For GDPR purposes, A22 acts as data controller for personal data collected through a22team.com. Contact for data protection matters: info@a22team.com.
15. California Residents — CCPA / CPRA
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know: the categories and specific pieces of personal information we collect, use, and disclose;
- Right to delete: request deletion of your personal information, subject to certain exceptions;
- Right to correct: request correction of inaccurate personal information;
- Right to opt out of sale or sharing: we do not sell or share personal information for cross-context behavioural advertising. No opt-out is required;
- Right to non-discrimination: we will not discriminate against you for exercising your rights.
To exercise these rights, contact info@a22team.com with "California Privacy Rights Request" in the subject line. We respond within 45 days.
16. International Data Transfers
A22 operates globally. Your personal data may be transferred to and processed in countries outside your home country, including the United States, where our infrastructure providers (Supabase on AWS, Vercel) operate.
These transfers are carried out under appropriate safeguards. For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission. You can request information about the specific safeguards applicable to your data by contacting us at info@a22team.com.
17. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the applicable supervisory authority within 72 hours of becoming aware of the breach (where required by applicable law). We will notify affected individuals without undue delay where required by law.
To report a suspected security vulnerability or data breach, contact us immediately at info@a22team.com.
18. Children
The platform is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, contact us immediately at info@a22team.com and we will delete it promptly.
19. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the effective date and version number above. Your continued use of the platform after any change constitutes your acknowledgment of the updated policy.
For material changes that require your consent (e.g. new uses of your data), we will seek your explicit consent before the changes take effect.
20. Contact
For questions, requests, or complaints about this Privacy Policy or our data practices, contact us at:
A22 — Data Controller
info@a22team.com
a22team.com
We aim to respond to all privacy-related enquiries within 30 days.