Privacy Policy
- Status
- Effective
- Last updated
This Policy explains how Varmorphic, Inc. collects, uses, discloses, and retains personal data in connection with AgentMuxer.
Definitions
Varmorphic operates AgentMuxer under the Amorphic Labs name. Customer Content means information submitted to, accessed through, or returned through AgentMuxer, including searches, call inputs, provider responses, outcome reports, support communications, and provider submissions. Usage Data means information about use and operation of the service and may include information derived from Customer Content as needed to provide, secure, support, analyze, troubleshoot, and improve AgentMuxer.
Scope and our role
This Policy applies to the AgentMuxer website, accounts, marketplace, managed gateway, provider submissions, and related communications and support. Varmorphic acts as a controller or business for account, billing, security, Usage Data, support, and marketing information. When a Customer directs us to process call content on its behalf, Varmorphic generally acts as that Customer's processor or service provider. A selected marketplace provider may independently process call content under its own terms and privacy notice.
Account and organization data
We process account data such as name, email address, account identifiers, organization and membership information, role, authentication events, preferences, and communications. AgentMuxer also maintains information needed to manage sessions, billing ownership, access credentials, permissions, agent budgets, and revocation.
Billing and commercial data
We process credit balances, top-up selections, fees, transaction identifiers, payment status, disputes, refunds required by law, and related accounting records. Our payment processor handles payment instruments. Varmorphic receives transaction status, amount, and account references needed to credit balances and manage disputes, but does not store complete payment-card numbers.
Marketplace and provider data
We process marketplace searches, offering and provider records, interface manifests, prices, availability and verification evidence, resolution handles, policy decisions, and coarse client-reported outcomes. Providers may submit contact information, endpoint URLs, task categories, pricing, interface details, data-handling statements, and ownership claims. Seller-form drafts remain in the browser until explicitly submitted.
Marketplace call data
The request payload for an explicitly selected marketplace call passes through AgentMuxer's managed gateway to the chosen provider, and the provider's response passes back through the gateway. AgentMuxer does not intercept unrelated MCP or application traffic. We process request fingerprints, idempotency keys, inputs, responses, timestamps, provider status, cost, receipts, errors, and outcome reports as needed to fulfil calls, prevent duplicate execution or billing, resolve disputes, and show account history.
Technical and analytics data
We may process IP address, approximate location, timestamps, browser and device information, referring pages, interactions with the service, attribution information, preferences, request identifiers, performance, errors, diagnostics, and security signals. We and our service providers may use cookies, local storage, and similar technologies for authentication, security, preferences, analytics, and service improvement.
Sources of data
We receive data directly from Customers, users, agents, and providers; from identity and payment providers; from marketplace providers a Customer selects; automatically from the service, devices, logs, cookies, and similar technologies; from public sources used to build or verify marketplace records; and from service providers that help us operate, secure, support, analyze, and market AgentMuxer.
How we use data
We use personal data to authenticate users and administer accounts and organizations; manage credentials, permissions, budgets, and policy; provide marketplace discovery, fulfilment, receipts, and account history; process purchases and disputes; review provider submissions; personalize, analyze, develop, test, and improve the service; monitor reliability and security; prevent abuse and investigate incidents; communicate about accounts, support, marketing where permitted, and relevant service updates; comply with law; and establish, exercise, or defend legal claims.
How we disclose data
We disclose call content to the marketplace provider selected by the Customer or its agent. We also disclose data to service providers that help operate, secure, analyze, support, communicate about, and process payments for AgentMuxer; to a Customer's organization administrators and authorized users; to professional advisers and parties to a financing, merger, reorganization, or sale under appropriate protections; and when reasonably necessary to comply with law, protect rights or safety, investigate fraud or security incidents, or enforce agreements.
Sale, advertising, and training
We do not currently sell personal data or share it for cross-context behavioral advertising. If that practice changes, we will update this Policy and provide any choices required by law before the change applies. We do not use Customer Content to train or fine-tune Varmorphic models or general-purpose models unless the Customer or, for an organizational account, an authorized Customer administrator affirmatively opts in after receiving notice of the content, purpose, and withdrawal process. We may otherwise use Customer Content as described in this Policy, and may use Usage Data, feedback, and reasonably de-identified data, to develop and improve AgentMuxer. We will not attempt to reidentify de-identified data.
Cookies and similar technologies
AgentMuxer uses essential cookies and similar storage for authentication, security, session continuity, and user preferences. If optional analytics or performance storage is enabled, we will provide preference or consent controls where applicable law requires them. Browser settings can manage local storage and cookies, but blocking essential cookies may prevent sign-in or other service functions.
Retention
We retain data for the period reasonably necessary to provide AgentMuxer, maintain security and continuity, satisfy accounting and legal duties, resolve disputes, and enforce agreements. The period depends on the data's nature, sensitivity, contractual requirements, provider configuration, and whether the Customer has an active account. Account deletion does not necessarily erase all information immediately; limited records may remain in backups, append-only financial or security logs, legal holds, or provider systems. We may retain de-identified data that no longer identifies a person or Customer.
Security
We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of AgentMuxer and the information we process. No system is completely secure. Customers are responsible for protecting accounts, configuring agents and budgets, choosing what data to send, and notifying us of suspected compromise.
International processing
Varmorphic currently markets AgentMuxer to United States Customers, but Varmorphic and its providers may process data in the United States and other countries with different privacy laws. Where required, we use contractual or other recognized safeguards for international transfers. Launching in a new jurisdiction may require additional notices, agreements, consent mechanisms, or local representatives.
Privacy rights and requests
Depending on location and applicable law, individuals may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent, and to appeal or complain to a privacy authority. Send requests to founders@amorphiclabs.com. We may verify identity and authority before responding and will not discriminate against an individual for exercising an applicable right. For Customer-controlled call content, we may refer the request to the relevant Customer or assist that Customer under our contract.
California notice
This section does not state that Varmorphic currently meets the thresholds that make the California Consumer Privacy Act applicable. If it applies, the data described above generally includes identifiers and account information; commercial information; internet, device, and network activity; professional information; approximate location; inferences used for security or analytics; and account credentials or other sensitive personal information used only for permitted operational purposes. We do not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer characteristics. Applicable California residents may request to know, access, correct, or delete personal information and may exercise those rights without discriminatory treatment.
Children and restricted data
AgentMuxer is for people aged 18 or older and is not directed to children. Customers must not submit personal data about children, protected health information, complete payment-card data, government identification numbers, biometric identifiers or templates, or other regulated sensitive data unless Varmorphic has approved the use in writing and the parties have established appropriate legal and technical safeguards.
Changes to this Policy
We may update this Policy prospectively as AgentMuxer and the law evolve. Routine product and operational changes that fit the practices described here do not require a new notice. We will post an updated Policy with a new date and provide reasonable additional notice of material changes where required by law. We will not rely on a silent or retroactive change to apply a materially new purpose to previously collected Customer Content when notice or consent is required.
Contact us
Questions and privacy requests may be sent to Varmorphic, Inc., 1010 16th Street, Apt. 324, San Francisco, CA 94107, United States, or founders@amorphiclabs.com.