What we hold, and why.
The Agency is operated by Symbaiotic Consultancy F.Z.E, a free zone establishment in the United Arab Emirates, which is the controller of your personal data. Contact: control@mail.theagency.global.
What we collect
To give you a number: your email address, verified once, and a passkey public key if you create one. The passkey's private half never leaves your device.
Your file, all of it optional except the codename: full name, codename, employment status, company or project, website, monthly income band, the places you call bases (resolved to a place name, country and place-level coordinates), WhatsApp number, one line on what you are designing, and a voice note if you record one, together with its transcript.
Referrals and usage: which agent's link you arrived from, which episode link you came through, and minimal, cookieless usage events (page views, sign-up steps) with a coarse device class. We do not use third-party analytics or advertising trackers.
What is public
Your codename, your agent number, your clearance state, the month you joined, your primary base, the flags of your bases and your referral count appear on your pass and your public card page. Everything else in your file is private to you and to the operator.
Why we use it
To run the club: assign and keep your number, show your pass, order the waitlist for intakes, send you the link to sign in, send briefings if you opted in, host events where agents are, and let apps you choose sign you in with your pass. Legal bases: performance of our terms with you, your consent where we ask for it (briefings, WhatsApp, voice note, third-party apps), and our legitimate interest in keeping the club safe.
Sign in with The Agency
When you allow an app to sign you in, we share only the scopes shown on the consent screen: your identity, your pass, your bases or your email. You can deny any request, and consent can be reviewed from HQ. Full name, WhatsApp number and income are never shared with any app.
Who processes it for us
Supabase (database and authentication, EU Ireland), Vercel (hosting, EU Dublin functions), Resend (email, EU Ireland), Google (place lookup only, no personal data sent beyond the text you type), Groq (voice note transcription; audio is processed and not retained by Groq). Each acts under a data processing agreement.
How long
For as long as you hold a number. Unverified sign-ups are removed after 30 days. If you ask us to remove you, we delete your file, your pass and your voice notes; your number is retired and never reissued. Minimal records of the referral you came through may be retained in anonymised form.
Your rights
Access, correction, deletion, restriction, portability and objection, under the UAE Personal Data Protection Law, and the UK and EU GDPR where they apply to you. You can edit your file from HQ at any time. For anything else, write to control@mail.theagency.global and we answer within 30 days. You may also complain to your local data protection authority.
Transfers
Data is stored in the European Union. Where it moves outside the UK or EU, including to the UAE, it does so under standard contractual clauses or an equivalent safeguard.
Cookies
Only what is needed to keep you signed in and to remember the referral or episode link you arrived from, for up to 30 days. No advertising cookies.
Changes
We will post changes here and date them. Material changes are announced in a briefing.