Privacy Policy
MyAgent Workforce Management Platform
Effective date: 2026-10-19 Version: 1.3 Status: PUBLIC. Published without authentication. This is the only document in this folder that is public.
1. Who we are
MyAgent is operated by 3D Steel Labs s.r.o., Chvalín 79, 413 01 Nové Dvory, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Ústí nad Labem, file ref. C 48241 ("we", "us", the "Operator").
For any question about this policy or about your personal data, contact privacy@3dsteellabs.cz.
2. Who this policy is for
MyAgent is a business platform used by organisations ("Tenants") to manage their workforce, timesheets, projects and documents. Most personal data in MyAgent is entered by a Tenant about its own people, and that Tenant is the controller of it — if you are an employee, worker, customer representative or agency contact using MyAgent, the organisation that gave you your account decides what data it holds about you and why, and is your first point of contact.
This policy describes the processing for which we are the controller: what we do to operate, maintain and improve the Platform, and the optional integrations you may choose to connect.
3. What we process, why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Account data (name, email, role, language, timezone) and the content you enter | To operate the Platform and provide the service to your organisation | Our legitimate interests in operating and supporting the Platform (Art. 6(1)(f)) |
| Selected free-text fields, where translation is requested | To display content in your chosen language | Legitimate interests (Art. 6(1)(f)) |
| Recipient name and email address for system messages | To deliver password resets and notifications | Legitimate interests (Art. 6(1)(f)) |
| Where an organisation has switched on the optional AI features: document templates, material an administrator attaches, and the records an administrator's request requires — see §4c | To analyse templates, to help an administrator draft documents and emails, and to answer an administrator's questions about their organisation's records | Legitimate interests (Art. 6(1)(f)) |
| The name, email address, phone number and note of a person who books an appointment — see §4d | To make the booking, confirm it, remind them of it and let them change or cancel it | Legitimate interests (Art. 6(1)(f)); the organisation they book with relies on its own basis |
| Error reports: the signed-in user, the page and the data a failed request carried | To find and fix faults | Legitimate interests (Art. 6(1)(f)) |
| Usage records: which pages and functions are opened, by which role, in which Tenant, and whether the request succeeded | To develop and maintain the Platform | Legitimate interests (Art. 6(1)(f)) |
| Calendar data, where you connect an external calendar — see §4 | To synchronise your appointments with the Platform | Your consent (Art. 6(1)(a)) |
| The name and email address of a person invited to a meeting, and the meeting's details | To send them the invitation, and any later update or cancellation for the same meeting | Legitimate interests (Art. 6(1)(f)) |
| Your own calendar, where you connect a phone or desktop calendar application — see §4a | To show your appointments and reminders on your own device | Legitimate interests (Art. 6(1)(f)) |
We do not record page addresses, IP addresses or text you enter in our usage records, we do not sell personal data, and we do not use it for advertising or automated decision-making with legal effect.
4. Connecting an external calendar (Google and Microsoft)
This applies only if you choose to connect a calendar account. Nothing happens until you do, and you can disconnect at any time.
What we access. With your permission we read and write the events on the calendars you select, and read the list of your calendars so you can choose which ones to synchronise. We request the narrowest permissions each provider offers. At Google that is the ability to read and write events, not to administer or share your calendars. Microsoft offers no events-only permission: the one it requires to read and write events also allows an application to create, delete and share calendars. We do none of that, but you will see the wider permission named on Microsoft's consent screen.
Why. To show your existing commitments inside MyAgent, and to write appointments you make in MyAgent back to your own calendar so they appear on your other devices.
What we store. The events on the calendars you select — their titles, times, locations, descriptions and participants, including each participant's response and who organised the meeting — together with the identifiers and synchronisation state needed to keep both sides consistent, and an access credential held in encrypted form.
Participants. Where you organise a meeting in MyAgent, the guest list you enter is sent to Google along with the event. It is never sent to Microsoft, which would email every guest itself; but if you edit, in MyAgent, a meeting that came from your Outlook calendar and has guests, Microsoft emails those guests an update, which we cannot prevent. For a meeting somebody else organised, we mirror the guest list and never rewrite it. If you ask us to, we will also email an invitation to each guest — see §4b.
How long. Until you disconnect the calendar or your account is closed. Disconnecting stops synchronisation at once and deletes the stored credential and the synchronised events we hold for that connection. At Google it also withdraws our access. Microsoft gives applications no way to withdraw a permission themselves, so after disconnecting a Microsoft account, remove MyAgent from the apps connected to your Microsoft account as well; we tell you where when you disconnect.
Google Limited Use. MyAgent's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalised artificial-intelligence or machine-learning models, we do not transfer it except as needed to provide or improve user-facing features of MyAgent — including, as §4c describes, answering your own questions about your calendar — or as required by law, and we do not sell it or use it for advertising.
We name Google LLC and Microsoft Corporation here because you connect your own account with them directly and knowingly; they are not otherwise recipients of your data. If you are in the European Economic Area, the controller of your Microsoft account is Microsoft Ireland Operations Limited.
4a. Connecting a phone or desktop calendar application
Separately from §4, you may connect a calendar application on your own device directly to MyAgent, so your MyAgent calendar appears alongside your others.
To do so you create a device password in the Platform. It is shown to you once, we keep only a one-way hash of it, you can revoke it at any time for that device alone, and it is not your MyAgent password — it cannot be used to sign in and reaches nothing but your own calendar.
Your device receives your own events and the calendar reminders MyAgent already shows you, in the categories you choose. It can add and change your own events; it can never change a reminder derived from another record, which is served read-only. No third party is involved — your device talks to our server directly, and we send nothing to Apple, Google, Microsoft or any other device maker for this. Revoking a device password stops further access, but it cannot remove what your device has already stored.
4b. Meeting invitations
If you organise a meeting in MyAgent and ask us to invite your guests, we email each of them an invitation from our system address, in your organisation's name. It carries the meeting's details, your address as the reply address, and — as every calendar invitation does — the addresses of the other guests, so each recipient's calendar can show who else is coming.
We never send an invitation unless you ask for it. Connecting a calendar, importing an event, or creating one on your phone invites nobody. We do not add recipients of our own, and we do not use a guest's address for anything beyond that meeting and its later updates or cancellation.
If you have received an invitation from MyAgent and would rather not have, reply to the person who sent it — their own address is on the message — or contact us at privacy@3dsteellabs.cz. We hold your address because the organiser entered it; the organisation they work for is the controller of that meeting's details.
4c. Artificial intelligence, and the data we take from your calendar
We do not use data from your Google or Microsoft account to build, train, improve or evaluate any artificial intelligence or machine learning model — our own or anyone else's — and we do not transfer it to any third party that would. This applies to the data exactly as we receive it, and equally to anything aggregated, anonymised, summarised or otherwise derived from it.
What our AI features are. An organisation may switch on optional AI features for its administrators. Some help write a document or an email. One, the Assistant, answers an administrator's questions about their organisation's records — its customers, projects, invoices, hours, documents and correspondence — and can prepare changes that the administrator then reviews and applies. Every AI feature acts for one administrator at a time and can read only what that administrator could open themselves.
Where your calendar comes in. If you are an administrator, your organisation has the Assistant, and you have connected a Google or Microsoft calendar, the events imported from it — with their descriptions and guest lists — are part of your calendar in MyAgent, and your own Assistant can read them when you ask it about your calendar. They are read to answer you and for nothing else. Specifically:
- Only you can cause this for your calendar as a whole, and only your own Assistant reads an imported event's description and guest list. No other AI feature and no automated process reads your calendar.
- One exception, which follows from how meetings work: a colleague in your organisation who is a guest on a meeting imported from your calendar sees that meeting in their own MyAgent calendar, and their Assistant can list its title and time when they ask about their calendar.
- It happens only in answer to a request a person makes in the Assistant, and the answer is shown to that person.
- Nothing is read if you do not connect a calendar, if your organisation does not have the Assistant, or if you do not ask.
Our AI provider. When an AI feature is used, what it reads is sent to Anthropic, PBC (United States), which provides the Claude API, acting as our processor. We call that service directly — not through any aggregator, gateway, model hub or reseller. Anthropic does not use what we send to train its models, keeps it for 30 days for safety and security purposes and then deletes it, and may keep content its automated systems flag for longer. No self-hosted or offline model is used, and no other AI or machine-learning provider is integrated into MyAgent. A conversation with the Assistant, including what it read, is kept for you in MyAgent and deleted 12 months after its last activity, or 30 days after you delete it.
Nothing else from your calendar leaves. Data we receive from your Google or Microsoft calendar is stored in your organisation's own area of our database. Apart from the Assistant reading it for you, it is used only to display and synchronise your calendar. It is not sent to our email provider, our translation provider, or anyone else. Where you ask us to email a meeting invitation (§4b), we can only do so for a meeting created in MyAgent — an event that came from your calendar cannot generate an email from us.
We do not sell Google or Microsoft user data, do not use it for advertising, and do not use it for any purpose other than providing the calendar features you connected it for and answering your own questions about it. This is the Limited Use commitment in §4, restated here because it is the question most worth answering directly.
4d. Booking an appointment
An organisation using MyAgent may give you a link to book an appointment with one of its people. When you book, you give your name, email address, the time you chose, a note if you wish, and a phone number where the organisation asks for one. The organisation you book with is the controller of your booking; we operate the page for it. The times offered are the free times in that person's calendar; nothing about their other appointments is shown to you.
We use your details to record the booking in that person's calendar — which may be connected to their Google or Microsoft calendar — and to email you a confirmation with a calendar file and a link to cancel, and, where the organisation has set one up, a reminder before the appointment. Those emails come from our system address, with the person you booked with as the reply address. If you cancel, you may give a reason. Where the organisation uses MyAgent's sales features, your booking may also be recorded as an inquiry for it to follow up, or added to one it already has for your email address. The organisation's administrators may use the AI features in §4c, and may read your booking and note in another language through our translation provider.
You can cancel from the link in your confirmation. For anything else about your booking, contact the organisation you booked with, or us at privacy@3dsteellabs.cz.
5. Who receives personal data
Beyond your own organisation and its Account holders, personal data may be disclosed to service providers who process it on our behalf, under written data processing agreements and only on our instructions:
- a machine-translation provider established in the European Union, which deletes submitted text immediately after translation;
- an email delivery provider established in the United States, which receives recipient names, email addresses and the content of system messages in order to deliver them, holds them on European infrastructure, and keeps its delivery logs for one day;
- an artificial-intelligence provider established in the United States, which receives, where an organisation has switched on the optional AI features, document templates, material attached by an administrator, and the records an administrator's request requires — including, for the Assistant, the administrator's own calendar (§4c) — retains inputs and outputs for 30 days, and does not use them to train its models;
- a hosting provider established in the Czech Republic, which supplies infrastructure and has no logical access to application data;
- a storage provider established in Germany, which holds the files stored in MyAgent in encrypted form, the key being held by us, and our off-site backups and error reports.
Your browser receives MyAgent's notifications, if you allow them, through the push service of its maker (Google, Apple or Mozilla); the content is end-to-end encrypted and readable only on your device. Our pages load their typeface from Google Fonts, and our PDF viewer from Cloudflare's public library service, which therefore receive your network address and browser identification — never what you type or view.
Meeting invitations (§4b) and booking confirmations (§4d) are delivered by the same email provider. Our usage records (§3), and the device connection described in §4a, involve no service provider at all and never leave our own systems.
We may also disclose personal data where required by law or to establish, exercise or defend legal claims.
A complete and current list of our processors, naming each one, is available to Tenants on request at privacy@3dsteellabs.cz.
6. Transfers outside the EU/EEA
Two of the service providers in §5 are established in the United States: the artificial-intelligence provider, and the email delivery provider — which, although it holds the data on European infrastructure, is a US company. Both transfers are governed by Standard Contractual Clauses adopted by the European Commission, and the email delivery provider is additionally covered by the EU–US Data Privacy Framework, in accordance with Chapter V GDPR. The storage provider is in Germany and no transfer arises. Where you connect a Google or Microsoft calendar (§4), that provider may process data outside the EU/EEA under its own safeguards; both Google LLC and Microsoft Corporation are certified under the EU–US Data Privacy Framework.
6a. How we protect your data
These are the measures we actually operate, described so you can judge them rather than be reassured by them. They apply to all personal data in MyAgent, and every one of them applies to the data we access from a connected calendar account.
In transit. Everything travels over an encrypted connection (HTTPS/TLS). In production we instruct browsers to refuse an unencrypted connection to us for a year at a time, including on our subdomains. Every call we make to Google is likewise over an encrypted connection.
Credentials, at rest. The access credential we hold for a connected calendar account is encrypted in our database, and is never displayed anywhere in the product, never included in any export, and deliberately excluded from our internal change history — so no readable copy of it accumulates anywhere. Account passwords are stored as one-way hashes and cannot be recovered by us or by anyone else. A password you create to connect a phone or desktop calendar application (§4a) is likewise stored only as a one-way hash, is shown to you exactly once, and can be revoked for that one device without affecting anything else.
Separation between organisations. Each customer organisation's data lives in its own separate area of the database rather than mixed into shared tables. A request is resolved to one organisation before any data is read, so one organisation's people cannot reach another's records.
Access control inside an organisation. Access follows a person's role, and the calendar data we receive from your account is narrower still: it is visible to you, and a meeting is also visible to a colleague in your organisation who is a guest on it — as it would be in any shared calendar. Nobody else in your organisation can see it, and nobody but you can connect, disconnect or inspect your calendar connection. Your own Assistant can read it if you ask; a guest colleague's Assistant can list that one meeting's title and time (§4c). No administrator, no colleague and no customer contact in your organisation can see the events imported from your calendar, and none of them can connect, disconnect or inspect your calendar connection. Our own staff do not access customer data except where a support request requires it, and such access is recorded.
Least privilege. We ask Google for the narrowest permissions the feature can work with — the ability to read and write events, and to read the names of your calendars so you can choose which to synchronise. We do not request the ability to administer or share your Google calendars, and we cannot do either. Microsoft offers no permission that narrow (§4); we use the one it offers only to read and write events.
Change history. Changes to records are recorded with who made them and when, so a question about what happened to a piece of data has an answer. Credentials are excluded from this record by design.
Backups. Backups are taken daily, are encrypted before they leave our systems under a key the backup provider never receives, and are kept to a defined retention schedule rather than indefinitely. Database backups are held off-site with a different provider from the one hosting the service. Stored files and their backup copy are with the same provider (§5), in separate systems; we intend to move the backup copy to a different provider. Restoring from them has been tested rather than assumed.
Deletion. Disconnecting your calendar destroys the stored credential and deletes the events we imported through that connection, and at Google revokes our access (§4). AI conversations are deleted 12 months after their last activity (§4c). Revoking a device password (§4a) ends that device's access immediately. Usage records are deleted after 90 days.
Boundaries we keep. We do not sell personal data, do not use it for advertising, do not use it for automated decisions with legal effect, and — as set out in §4c — do not use it to train artificial intelligence models or pass it to anyone who would.
Where we are not there yet. Two-step verification is not yet available for MyAgent accounts, and our database files are not separately encrypted beyond the credential encryption and backup encryption described above. We would rather tell you that than imply protections we do not operate.
If something goes wrong. If a breach of personal data occurs that is likely to result in a risk to people's rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will inform affected people directly where the risk to them is high.
7. How long we keep it
A device password (§4a) is kept until you revoke it or your account is closed. A guest's details on a meeting are kept for as long as the meeting record is. Account data and content are kept for as long as your organisation's use of the Platform continues, and are deleted or returned on termination in accordance with our agreement with it. Usage records are deleted after 90 days. Text sent for translation is deleted immediately after translation. Our email delivery provider keeps its delivery logs for one day. Material sent to the AI provider is retained by it for 30 days; a conversation with an AI feature is kept in MyAgent for 12 months after its last activity. Calendar data is kept until you disconnect (§4). A booking (§4d) is kept by the organisation you booked with as part of its records. Error reports are deleted after 30 days.
8. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. Where processing rests on your consent — as with the calendar integration — you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
Because most data in MyAgent is controlled by the organisation that gave you your account, please direct requests to that organisation first; we will give it the technical assistance it needs. For the processing described in this policy for which we are the controller, contact us directly at privacy@3dsteellabs.cz.
9. Complaints
You may lodge a complaint with the Office for Personal Data Protection of the Czech Republic (Úřad pro ochranu osobních údajů, ÚOOÚ), or with the supervisory authority of your habitual residence.
10. Changes to this policy
We will update this policy when our processing changes, and will publish the new version here with a new effective date. Material changes affecting Tenants are notified to them separately.
11. Version history
| Version | Date | Changes |
|---|---|---|
| 1.0 | 2026-08-31 | Initial public version. Describes recipients by category rather than by name (Art. 13(1)(e) GDPR); Google and Microsoft are named in §4 because the integration is one the data subject connects directly. |
| 1.1 | 2026-09-03 | Added §4a (connecting a phone or desktop calendar application) and §4b (meeting invitations), with matching rows in §3, §5 and §7. Both describe processing that did not exist at v1.0. §4b includes a route for a recipient who is not a user of the Platform and has no other way to reach us. §4 and the Google Limited Use commitment are unchanged. |
| 1.2 | 2026-09-04 | Added §6a, the data protection measures we operate, including what we do not yet operate; and §4c, stating that data from a connected Google account is never used to train any AI or ML model and never transferred to any third party that would, and that our AI features have no means of reaching calendar data. Both sections respond to points raised in Google's OAuth verification review of 2026-09-04. §4, §4a and §4b are unchanged, as is the Limited Use commitment. |
| 1.3 | 2026-10-19 | §4c rewritten. v1.2 said our AI features had no means of reaching calendar data. With the new Assistant, an administrator's own Assistant can read the events imported from their own Google or Microsoft calendar when they ask it about their calendar; §4c now says so, with its limits — only for that person, only on their request, sent to our AI provider as processor, never used for training, and deleted on a schedule. The no-training and no-transfer-for-training commitment, and the Limited Use commitment in §4, are unchanged; §4 now names answering your own questions among the user-facing features. AI features described in §3 and §5 as they now are. Microsoft calendars described where they differ from Google (permission breadth, guest lists, Microsoft's own update emails, disconnection). New §4d for people booking an appointment through a link — a page live since September 2026 that v1.2 did not cover. §5 adds our storage provider in Germany, browser push services, Google Fonts and Cloudflare. §6a corrected twice: stored files and their backup copy are currently with the same provider, which v1.2's backup sentence did not reflect; and imported calendar events are visible not only to the person who connected the calendar but also to colleagues who are guests on a meeting — v1.2 said "visible only to you", which was not true since guest lists began to be imported on 2026-09-03. §3 and §7 add error reports, bookings and AI conversation retention. |