1. Who we are
The Service is operated by Bar Zaken, Israel (“ands”, “we”, “us”), who is the controller of the personal information described here. Contact: legal@ands.sh.
2. The short version
- We collect as little as we can: your email, your subscription status, and how much of your balance you use.
- To do a task in the desktop app, what the task needs (your request and a description of what is on the relevant screen, and screenshots only when you allow them) is sent through our servers to third-party AI providers, which return the next step. We do not keep that content after the request is answered.
- Your settings and the log of what the Agent did stay on your computer.
- We do not sell your information, we do not use it for advertising, and we do not use your content to train AI models.
3. What we collect
Account: your email address, and the one-time sign-in codes sent to it.
Subscription and payment: Polar, our merchant of record, collects your payment details and billing information. We receive from Polar your email, a customer ID, the order and subscription status, and the billing period. We never receive your full card details.
Usage and balance: your balance and the amount of usage each task consumes, with timestamps. We do not store the text of your tasks with these records.
Task content (desktop app): your request, the plan, and the information the Agent needs to act, such as the names, roles and text of buttons, fields and windows in the relevant app or page. Screenshots are sent only when you allow them. This can include personal information that appears on your screen, including other people’s information.
Remote features: a connection link’s identifier and a hashed form of its secret; requests and results passing through the relay; and approval requests (a short description of the step, its tier and status).
Communications: messages you send us, and records of emails we send you.
Website: our hosting provider processes standard technical data such as IP address, browser and pages requested, to serve and protect the site. The site keeps your language and theme choice, and on the approval page your sign-in session, in your browser’s local storage. We do not use advertising cookies or third-party trackers.
4. What stays on your computer
Settings, the list of blocked apps and the log of Actions live in the ~/.ands folder on your computer, readable only by your user, and are not uploaded to us.
Voice input is turned into text by your operating system’s speech service, under the privacy terms of its provider (such as Apple or Microsoft). We receive only the resulting text, as part of your request.
With the free developer tool (andsh), your own AI agent and model provider receive what the agent needs, under their terms. That information does not pass through us, unless you use the relay to connect a Remote Agent.
5. How we use information
- to provide the Service: sign you in, run tasks, deliver relay requests and approvals, and keep your balance;
- to process payments and manage your subscription with Polar;
- to keep the Service secure and prevent fraud, abuse and breaches of our Terms;
- to send service emails, such as sign-in codes, billing notices and important changes;
- to answer you, and to improve the Service using aggregate usage figures;
- to meet legal obligations and to establish, exercise or defend legal claims.
6. Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies, we rely on: performing our contract with you (providing the Service and billing); our legitimate interests (security, fraud prevention, improving the Service and defending claims), balanced against your rights; legal obligations (such as tax records); and your consent where we ask for it (such as optional marketing), which you can withdraw at any time.
8. International transfers
Our providers may process information outside your country, including in the United States and the European Union. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, and on adequacy decisions (the EU recognizes Israel as providing adequate protection).
9. How long we keep information
- Account, balance and usage records: while your account is active, and up to 24 months after it closes, unless you ask us to delete them sooner.
- Payment and billing records: as long as tax and accounting laws require (in Israel, generally 7 years).
- Task content: not stored by us after the request is answered.
- Relay requests and approval requests: deleted automatically within about a day.
- Hosting and security logs: under our providers’ standard retention.
10. Security
We use encryption in transit, access controls that let each person read only their own data, hashed secrets for connection links, and on your computer the Agent never reads password fields. No system is perfectly secure, and we cannot guarantee the security of information. If a breach affecting you happens, we will notify you and the authorities as the law requires.
11. Other people’s information
If you use the Agent on content that includes other people’s personal information, you are responsible for having a legal basis and any required consent to do so. For that content we act on your instructions and process it only to perform your task.
12. Your rights
Israel: under the Protection of Privacy Law, 1981, you may review the information we hold about you and ask us to correct or delete it, and ask to be removed from any direct marketing list.
EEA and UK: you may access, correct, delete, restrict or object to processing of your information, ask for a portable copy, withdraw consent, and complain to your local data protection authority.
California and other US states: you may know what we collect, access it, correct it and delete it, and you will not be treated differently for using these rights. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.
To use a right, write to legal@ands.sh from your account’s email. We may need to verify your identity, and we will answer within the time the law sets. Deleting your account ends your access to the Service.
13. Emails and marketing
Service emails (such as sign-in codes and billing notices) are part of the Service. We send marketing only with your consent as the law requires, including the Israeli Communications Law, and every marketing email includes a way to unsubscribe.
14. Children
The Service is for people 18 and over. We do not knowingly collect information from anyone under 18, and we will delete it if we learn that we did.
15. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell you by email or in the app before it takes effect.
16. Contact and complaints
Privacy questions and requests: legal@ands.sh. You may also complain to the Israeli Privacy Protection Authority, or to the data protection authority where you live.
This policy is written in Hebrew and English. If the versions differ, the Hebrew version governs.