Data processing
Last updated 25 October 2026
This page is for businesses and organisations that use KitMyAgent and need to know how we handle personal data, for example for your own records under UK GDPR. If you're an individual, our privacy policy covers everything you need.
1. Our role
KitMyAgent is a trading name of Design Fly Media Ltd (company number 09608816), 2b Derby Road, Ashby-de-la-Zouch, Leicestershire, LE65 2HE.
- Your account data (sign-in email, optional first name, the agents you save, downloads and purchases): we are the data controller. We decide how it's used, as set out in our privacy policy.
- Your business data and your customers' data: KitMyAgent doesn't process it. A kit is a set of files you download and install on your own AI platform (for example ChatGPT, Claude or Gemini). Once it's installed, your agent runs on that platform, under your account with that provider. We never connect to it, and we never see your chats, emails, files or customer records.
That means, for the agents you run, you (or your organisation) are the controller, and your AI platform provider is usually your processor. Check that provider's data terms: they apply, not ours.
2. Providers we use
We use these providers (sub-processors) to run kitmyagent.com. They only use the data to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Website hosting, security and our database | Database stored in the EU; network worldwide |
| Resend | Sign-in emails, receipts and the newsletter | USA |
| Google Analytics | Website statistics, only if the visitor accepts analytics cookies | USA / EU |
Paddle (paddle.com) sells our downloads as Merchant of Record. Paddle is an independent controller of payment and billing data under its own privacy notice, not our processor.
Where data leaves the UK, it's covered by approved safeguards such as the UK–US Data Bridge or the ICO's international data transfer agreement. We'll update this list before adding a new provider that handles personal data.
3. Security
- All traffic uses HTTPS; data is encrypted at rest.
- No passwords: sign-in uses one-time links that expire after 15 minutes.
- Session cookies are Secure and HttpOnly, so page scripts can't read them.
- Access to our systems is limited to the people who need it and protected with two-factor authentication.
- We keep data only as long as set out in the privacy policy, and expired sign-in links and sessions are deleted automatically every day.
4. If something goes wrong
If we have a personal data breach that's likely to put people at risk, we'll report it to the Information Commissioner's Office within 72 hours of finding out, and tell the people affected without undue delay, as UK GDPR requires.
5. Requests and agreements
To see, correct, export or delete the account data we hold, email hello@kitmyagent.com. Signed-in users can also download their data from their account page. We reply within one month.
If your organisation needs a written data processing agreement or a completed supplier questionnaire, email us and we'll help.