Privacy policy

Summary

OpenAgents is a desktop app for Microsoft 365 administrators. It runs on your computer. Your Microsoft 365 tenant data and the prompts sent to your local language model never leave your machine. The only data we knowingly receive is what you type into the waitlist form on this website.

When you choose a hosted language-model provider (Anthropic, OpenAI, or Azure OpenAI) instead of a local one, prompts that include tenant data are sent to that provider under their own privacy policy. The app states this explicitly in the UI before any prompt is sent.

Who is responsible

OpenAgents is an open-source project published by UgurLabs. The source is at github.com/ugurkocde/OpenAgents. You can reach the maintainer at support@ugurlabs.com.

What the desktop app does on your computer

• Microsoft 365 authentication. When you connect a tenant, the app signs you in to Microsoft using MSAL. Microsoft returns access and refresh tokens scoped to the Graph permissions you consented to. Those tokens are stored in your operating-system keychain (macOS Keychain, Windows Credential Manager) and used only by the local app to call Microsoft Graph. They are never transmitted to OpenAgents or UgurLabs.
• Microsoft Graph data. Agents you run call Microsoft Graph on your behalf and process the returned data (devices, users, policies, etc.) in memory on your machine. Selected fields may be written to a local SQLite database for run history and audit purposes. This database is stored under your user profile and is never uploaded anywhere.
• Language-model prompts (local provider). When you select a local LLM provider such as Ollama or LM Studio, prompts and responses stay on your machine. OpenAgents does not see them.
• Language-model prompts (hosted provider). When you select Anthropic, OpenAI, or Azure OpenAI, prompts (which may contain tenant data) are sent over TLS to that provider, under their privacy policy and your account with them. The OpenAgents UI labels the selected provider and the region the API is hosted in. OpenAgents and UgurLabs do not receive a copy of these prompts.
• No telemetry. The desktop app does not collect analytics, usage metrics, or error-reporting data. Crash logs stay on your machine.
• Auto-update. The Microsoft Store handles updates on Windows. On macOS, the app checks GitHub Releases for a new version and downloads the signed installer. These checks send a standard HTTPS request to GitHub; refer to GitHub’s privacy statement for what they log.

What this website does

• Waitlist signups. If you enter your email on the homepage, that address is stored in our database (Supabase, hosted in the EU) and used only to contact you about the OpenAgents private preview. You can ask us to delete it at any time by emailing support@ugurlabs.com.
• Hosting and logs. The site is deployed on Vercel. Vercel records standard server access logs (IP address, user-agent, timestamps) as a normal part of serving the site; see Vercel’s privacy policy.
• No third-party analytics. We do not use Google Analytics, advertising trackers, or third-party cookies.

Your rights

If you are in the EU, UK, or another jurisdiction with similar data-protection laws, you have the right to request a copy of the personal data we hold about you, to correct it, or to have it deleted. Because the desktop app does not transmit anything to us, this in practice applies to your waitlist email and any support correspondence. Email support@ugurlabs.com and we will respond within 30 days.

Changes to this policy

Material changes will be noted by updating the “Last updated” date above and, where reasonable, by a notice in the desktop app or on this page. The full revision history is public in the project’s GitHub repository.