AgentScreenshots

GDPR overview

There is no mention of the GDPR anywhere on the site, neither in the privacy policy nor in the terms nor on any legal page. No Article 27 representative is designated, no data protection officer is named, no data processing agreement is offered or refused, and no subprocessor list is published as such. What does exist is narrower but real: a privacy policy dated 12 May 2026, a stated right to have the account and all associated data permanently deleted on request, a published privacy contact, and a genuinely minimal collection surface, since neither the images nor the page content ever reach the vendor. A European buyer working from a formal compliance checklist will find nothing to tick; a reader judging by data minimisation alone will find the design defensible.

Who owns the data?

The terms are unusually plain on ownership: you keep every right to the screenshots you capture and to the content they show, and the publisher claims no ownership over that output. What stays theirs is the product itself, namely the agentshot CLI, its documentation and the AgentScreenshots brand. Because captures are written straight to a local path and never uploaded, the vendor never holds the images in the first place. What it does hold is thin: the email address tied to the account, licence keys stored in encrypted form, and usage events. Deletion of the account and of all associated data, licence keys and usage records included, is available on request.

Reuse rights

Reuse is unrestricted on the user's side. The output belongs to whoever captured it, so a screenshot can be committed to a repository, attached to a pull request, shown to a client or published, with no permission to ask the publisher for. The vendor's own use of data runs the other way and is deliberately narrow. It never receives the images, the page content, the DOM, cookies or the full URLs; it records four things per capture, namely success or failure, whether the target was localhost or public, the CLI version and a timestamp, and it does so to enforce licences and to bill. Payment processing goes to Stripe, and no card detail is kept by the publisher. The account email serves one-time login codes and billing messages, and is neither sold nor shared with third parties.

Data retention & training

Hosting summary

Screenshots are never hosted anywhere: they are written to a local path on the machine that ran the command, and the publisher states that no image and no page content ever reaches its backend. What is hosted is the account layer. The backend runs on Cloudflare Workers, while account and licence data sits in Supabase, on PostgreSQL. Payment processing is handled by Stripe, which keeps the card details the publisher never stores. Each provider is named, and the privacy policy notes that each maintains its own security and privacy practices. No country and no region of hosting is stated anywhere, neither for the Workers deployment, nor for the database, nor for billing records, and no data processing agreement or subprocessor list is published. A buyer who needs to know which jurisdiction holds an account email and a usage log will not find the answer on the site. The mitigating factor is the size of the surface: an email address, encrypted licence keys, and usage events that contain neither a URL nor any page content.