Privacy Policy

Last updated: October 21, 2026

Zirahn (“Zirahn”, “we”, “us”, or “our”) is the trading name of Ahmed Khan, who operates the website zirahn.com and the Guard and AgentGovern services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

1. Information We Collect

Information You Provide

• Contact information: Name, email address, company name, and job title when you submit a demo request or contact form.
• Account information: When you sign up: your email address, your name, your organisation, your sign-in credentials, and the time you accepted our Terms of Service.
• Communications: Messages you send to us via email or our contact form.

Information Collected Automatically

• Usage data: Pages visited, time on page, referral source, and browser type, collected via Cloudflare Web Analytics. This analytics service is cookie-free and collects no personal data.

• Log data: IP addresses, request timestamps, and error logs for security and operational purposes.

• Usage counts: How many Guard checks your team uses each month, so we can apply your plan’s allowance and send usage emails.

• Guard and agent activity. What Guard sends and stores:

  • For each Claude Code tool call, Guard sends AgentGovern the tool’s name and its full input, such as the command, the file path and any text being written, and after the call, the tool’s output.
  • It also sends your prompts and Claude’s replies, and the folder, git branch and commit you are working in.
  • Secrets in recognised formats, such as API keys, tokens, private keys and connection strings, are masked before AgentGovern stores anything. Other text, including personal data, is stored as sent.
  • Inputs and outputs, up to 25 KB each, are kept for 90 days unless your organization’s admin sets a different period. If PII redaction is on for your organization, a redacted copy of the full inputs and outputs is kept until your account is deleted.
  • A one-line summary of each action, up to 200 characters of the command, file path, URL or search, or the first 97 characters of a prompt or reply, is kept until your account is deleted. A secret cut off by that limit may not be recognised.
  • If AgentGovern can’t be reached, Guard keeps your unsent prompts, tool calls with their inputs and outputs, and Claude’s replies on your machine, unmasked, in ~/.agentgovern. It retries them for 48 hours, then keeps any it could not send in ~/.agentgovern/outbox-dead until you delete them or uninstall Guard.

  Guard also sends your developer ID. The checks run on our service in the United States. Do not use Guard on work you aren’t allowed to share with us. How to install and remove Guard: Set up Guard.

Information We Do Not Collect

We do not use cookies for analytics or tracking. We do not collect personally identifiable information through our analytics systems. No cookie consent banner is required because we do not set tracking cookies.

2. How We Use Your Information

We use the information we collect to:

• Respond to demo requests and sales inquiries
• Schedule and conduct product demonstrations
• Send transactional emails (demo confirmations, onboarding)
• Apply your plan’s allowance, and email your team’s admins when usage reaches 50%, 75%, 90% and 100% of the monthly allowance
• Improve our website and product
• Monitor for security threats and abuse
• Comply with legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Data Sharing

We may share your information with:

• Service providers: Resend (transactional email), Cloudflare (hosting and security), Sentry (error monitoring), Clerk (sign-in and accounts), Vercel (dashboard hosting), Render (policy engine hosting), Neon (database), Stripe (billing records: email address and company name), Upstash (rate limiting; account and developer IDs only, no content) and Axiom (operational logs; IDs, event names and timings, no content). We use each provider under its data processing terms.
• Legal requirements: We will disclose data when required by law or to protect our legal rights.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.

4. AI Product Disclosures

AgentGovern processes data about your AI agents’ actions and outputs. In compliance with applicable AI regulations including the EU AI Act (Article 50 transparency obligations apply from 2 August 2026; high-risk obligations under Annex III apply from 2 December 2027, as deferred by Regulation (EU) 2026/1744):

• We disclose that AgentGovern itself uses automated processing to evaluate AI agent actions against compliance policies.
• No fully automated decisions with legal or similarly significant effects are made about individuals.
• Compliance scores are computed automatically from recorded actions; no decisions about individuals are made from them.

5. Data Retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations:

• Contact form submissions: 2 years
• Account data: kept while your account is active. To delete your account and its data, email [email protected]. We delete your data on request, within 30 days. After that, copies can remain for a limited time: in our database backups for up to 30 days, and in our service and error logs for up to 90 days, after which they are deleted automatically.
• Log data: 90 days
• Tool-call and agent payloads: Inputs and outputs, up to 25 KB each, are kept for 90 days unless your organization’s admin sets a different period. If PII redaction is on for your organization, a redacted copy of the full inputs and outputs is kept until your account is deleted. A one-line summary of each action, up to 200 characters of the command, file path, URL or search, or the first 97 characters of a prompt or reply, is kept until your account is deleted. A secret cut off by that limit may not be recognised. Secrets in recognised formats, such as API keys, tokens, private keys and connection strings, are masked before AgentGovern stores anything. Other text, including personal data, is stored as sent.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing or request restriction
• Data portability
• Lodge a complaint with a supervisory authority (EU residents: your local Data Protection Authority)

To exercise any of these rights, contact us at [email protected].

7. International Transfers

Zirahn is based in the United States. If you access our services from the European Economic Area, United Kingdom, or Switzerland, your data is transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) as the transfer mechanism under GDPR.

8. Security

We implement industry-standard security measures including encryption in transit (HTTPS/TLS), access controls, and written security reviews of changes to our policy engine, SDK and sign-in code. However, no method of transmission over the internet is 100% secure.

9. Children’s Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the “Last updated” date and, where appropriate, by email.

11. Contact Us

Zirahn (trading name of Ahmed Khan) Email: [email protected] Website: zirahn.com