This is the single most common way small businesses get held hostage. The agency registers the domain under its own account, builds on its own hosting or a proprietary platform, owns the Google Business Profile and the ad accounts, and when you leave you get nothing but an invoice. Sometimes it is malice. More often it is sloppiness that becomes leverage the day you give notice. Either way the fix is the same and it takes an afternoon.
Check these right now. Who is the registrant on your domain, which you can look up yourself. Do you have your own login to the hosting account, or only the agency's. Are you listed as owner, not manager, on the Google Business Profile, Google Analytics, Search Console, Google Ads and Meta accounts. Is the website on a platform you could move, or something custom that only works on their servers. Each one you cannot answer is a problem.
Then get it in writing. Your agreement should say you own the domain, the content, the photos and the site files, that you get a full export on request, and that there is no fee to leave. If a vendor will not put that in an email, that is your answer about the relationship. The published Heights offer is month to month with no contract for exactly this reason. Work should keep you because it works, not because leaving is painful.
Send the site over. We will tell you what is broken, what you could rank for, and whether AI search knows you exist. No charge and no pitch deck.