Privacy notice

Plain-language summary. We store the minimum we need to run the service. We never log the stdout / stderr of your sandbox commands — too easy a place to leak secrets you typed. Stripe handles payment data; we never see your card. You can revoke sessions and OAuth grants from the dashboard at any time. The full picture follows.

Effective date: 2026-05-19 · Last updated: 2026-10-04 (text messages include RCS: section 2.8)

This privacy notice describes how connect0.ai inc ("connect0", "we", "us", "our") collects, uses, shares, and protects personal information in connection with the service we operate at connect0.ai (the "Service"). It applies to the marketing site, the customer dashboard, the MCP server at mcp.connect0.ai, and the supporting APIs.

1. Who is the data controller

connect0.ai inc is the controller of the personal information described here. For data we process on behalf of business customers (account members, invocation logs tied to a customer's projects, etc.), we act as a processor under our customers' instructions.

Contact for privacy questions: privacy@connect0.ai.

2. What we collect

2.1 Identity

We delegate sign-in to Google's Identity Platform. From it we receive:

• a stable user id (the Identity Platform localId),
• your email address,
• your display name and avatar (if you've shared them on the Google side),
• the identity provider that authenticated you (Google).

We never see or store your password. Google's privacy notice covers what they collect during sign-in.

2.2 Account and project metadata

• Account: name, slug, owner role, member list, member roles.
• Project: name, slug, description, per-project settings (e.g. the sandbox egress flag).

2.3 Sandbox invocations

For every sh call we record: the command string, the exit code, the duration, the requesting user id, the requesting client id, and the timestamp. We do not record stdout, stderr, environment variables, or workspace file contents. Per the spec, this data is retained for 90 days.

2.4 Billing data

• Stripe customer id linked to your account.
• Subscription status, plan slug, period start / end, trial end, cancel-at, canceled-at.
• Invoice metadata: id, status, amount, currency, hosted-invoice URL, PDF URL, period.

Card numbers, billing addresses, and other payment instruments are held by Stripe; we never see or store them. Stripe's privacy notice is at stripe.com/privacy.

2.5 Sessions and OAuth grants

For every active web session: an opaque session-token hash, the user agent string, the IP address that established the session, the creation and last-seen timestamps, and the expiry. We use this to render the "active sessions" list on the dashboard and to support revocation.

For every OAuth grant we maintain a rotating refresh-token chain: client id, scope, resource, rotation chain id, and per-token timestamps. Token bodies are never stored — only SHA-256 hashes of them.

2.6 Server logs

Cloud Run produces request logs (timestamp, method, path, status, user agent, IP). We retain these in Google Cloud Logging for up to 30 days for operational purposes (debugging, abuse investigation, capacity planning).

2.7 What we don't collect

• Sandbox stdout / stderr.
• Workspace file contents (those live in your project's R2 prefix on Cloudflare; we can delete the prefix when a project is removed, but we don't browse it).
• Marketing-grade behavioural analytics. We don't run Plausible, PostHog, Google Analytics, or any similar service on the connect0.ai surface.

2.8 Mobile number and text messages

Only if you link a mobile number to use the connect0 text assistant (see the Terms, section 13). "Text messages" here means SMS and, where your phone and carrier support it, RCS messages; we handle both the same way:

• your mobile number, when you linked it, and which connect0 account your texts act in,
• the text messages you send us and the replies we send you, stored as part of your conversation with Zero,
• whether you turned on account notices by text for the number, the notices we sent to it (at most 10 a day; only unusual-spend notices, approval requests and questions from your agents), and your replies to an agent's question, stored as part of that conversation,
• delivery status for each message we send, and the number of message segments, so we can bill usage accurately,
• if you text STOP, a record that the number opted out, kept so we can honour it — including after the number is unlinked.

We use this only to answer your messages, to send the account notices you turned on, to operate and bill the program, and to honour opt-outs. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

3. How we use the data

• To operate the Service (authenticate, route requests, allocate sandboxes, bill).
• To provide customer support and respond to inquiries.
• To detect, investigate, and prevent abuse, fraud, and security incidents.
• To meet our legal and regulatory obligations.
• If you linked a mobile number: to deliver replies to your text messages, to send the account notices you turned on for that number (an unusual-spend notice, a request for your approval, or a question from one of your agents) and to deliver your reply to that agent, and to honour STOP / HELP requests (section 2.8).
• To send important service notices (security disclosures, planned downtime, billing failures). We do not send marketing email from the data above; if we ever do, you'll have opted in separately.

4. Legal bases (GDPR / UK GDPR)

If you're in the EEA, UK, or another jurisdiction with similar law, our lawful bases for processing are:

• Contract (Art. 6(1)(b)) — to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent abuse, and improve it.
• Legal obligation (Art. 6(1)(c)) — when we have to respond to a lawful request.
• Consent (Art. 6(1)(a)) — only where we explicitly ask for it (we don't currently).

5. Who we share data with

We use a small set of sub-processors:

Sub-processor	Purpose	Data location
Google Cloud Platform	Compute, Cloud SQL, logging, secret management	us-central1 (US)
Google Identity Platform	Authentication	Per Google's policy
Cloudflare, Inc.	Sandbox containers, R2 workspace storage, DNS	Cloudflare's network
Stripe, Inc.	Subscription billing, hosted Checkout / Portal	Per Stripe's policy
Twilio Inc.	Sending and receiving text messages (section 2.8)	United States

We don't sell personal information and we don't share it with advertisers. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

We may disclose data when we believe in good faith that the law requires it, to enforce our Terms, or to protect the rights, property, or safety of connect0, our users, or the public.

6. International transfers

connect0 stores most data in the United States (us-central1). If you access the Service from outside the US, your data will be transferred to the US. We rely on appropriate transfer mechanisms (Standard Contractual Clauses with our sub-processors where required).

7. Retention

Data	Retention
Account / project / member	While the account is active; deleted on request
Sandbox invocation log	90 days, then deleted
Active session / OAuth grant	Until revoked or until expiry
Stripe metadata (invoices, etc.)	While Stripe retains the corresponding records
Server request logs	Up to 30 days

Audit-tier accounts (enterprise plan, when it lands) retain longer per their contract.

8. Your rights

Subject to local law, you have rights to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten"). This removes your account + every account you solely own, the projects under those accounts, every sandbox_invocation row, and queues the R2 prefixes for cleanup. Stripe subscriptions are cancelled at the end of their current period.
• Restrict or object to processing in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with your local data-protection authority.

To exercise any of these, email privacy@connect0.ai. We'll respond within the timeframe required by applicable law (within 30 days under GDPR).

You can revoke any active session or OAuth grant yourself at any time from /a/[account]/access on the dashboard.

9. Cookies

connect0.ai uses two cookies:

• __session — a strictly-necessary HttpOnly cookie that holds your sign-in session. Without it you can't use the dashboard. SameSite=Lax, scoped to .connect0.ai.
• __site_gate — set only while the site is in a pre-launch gate; clears automatically once we lift it.

We do not use analytics, advertising, or fingerprinting cookies.

10. Security

• TLS 1.2+ in transit; HSTS on every public origin.
• Audience-bound JWTs (ES256) with rotating signing keys.
• Per-project Cloudflare Sandbox isolation; R2 prefix scoping.
• Workload Identity Federation for CI; no long-lived service-account keys in source.
• Postgres connections under IAM-authenticated runtime service accounts; no application passwords.

Security disclosures: security@connect0.ai.

11. Children

The Service is not directed at, and we don't knowingly collect personal information from, anyone under 18.

12. Changes

We may update this notice. Material changes will be announced on the dashboard and, where we have an email address on file, by email at least 14 days before they take effect. The "Effective date" at the top of this page reflects the latest version.

13. Contact

connect0.ai inc — privacy@connect0.ai. Postal address available on written request.