Privacy notice

Plain-language summary. We store the minimum we need to run the service. We never log the stdout / stderr of your sandbox commands — too easy a place to leak secrets you typed. Stripe handles payment data; we never see your card. You can revoke sessions and OAuth grants from the dashboard at any time. The full picture follows.

Effective date: 2026-05-19

This privacy notice describes how connect0.ai inc ("connect0", "we", "us", "our") collects, uses, shares, and protects personal information in connection with the service we operate at connect0.ai (the "Service"). It applies to the marketing site, the customer dashboard, the MCP server at mcp.connect0.ai, and the supporting APIs.

1. Who is the data controller

connect0.ai inc is the controller of the personal information described here. For data we process on behalf of business customers (account members, invocation logs tied to a customer's projects, etc.), we act as a processor under our customers' instructions.

Contact for privacy questions: privacy@connect0.ai.

2. What we collect

2.1 Identity

We delegate sign-in to Google's Identity Platform. From it we receive:

• a stable user id (the Identity Platform localId),
• your email address,
• your display name and avatar (if you've shared them on the Google side),
• the identity provider that authenticated you (Google).

We never see or store your password. Google's privacy notice covers what they collect during sign-in.

2.2 Account and project metadata

• Account: name, slug, owner role, member list, member roles.
• Project: name, slug, description, per-project settings (e.g. the sandbox egress flag).

2.3 Sandbox invocations

For every sh call we record: the command string, the exit code, the duration, the requesting user id, the requesting client id, and the timestamp. We do not record stdout, stderr, environment variables, or workspace file contents. Per the spec, this data is retained for 90 days.

2.4 Billing data

• Stripe customer id linked to your account.
• Subscription status, plan slug, period start / end, trial end, cancel-at, canceled-at.
• Invoice metadata: id, status, amount, currency, hosted-invoice URL, PDF URL, period.

Card numbers, billing addresses, and other payment instruments are held by Stripe; we never see or store them. Stripe's privacy notice is at stripe.com/privacy.

2.5 Sessions and OAuth grants

For every active web session: an opaque session-token hash, the user agent string, the IP address that established the session, the creation and last-seen timestamps, and the expiry. We use this to render the "active sessions" list on the dashboard and to support revocation.

For every OAuth grant we maintain a rotating refresh-token chain: client id, scope, resource, rotation chain id, and per-token timestamps. Token bodies are never stored — only SHA-256 hashes of them.

2.6 Server logs

Cloud Run produces request logs (timestamp, method, path, status, user agent, IP). We retain these in Google Cloud Logging for up to 30 days for operational purposes (debugging, abuse investigation, capacity planning).

2.7 What we don't collect

• Sandbox stdout / stderr.
• Workspace file contents (those live in your project's R2 prefix on Cloudflare; we can delete the prefix when a project is removed, but we don't browse it).
• Marketing-grade behavioural analytics. We don't run Plausible, PostHog, Google Analytics, or any similar service on the connect0.ai surface.

3. How we use the data

• To operate the Service (authenticate, route requests, allocate sandboxes, bill).
• To provide customer support and respond to inquiries.
• To detect, investigate, and prevent abuse, fraud, and security incidents.
• To meet our legal and regulatory obligations.
• To send important service notices (security disclosures, planned downtime, billing failures). We do not send marketing email from the data above; if we ever do, you'll have opted in separately.

4. Legal bases (GDPR / UK GDPR)

If you're in the EEA, UK, or another jurisdiction with similar law, our lawful bases for processing are:

• Contract (Art. 6(1)(b)) — to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent abuse, and improve it.
• Legal obligation (Art. 6(1)(c)) — when we have to respond to a lawful request.
• Consent (Art. 6(1)(a)) — only where we explicitly ask for it (we don't currently).

5. Who we share data with

We use a small set of sub-processors:

Sub-processor	Purpose	Data location
Google Cloud Platform	Compute, Cloud SQL, logging, secret management	us-central1 (US)
Google Identity Platform	Authentication	Per Google's policy
Cloudflare, Inc.	Sandbox containers, R2 workspace storage, DNS	Cloudflare's network
Stripe, Inc.	Subscription billing, hosted Checkout / Portal	Per Stripe's policy

We don't sell personal information and we don't share it with advertisers.

We may disclose data when we believe in good faith that the law requires it, to enforce our Terms, or to protect the rights, property, or safety of connect0, our users, or the public.

6. International transfers

connect0 stores most data in the United States (us-central1). If you access the Service from outside the US, your data will be transferred to the US. We rely on appropriate transfer mechanisms (Standard Contractual Clauses with our sub-processors where required).

7. Retention

Data	Retention
Account / project / member	While the account is active; deleted on request
Sandbox invocation log	90 days, then deleted
Active session / OAuth grant	Until revoked or until expiry
Stripe metadata (invoices, etc.)	While Stripe retains the corresponding records
Server request logs	Up to 30 days

Audit-tier accounts (enterprise plan, when it lands) retain longer per their contract.

8. Your rights

Subject to local law, you have rights to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten"). This removes your account + every account you solely own, the projects under those accounts, every sandbox_invocation row, and queues the R2 prefixes for cleanup. Stripe subscriptions are cancelled at the end of their current period.
• Restrict or object to processing in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with your local data-protection authority.

To exercise any of these, email privacy@connect0.ai. We'll respond within the timeframe required by applicable law (within 30 days under GDPR).

You can revoke any active session or OAuth grant yourself at any time from /a/[account]/access on the dashboard.

9. Cookies

connect0.ai uses two cookies:

• __session — a strictly-necessary HttpOnly cookie that holds your sign-in session. Without it you can't use the dashboard. SameSite=Lax, scoped to .connect0.ai.
• __site_gate — set only while the site is in a pre-launch gate; clears automatically once we lift it.

We do not use analytics, advertising, or fingerprinting cookies.

10. Security

• TLS 1.2+ in transit; HSTS on every public origin.
• Audience-bound JWTs (ES256) with rotating signing keys.
• Per-project Cloudflare Sandbox isolation; R2 prefix scoping.
• Workload Identity Federation for CI; no long-lived service-account keys in source.
• Postgres connections under IAM-authenticated runtime service accounts; no application passwords.

Security disclosures: security@connect0.ai.

11. Children

The Service is not directed at, and we don't knowingly collect personal information from, anyone under 18.

12. Changes

We may update this notice. Material changes will be announced on the dashboard and, where we have an email address on file, by email at least 14 days before they take effect. The "Effective date" at the top of this page reflects the latest version.

13. Contact

connect0.ai inc — privacy@connect0.ai. Postal address available on written request.