Privacy Policy

For any privacy question or request, use our privacy contact form.

In this policy, "Mainframe", "we", "us" and "our" mean the operator of Mainframe. This policy covers the Mainframe website at mainframe1.com, the Mainframe app at app.mainframe1.com, and the cloud computer we run for your Mainframe.

• Account data from Google sign-in. When you sign in with Google, we receive your name, email address and profile picture, through the openid, email and profile scopes.
• Billing data. Payments are processed by Stripe. We never receive or store your full card number. We receive what we need to run your subscription, such as your billing name, billing country, tax details where they apply, subscription status and invoices.
• Your workspace content. The files you upload, the data your connected services return, the work your agents produce and your conversations with them. This content lives in your private Mainframe workspace.
• Usage and logs. Operational records such as event types, timestamps, error reports and data volumes, which we use to run the service, keep it secure and fix problems. These logs are designed to exclude the text of your prompts and any secret values.
• Access requests and support. The details you enter when you request access on our website, such as your name, email, company and the work you want help with, and any messages you send us.

Signing in with Google

When you sign in with Google, we request the openid, email and profile scopes. We use your name, email address and profile picture only to create your account, identify you, and keep your account secure.

Google services you connect

You can choose to connect Google services to your Mainframe. Nothing is connected unless you authorise it yourself, and each connection asks only for the access listed here:

• Gmail (gmail.readonly, gmail.compose). Read and search your messages, and create drafts for you to review and send yourself. Mainframe does not send email on your behalf.
• Google Calendar (calendar.readonly). Read your events and free or busy times. Mainframe does not create, change or delete calendar events.
• Google Drive (drive.readonly). Read the files you ask Mainframe to work with. Mainframe does not create, change or delete files in your Drive.

How we handle it

• Data from connected Google services is accessed only in your private Mainframe workspace, and only to perform tasks you ask Mainframe to do.
• We do not sell Google user data.
• We do not use Google user data for advertising, including retargeting, personalised or interest-based advertising.
• We do not use Google user data to develop, improve or train AI or machine learning models, and we do not allow it to be used for that purpose.
• We do not transfer Google user data to others, except as needed to perform a task you asked for, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• No person at Mainframe reads your Google user data, unless you give us explicit consent for specific data, it is needed for security purposes such as investigating abuse, or we are required to by law.

Mainframe's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

• You choose the model provider. Your request, and the content needed to complete it, is sent to that provider only to perform the task.
• The provider handles that request under its own terms. If you connect your own subscription or API key, your agreement with that provider applies.
• We do not use your content to train AI models. If you connect your own ChatGPT subscription or API account, its training settings remain under your control. Google user data is covered by the stricter rule in section 03.
• Supported connector flows use secret references to reduce credential exposure. Agents with host access can also use tools, files and provider login sessions; this is not a guarantee that all credentials are technically inaccessible to every agent. Do not paste credentials into chat.

These providers process data for us, under contract:

• Cloud hosting, in the European Union or United States region you choose when you sign up.
• Payments, to process your subscription.
• Email delivery, to send you account and service messages.
• AI model providers, the ones you choose, to perform the tasks you ask for.
• Messaging and voice services, only if you turn on a feature that uses them.

A current list of these providers is available on request fromour privacy contact form.

We may also disclose data where the law requires it, to protect the security of Mainframe and its users, or as part of a merger or acquisition, in which case we will tell you.

• Each Mainframe has an isolated workspace, with its own storage, database and backups, in the region you choose.
• Data is encrypted in transit and at rest.
• Access is controlled. Our administrative access runs over a private network, and is used to operate and support the service.
• Supported connector integrations keep credentials in a secrets store and resolve references when needed. Host access is a broader boundary, as explained in section 04 and our Security page.
• The board records agent activity and supported operations produce audit events. This does not cover every possible host operation.

No system is perfectly secure. Our Security page describes the controls in more detail.

• While your account is active, we keep your data so you can use Mainframe.
• Cancelling renewal keeps service active until the paid period ends. Account closure and deletion requests are separate. Download your files before requesting deletion; use our contact form for export or deletion assistance. Deleting a machine does not itself erase backups, provider records or legally required billing records.
• Payment failure can affect service access. Cancellation, non-payment and a request to erase personal data are distinct events; contact us about access and export before closing your account.
• We keep billing records for as long as tax and accounting law requires.

You can export your workspace at any time from inside your Mainframe. To ask us to export or delete your data, use our privacy contact form. We respond within 30 days.

• To disconnect a Google service, open the Connections page in your Mainframe and remove it.
• You can also revoke access from your Google Account at myaccount.google.com/permissions.

Once you revoke access, Mainframe can no longer read that service. Data it already brought into your workspace stays there until you delete it, or until it is deleted with your account. Revoking sign-in access means you will no longer be able to sign in to Mainframe with that Google account.

Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To use any of these rights, use our privacy contact form. We respond within 30 days.

Why we are allowed to use your data

• To perform our contract with you: creating your account, running your Mainframe and billing you.
• Your consent: connecting Google and other services, and optional features you turn on.
• Our legitimate interests: keeping Mainframe secure, preventing abuse and keeping the service reliable.
• Legal obligations: keeping tax and accounting records.

Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the supervisory authority in Cyprus, the Office of the Commissioner for Personal Data Protection, at dataprotection.gov.cy, or to the data protection authority where you live.

• The Mainframe website does not use analytics, advertising or tracking cookies. It may save a display preference, such as a light or dark theme, in your browser's local storage.
• The Mainframe app stores what it needs to keep you signed in and secure. This storage is essential to the service and is not used for advertising.

We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, use our privacy contact formand we will delete it.

Your Mainframe workspace, its storage and backups stay in the European Union or United States region you pick. Some of the providers listed above, such as AI model providers and payment or email services, may process data in other countries. Where personal data leaves the European Economic Area, we rely on appropriate safeguards, such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses.

If a change materially affects how we handle your data, we will tell you by email or in Mainframe before it takes effect.

Effective date: 28 September 2026.