The short version
We collect the information needed to run and secure the Service. Chat content and extracted attachment text may be stored and sent to the selected AI provider. Observer sends aggregates, not prompts or completions. We do not currently sell personal information, run behavioral advertising, or use Customer Content to train our own general-purpose foundation model.
Scope and our role
This Privacy Policy explains how MainStreet AI handles personal information when you visit our site, create an account, join a workspace, use chat, Projects, files, APIs or Observer, request access, or communicate with us. It does not govern a third party's independent services or sites.
MainStreet AI generally acts as a controller or “business” for account administration, security, product operations, and direct relationships with users. When an organization submits personal information through the Service and controls why and how it is processed, that organization may be the controller or business and MainStreet AI may act as its processor or service provider. A signed data processing addendum or customer agreement controls if it conflicts with this Policy.
Information we collect
| Category | Examples from the current Service | Primary source |
|---|---|---|
| Account and workspace | Name, email, authentication ID, workspace name, role, account type, use case, and routing preference | You, your administrator, and our authentication provider |
| Customer Content | Prompts, messages, model outputs, Project context, goals, guardrails, and response feedback | You and users in your workspace |
| Files | File name, type, size, and extracted text from supported PDF, TXT, DOC, and DOCX uploads | You |
| Routing and usage | Task classification, candidate models, selected model and effort, token counts, latency, provider request ID, errors, cost and savings estimates, and policy settings | Generated through use of the Service and returned by providers |
| API and security | API-key prefix and last four characters, a one-way verifier, scope, creation and use dates, audit events, and hashed source IP and user-agent values | You, your systems, and the Service |
| Observer telemetry | Hourly aggregate request, failure, truncation, token, cost, unpriced-request, and latency measurements by deployment, tag, provider, model, and inference effort, plus structured optimization findings and their cost arithmetic | Your customer-managed deployment |
| Device and request | IP address, browser and device signals, cookies, local storage, request time, route, and diagnostic or security logs | Your browser, device, and infrastructure providers |
| Website analytics | Page URL, referrer, filtered query parameters, approximate location, browser, operating system, device type, and event time in aggregated Vercel Web Analytics | Your browser and Vercel |
| Communications | Email, waitlist or access-request details, optional message, support correspondence, and anti-abuse signals | You |
We collect information you provide, information generated when you use the Service, information supplied by your organization, and limited information from service providers. Please do not include sensitive personal information in a prompt or Project unless it is necessary, authorized, and covered by an appropriate agreement.
How content moves through the Service
When you send a chat or API request, MainStreet AI may combine it with recent conversation history, Project context, goals and guardrails, attachment text, tool definitions, and routing preferences. The router evaluates the request and sends the required content to the selected model provider. We return the response and store the conversation and routing evidence so the product can display history, explain selection, measure performance, and calculate savings.
For supported uploads, the current implementation extracts text for the request and does not intentionally retain the original file bytes. File metadata and extracted text may be stored with the conversation, Project, or request record. Scanned documents may require separate OCR and are not currently supported by this path.
Projects add persistent context
Observer privacy boundary
Observer measures customer-managed deployments without collecting model content. Its current telemetry consists of hourly aggregates such as request count, failures, truncation, input/output/cache tokens, estimated cost, inference effort, unpriced-request counts, and latency percentiles. It may also include structured optimization findings and the usage and cost arithmetic supporting them. It does not include prompts, completions, provider API keys, request identifiers, exact request timestamps, or raw provider error strings.
Provider credentials remain in the customer's environment. Observer report and claim credentials are shown in plaintext once; the Service stores one-way hashes for later verification. An anonymous deployment claim token may be stored in your browser until you attach the deployment to an account or clear browser storage.
How and why we use information
We use personal information to:
- provide accounts, workspaces, chat, Projects, file processing, APIs, routing, and Observer;
- authenticate users, issue and verify API keys, enforce permissions, prevent replay and abuse, and investigate incidents;
- select models and inference effort, execute requests, calculate usage, and produce cost and savings estimates;
- maintain conversation history and customer preferences;
- monitor reliability, evaluate routing quality, debug failures, and improve the Service;
- measure aggregated page traffic, referrers, devices, and geographic trends through Vercel Web Analytics;
- respond to access requests, support messages, and product feedback;
- enforce agreements and comply with legal obligations; and
- create aggregated or de-identified statistics that do not reasonably identify an individual.
Where law requires a legal basis, we rely on performance of a contract, legitimate interests such as security and service improvement, compliance with law, and consent where we specifically request it. You may withdraw consent where consent is the basis, without affecting earlier processing.
AI providers and model training
Current approved production routes use direct APIs from providers including OpenAI and Anthropic. A selected provider receives the prompt and other content needed to generate a response, plus technical settings such as model, output limit, and inference effort where supported. Providers may keep limited logs or application state under their enterprise/API terms, account settings, safety requirements, and law.
MainStreet AI does not train its own general-purpose generative foundation model on Customer Content. We may use feedback and minimized or aggregated operational signals to improve routing, reliability, safety, and cost estimation. If we propose a materially different training or human-review program involving Customer Content, we will provide additional notice or obtain agreement as required.
Provider terms and controls can change. OpenAI currently states that API data is not used to train its models unless the customer opts in. Anthropic currently states that commercial API content is not used to train its models unless the customer participates in a designated program or expressly provides feedback or opts in.
How we disclose information
We may disclose information to the following categories of recipients for the purposes described above:
- AI providers, currently including OpenAI and Anthropic, to fulfill model requests;
- authentication providers, currently Clerk, to manage identity and sessions;
- database, hosting, analytics, cache, security, and infrastructure providers, including Vercel for web hosting and cookie-free Web Analytics, Supabase-hosted Postgres, and providers that run the backend services;
- communications providers, currently including Resend, for access-request and operational email;
- your organization and its administrators when your account belongs to a managed workspace;
- professional advisers, authorities, or counterparties when reasonably necessary for legal compliance, safety, claims, financing, reorganization, merger, or sale; and
- other parties at your direction or with your consent.
We do not sell personal information or share it for cross-context behavioral advertising under the current Service design. We do not use advertising cookies. If that changes, we will update this Policy and provide required choices before the new practice begins.
Retention and deletion
We retain information for as long as reasonably necessary to provide the Service, maintain security and audit integrity, resolve disputes, enforce agreements, comply with law, and support legitimate business operations. The period depends on the record and why we hold it:
| Record | Current retention approach |
|---|---|
| Account and workspace | While active and for a reasonable period after closure for security, support, legal, and audit needs |
| Conversations and Projects | Until deleted or the account is closed, subject to backup, security, dispute, and legal retention |
| Raw uploaded files | Processed for text extraction and not intentionally retained as raw file bytes in the current implementation |
| Extracted text and model content | May be retained with the conversation, Project, or stored API request; provider copies follow provider controls |
| Routing, usage, savings, and feedback | For the period needed to display history, substantiate metrics, improve routing, and maintain auditability |
| Security and audit records | For the period reasonably needed to protect the Service, investigate incidents, and meet legal obligations |
Deleting a conversation or Project currently removes it from the active product through logical deletion. This may not immediately erase every underlying record or backup. We will delete or de-identify retained information when it is no longer reasonably needed, subject to technical limits and legal exceptions.
Security
We use safeguards designed to protect information, including authenticated access, tenant-scoped records, encrypted transport, signed short-lived internal service assertions, one-way API-key verifiers, secret separation, replay protection, spend controls, access logging, and production configuration checks. Raw customer API keys are shown once and are not stored for later display.
No method of storage or transmission is completely secure. You are responsible for protecting your credentials, choosing suitable content, and configuring customer-managed infrastructure. Contact us promptly if you suspect unauthorized access.
International processing
MainStreet AI and its service providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws. Where required, we use contractual or other approved safeguards for restricted transfers. Business customers may request an applicable data processing addendum before placing regulated personal information in the Service.
Your privacy rights
Depending on your location and relationship with MainStreet AI, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent; opt out of certain sale, sharing, targeted advertising, or profiling; and appeal a denied request. You may also complain to your local data-protection authority.
To make a request, email hello@mainstreetai.app. Describe the request and the account or workspace involved. We may need to verify your identity and authority. If your account is controlled by an organization, please direct content requests to that organization first; we will assist it as required. We will not discriminate against you for exercising an applicable right.
The Service does not currently sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer characteristics. Because those activities are not part of the current design, a “Do Not Sell or Share” link is not presently offered. We will honor legally recognized browser signals where applicable if such processing is introduced.
Children
The Service is intended for adults and business use and is not directed to children under 13. You must be at least 18 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
Changes and contact
We may update this Policy as the Service, vendors, or law changes. We will post the updated version and revise the date above. If a change is material, we will provide additional notice where required.
For privacy questions or requests, email hello@mainstreetai.app. The completed launch policy must also list the legal operator and mailing address. If a representative or data-protection contact is required for a market, it will be identified here before launch in that market.