1. Introduction

This Privacy Policy explains how Preframe Inc. ("Preframe," "we," "us," or "our") collects, uses, shares, and retains information when you use our website, application, and related services (collectively, the "Service"). By using the Service you agree to this Policy and to our Terms of Service.

2. Information We Collect

Account & profile information

When you sign up we collect your email address, name, and a password (stored hashed by our authentication provider, Supabase). If you sign in with Google or GitHub, we receive your email address, name, and profile photo only. We never receive or store your Google or GitHub password.

Payment information

Payments are processed by Stripe, Inc. Card numbers, security codes, and bank account details are submitted directly to Stripe and never touch Preframe's servers. We retain your email, organization identifier, subscription tier, billing status, and Stripe customer reference.

Workspace data you provide

We store the account lists, contacts, research questions, ICP and scoring preferences, sequences, email templates, and message content you upload or create inside Preframe.

Connected mailbox data

When you connect a Gmail, Outlook, or SMTP mailbox to Preframe to send sequences, we read and store message metadata (sender, recipient, subject, timestamps, thread identifiers) and the body content of messages sent or received through Preframe-managed campaigns. We use this information to send your sequences, detect replies, classify out-of-office and bounce notifications, and route replies to the address you designate. We do not read or index personal email outside of Preframe-related threads. See Section 5 for Google API Limited Use details.

Contact data and enrichment

When you use Lead Search, we query third-party enrichment providers (currently Hunter.io) to look up professional contact information such as business email address, job title, seniority, department, and public social profile URLs. Returned contact records are cached in your workspace to power future searches and to power campaigns you choose to send. We do not enrich consumer-personal data.

Research inputs and outputs

Research sends your research question, the target account name, and snippets of publicly available web content to our AI providers (currently Alibaba Qwen and Google Gemini) so they can extract an answer. We store the extracted answer, a confidence grade, and the source URLs in your workspace. We instruct Qwen, via theX-DashScope-DataInspectionheader, not to log inputs or outputs for inspection.

Automatically collected information

• Device and browser data (user agent, operating system, IP address)
• Usage events (pages viewed, features used, errors encountered)
• Session cookies set by our authentication provider (httpOnly, secure, sameSite=lax)
• Aggregate, privacy-preserving analytics from Vercel Analytics on the marketing site

We do not currently load third-party advertising or marketing cookies.

3. How We Use Information

• To provide, operate, and improve the Service
• To authenticate you and maintain your session
• To run the sequences, research jobs, scoring, and reply routing you configure
• To detect bounces, unsubscribes, and out-of-office notifications and update your suppression list
• To bill you for the Service and prevent payment fraud
• To send transactional emails (verification, password reset, billing notices, security alerts)
• To monitor usage for compliance with our Terms of Service and to investigate abuse
• To comply with legal obligations and respond to lawful requests

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. How We Share Information (Subprocessors)

We share information only as needed to operate the Service, with the following categories of recipients:

• Hosting and database: Supabase (Postgres + auth), Vercel (application hosting), Inngest (background job queue)
• Payments: Stripe
• Email integrations: Google (Gmail API), Microsoft (Graph API), and SMTP servers you configure
• Identity providers: Google and GitHub OAuth for sign-in
• Contact enrichment: Hunter.io
• AI providers: Alibaba DashScope (Qwen models) and Google (Gemini models) for Research extraction and search query optimization
• Web fetching: our scraper service and upstream proxy providers used to retrieve public web pages for research
• Analytics: Vercel Analytics (marketing site only)
• Professional advisors: auditors, lawyers, and accountants under confidentiality obligations
• Law enforcement and regulators: when legally required
• In a corporate transaction: as part of a merger, acquisition, financing, or asset sale, subject to a successor entity honoring this Policy

Each subprocessor is bound by contract to use the information only to provide their service to Preframe and to protect it consistent with this Policy. A current list of subprocessors is available on request at support@preframe.io.

5. Google API Services User Data Policy & Limited Use

Preframe's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

When you connect a Gmail account, you grant Preframe the minimum OAuth scopes needed to send your campaigns, detect replies, and keep the sender name you configure in Preframe aligned with Gmail's Send Mail As display name. We do not request Gmail message-modification access.

• gmail.send: to send the messages you compose and schedule in Preframe, only from the mailbox you connect and only after you grant consent. We never send from an account that has not authorized access.
• gmail.readonly: to detect replies to your own sent mail so we can thread conversations and automatically stop scheduled follow-ups once a recipient responds. We do not read, index, or store messages unrelated to your campaigns.
• gmail.settings.basic: to update only the Gmail Send Mail As display name for the same connected mailbox when you edit the sender name in Preframe. We do not use this scope to create or delete aliases, change forwarding, filters, delegates, vacation settings, signatures, SMTP relay settings, or any other Gmail settings.

We do not request gmail.modify, and we do not use the Gmail API to modify message labels, read/unread state, or trash/delete state.

We use Google user data exclusively to provide and improve the user-facing features of Preframe. Specifically, we do not:

• Use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising
• Sell, transfer, or disclose Google user data to data brokers, information resellers, or any other party not necessary to provide the Service
• Use Google user data to train, fine-tune, or otherwise develop generalized machine-learning or AI models
• Permit humans to read Google user data unless we have your explicit consent, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data is aggregated and used for internal operations consistent with the Limited Use policy

Gmail credentials are encrypted at rest using application-layer encryption. You may revoke Preframe's access at any time from your Google account permissions page or by disconnecting the mailbox in the Preframe app.

6. Microsoft 365 / Outlook

When you connect a Microsoft 365 or Outlook mailbox, Preframe uses the Microsoft Graph API to send your sequences and to read messages in Preframe-related threads in order to detect replies, bounces, and out-of-office notifications. Microsoft credentials are encrypted at rest using application-layer encryption. You can revoke Preframe's access from your Microsoft account at any time.

7. Data Retention

• Account, workspace, contact, and message data is retained for the duration of your subscription and for a limited period after termination so we can restore the account on request.
• After 90 days from termination we begin deleting workspace data. We may retain aggregated, anonymized data and information we are required to keep for legal, accounting, or fraud-prevention purposes.
• Mailbox tokens and credentials are deleted when you disconnect a mailbox or close your account.
• You can request deletion of your account and personal information at any time by emailing support@preframe.io.

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect information against loss, misuse, and unauthorized access. These include encryption in transit (TLS), encryption at rest for credentials and tokens, role-based access controls, audit logging, secure software development practices, and regular review of third-party subprocessors. No system is perfectly secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your personal information (subject to legal exceptions)
• Restrict or object to certain processing
• Request a portable copy of your information
• Withdraw consent where processing relies on consent
• Lodge a complaint with a supervisory authority in your region

To exercise any of these rights, email support@preframe.io from the address on file with your account. We will respond within the timeframe required by applicable law.

California residents have specific rights under the CCPA and CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing of personal information. Preframe does not sell personal information and does not share it for cross-context behavioral advertising.

10. International Data Transfers

Preframe and several of our subprocessors operate in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms approved by the relevant supervisory authorities to lawfully transfer personal data from the European Economic Area, the United Kingdom, and Switzerland.

11. Children's Privacy

Preframe is intended for use by businesses and professionals. The Service is not directed to children under 16 and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us at support@preframe.io and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or by an in-product notice. The "Last updated" date at the top reflects the latest revision. Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.

13. Contact Us

Questions about this Policy or our privacy practices may be sent to support@preframe.io.