This Privacy Policy explains how PairRail collects, uses, and shares information when you use PairRail Atlas on pairrail.com and related APIs.
1. Who this covers
- Seller users who sign in to the console (Google or GitHub via Firebase Authentication).
- Visitors to the marketing site and public protocol endpoints.
- Agents and integrators that call protocol or OpenAPI surfaces.
- Job applicants who write to us about working at PairRail (see section 10).
Actions by PairRail’s own staff (operators) are not forwarded to the seller product telemetry pipeline described below.
2. Information we collect
Account and authentication
When you sign in with Google or GitHub through Firebase Authentication, we receive identifiers such as email address, display name, profile photo URL (if provided by the identity provider), user UID, and sign-in provider. Session tokens may be held in browser session storage for the console. Firebase and the identity provider may set their own cookies or local storage as described in our Cookie Notice.
Seller workspace and commercial content
To operate Atlas we process Customer Content you submit or generate in-product, including organization/workspace identifiers, seller profiles, catalog versions, pricing and packaging, evidence metadata, publication state, onboarding inputs, extraction previews, readiness reports, and configuration for protocol publication (MCP, UCP, ACP, A2A, UAP, and related feeds).
Billing
If you subscribe to a paid plan, checkout and payment details are handled by our payment partner (e.g., Dodo Payments). We receive subscription status, plan identifiers, and related billing metadata needed to entitle features, not full card numbers.
Product telemetry and feedback (Cloudflare edge)
For seller users (not operators), we may record operational events to Cloudflare-backed storage (D1 database and, where attachments are provided, R2 object storage), including:
- Auth events: login-related signals such as email, UID, provider, organization/workspace IDs, plan, coarse location metadata (e.g., country from the edge), and limited metadata.
- Action events: console actions such as catalog edits, pricing previews, extracts, and similar product operations, with associated user and workspace identifiers.
- Protocol usage: protocol name, endpoint, seller ID, optional agent name, operation, latency, status code, and country for agent/API traffic analytics.
- Feedback: category, message, optional email/seller ID, and optional attachments (screenshots or traces) stored in object storage.
Technical and security logs
Like most web services, our hosts, CDN, and application layers may process IP addresses, user agents, request paths, timestamps, and error diagnostics for security, reliability, and abuse prevention.
3. How we use information
- Provide, secure, and improve the Service (including protocol serving, extraction, and governance features).
- Authenticate users, enforce roles and plan limits, and process billing entitlements.
- Monitor reliability, diagnose issues, and prevent abuse.
- Respond to support and feedback requests.
- Follow up with people who sign up. When you create a workspace, your email, name and company name are recorded in our internal sales tool, along with later product milestones (such as connecting billing or issuing an agent key), so we can contact you about getting started with PairRail.
- Comply with legal obligations and enforce our Terms and Acceptable Use Policy.
We do not sell personal information.
4. Sharing
We share information with:
- Infrastructure and auth processors: listed on Subprocessors, including Google Cloud (Firebase Authentication and Hosting, Cloud Run, Cloud Storage, Gemini / Vertex AI), Cloudflare (catalog and workspace storage, edge telemetry/feedback storage, DNS/CDN, and Workers AI model inference for extraction), Groq (model inference for extraction), Anthropic (Claude model inference for extraction and Deep verification), Resend (transactional mail), and our payment provider for subscription checkout. Content you submit for AI extraction (pricing pages, files, screenshots) is sent to these AI providers only to produce your extraction or verification.
- Payment processors: for subscription checkout and webhooks.
- Identity providers you choose: Google or GitHub, under their policies when you authenticate.
- Professional advisors or authorities when required by law or to protect rights and safety.
Published protocol endpoints intentionally expose the commercial data you choose to publish so that buying agents and integrators can discover offers. That exposure is controlled by your publication settings, not by this Privacy Policy alone.
5. Retention and deletion
Sandbox keeps about 14 days of activity. Pro retains audit trail and catalog versions for 90 days. Enterprise can extend retention under contract. We also keep account and billing metadata as needed to operate the Service, meet legal obligations, resolve disputes, and maintain security.
Workspace owners can delete a workspace themselves in Workspace → Settings. Agent access stops at once; 14 days later we delete the catalog, agent keys, quotes, audit trail and the owner’s account. The owner can cancel during those 14 days. We keep a record of quote amounts and dates, without personal data, to resolve disputes, and billing records we are required to keep. Teammates can leave a workspace or delete their own account from the same page; that removes their sign-in and personal data straight away. You can also email support@pairrail.com.
We keep recent saved versions of the Service’s state for up to 30 days so we can recover from mistakes. Deleted data leaves those versions as they expire; until then we only use them to restore a workspace, and only at the owner’s request. Logs may keep limited records for a similar period. Product usage analytics (sign-ins, workspace actions, agent requests and feedback) are deleted after 90 days. See the Data Processing Terms.
6. Security
We apply administrative and technical safeguards appropriate to a B2B SaaS control plane. No method of transmission or storage is perfectly secure. See our Security & Responsible Disclosure page for how to report vulnerabilities.
7. International processing
PairRail may process data in the United States and other countries where our providers operate. If you access the Service from elsewhere, you understand that information may be transferred to those locations.
8. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. In Workspace → Settings you can download your own data, download the whole workspace (owners), delete your account, or delete the workspace (owners). For anything else, contact support@pairrail.com. We may need to verify your identity before fulfilling a request. You can sign out of the console and revoke Google/GitHub access via those providers.
9. Children
The Service is intended for business users and is not directed to children under 16. We do not knowingly collect personal information from children.
10. Job applicants
If you write to us about working at PairRail, for example at careers@pairrail.com, we receive what you choose to send, such as your name, email address, CV, links and note. We use it only to consider you for roles at PairRail and to reply to you. We keep it only as long as we need it for that, and we delete it sooner if you ask at the same address.
11. Changes
We may update this Policy by posting a revised version with a new “Last updated” date. Material changes will be highlighted in-product or by email when practicable.
12. Contact
Privacy questions: support@pairrail.com. Security incidents: security@pairrail.com.
Enterprise customers can request an executable DPA from the Data Processing Terms page.