OneXnect Privacy Policy

Effective date: November 6, 2026

1. Who we are and what this policy covers

OneXnect is a product of Mfini Inc. ("Mfini", "we", "us", "our"), a Delaware corporation based in Texas. This policy explains what personal information we handle when you use OneXnect, why, how long we keep it, who else receives it, and the choices you have.

OneXnect is the access and authorization layer between AI agents and the services, websites and tools they use for people. It serves businesses, not consumers. It is reached at:

https://www.onexnect.com (the website),
https://app.onexnect.com (the dashboard), and
https://api.onexnect.com (the API and the hosted sign-in page).

Together these are the "Service". This policy uses the same terms as our Terms of Service:

Customer: the business that signs up for OneXnect and calls the API (a "tenant" in the product).
End User: a person the Customer registers so that the Customer's agents can act for them (a "user" in the API).
Agent: software the Customer registers to act for its End Users.
Third-Party Service: what is on the other side: an API such as Gmail, a website, or an MCP server.
Connection: one End User's signed-in account on one Third-Party Service, which we keep for the Customer.

2. Two roles: whose data, who decides

We handle personal information in two different roles. Which one applies depends on whose information it is.

(a) Mfini decides (we are the controller). For the people who deal with us directly, we decide what we collect and why:

the Customer's staff who sign in to the dashboard (owners and developers),
the Customer's billing contacts,
visitors to the website, and
anyone who emails us.

Sections 3, 5 and 12.1 describe this information and your rights over it.

(b) The Customer decides (we are its processor or service provider). Everything about the Customer's End Users is handled on the Customer's instructions: the identifiers the Customer gives us, their Connections, the credentials and website sessions we keep for those Connections, what passes through tool calls, grants and decisions. The Customer decides which End Users exist, what its Agents may do, and which actions its app asks the End User about.

End Users never sign up with us. The Customer tells them about OneXnect and obtains any consent the law requires; our Terms of Service require it to. If you are an End User, please read the privacy notice of the business whose app you use, and send your requests to that business. We help it answer them (Section 12.2). Section 4 describes what we keep for Customers about End Users, so that you can see it too.

A data processing agreement is available to Customers on request at support@onexnect.com.

3. Information we collect as controller

Who	What	Why	How long
Dashboard staff	Name, email address, sign-in methods (such as Google or Apple), an optional second factor. Held by our sign-in provider, Clerk.	To let you sign in and to secure your account.	Until the account is deleted.
	Which Customers you belong to, and your role (owner or developer).	To show you the right Customer and to decide what you may change.	Until you are removed from the team.
	Your actions in the Activity log: which keys, team members, settings, grants and decisions changed, and by whom. Identifiers only, never content.	Security, and so the Customer can see who did what.	While the Customer's account exists.
	Invitations: the invited email address and the inviter. We keep only a hash of the invite link's token.	To let a teammate join, and to show who invited whom.	While the Customer's account exists (accepted, cancelled and expired invitations included).
	Waitlist sign-ups: the email address you give Clerk.	To approve sign-ups by hand until launch.	As long as Clerk keeps it under its standard terms.
The Customer	Name, slug, settings, limits, webhook endpoints.	To run the Service as the Customer set it up.	While the Customer's account exists.
	API keys: only a SHA-256 hash and a short prefix of each key, when it was last used, and the IP address it was last used from.	To check keys, to email owners when a key is used from a new address, and to show past keys.	While the Customer's account exists (revoked keys included).
Billing contacts (once paid plans start)	Stripe customer id, billing address, statements, payment ids. Stripe holds the card; we never see a card number.	To charge for the Service and to calculate sales tax.	7 years, for tax.
	Usage totals per Customer per hour: tool calls, browser minutes, new connections; each remote browser's id, purpose and minutes. No End User, Agent or content.	To bill the Customer and keep tax records.	7 years, for tax.
Website visitors	Our host Vercel's request logs: IP address, browser, the page requested. The site sets no cookies, runs no analytics and has no forms.	To serve the site and keep it secure.	As long as Vercel keeps them under its standard terms.
People who email us	Your email address, what you write, and our replies.	To answer you.	In our Google Workspace mail, as long as needed to answer you and keep a record of the conversation.

We email dashboard staff only about the Service: invitations, alerts to owners (a limit nearly or fully reached, a key used from a new address, a spike in use, a webhook endpoint switched off) and, once paid plans start, billing notices. We send no marketing email.

4. End User data we keep for Customers

This is what the Service keeps about End Users, on the Customer's instructions.

What	How it is kept	How long
The End User record: our id (`usr_…`), the Customer's own reference, an optional label and email address the Customer gives us, a hash of the End User's token.	Only the hash of the token is kept.	Until the Customer deletes the End User.
API connections through Composio (Gmail and others). Composio holds the OAuth tokens. We keep Composio's account id and the account's name, which is often an email address.		Until the Connection or the End User is deleted; then the account is revoked at Composio too.
API keys and tokens we hold directly, including tokens for MCP servers the End User adds.	Encrypted with a key only the Service holds, which we rotate.	Until the Connection or the End User is deleted.
Website sign-ins: the website's cookies and site storage, and the cookies of the identity provider the End User signed in with (such as Google). We do not keep the password: the End User types it into the website's own page.	Encrypted. The identity provider's cookies are loaded only into a remote browser our code drives, to sign back in to that website, never into a browser a person or an Agent uses.	Until the Connection or the End User is deleted. On request we first sign out on the website.
A copy of a page being browsed, to carry it from one remote browser to the next.	Encrypted.	Removed when the browse closes. A browse lasts at most its limit (30 minutes by default, up to 2 hours).
An action waiting for the End User's decision: its arguments; once it runs, its result.	Encrypted.	Undecided actions expire after 7 days. A result is handed over once and kept at most 24 hours.
Content passing through a call: emails, pages, files and anything else a Third-Party Service returns or an Agent sends.	Relayed to the Customer as sent.	Not kept beyond the call, except as in the row above.
Grants and settings: which Agents may use which services, and whether each action runs at once, asks, or is refused.		Until changed or the End User is deleted.
Activity log entries about End Users (a grant changed, an action approved or declined).	Identifiers only, never content.	While the Customer's account exists.
Rate-limit counters and limit alerts.	Counts and identifiers, no content.	About 8 days (counters) and 31 days (alerts).
Webhook events sent to the Customer's own servers, and the delivery log.	Thin events: the event type and identifiers, never content.	30 days.
Logs.	No content and no credentials. Errors are shortened before they are logged.	As long as our host, Render, keeps them under its standard terms.

5. How we use information

We use the information above only to provide, secure and bill for the Service:

to keep Connections and run the tool calls and browsing the Customer's Agents ask for, within the grants and settings the Customer and its End Users chose;
to ask the End User, through the Customer's app, before an action runs, unless the End User allowed it;
to sign Customer staff in to the dashboard and show them their Customer;
to enforce the limits and pauses the Customer sets, and to email owners alerts;
to detect and stop misuse, and to investigate problems;
to count usage, bill the Customer and keep tax records;
to answer email and send the service emails in Section 3;
to comply with the law.

Legal bases (EEA and UK). Where we are the controller, we rely on: performing our contract with the Customer; our legitimate interests in running a secure, reliable Service for the Customer whose staff you are, and in answering you; and our legal obligations, such as keeping tax records. Where we act for a Customer, the Customer is responsible for the legal basis.

6. What we do not do

We do not sell personal information, or share it for cross-context behavioral advertising. We show no ads.
We do not use Customer or End User data to train AI models, ours or anyone's.
We do not run AI models on anyone's data. No AI model provider is among our subprocessors.
We do not read, judge or reshape what passes through a call. It is relayed as the Third-Party Service sent it. The one exception is the Customer's own choice: an optional sensitive-data screen, off by default and turned on by the Customer's owners in the dashboard, which masks card, bank and password data in results and refuses it in arguments.
We do not use tracking cookies or analytics on the website or the dashboard.
We do not enter passwords for End Users, complete CAPTCHAs, or get past a website's bot checks.

7. Google user data

When an End User connects a Google account (such as Gmail) through OneXnect, we receive information from Google APIs for that End User. OneXnect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

Use. We use Google user data only to provide the user-facing features that the Customer's app requests on the End User's behalf, within the grants the End User and the Customer set: for example, reading or sending email when the End User's Agent asks to.
Transfer. We do not transfer Google user data to others except as needed to provide those features (to the Customer's app that requested it, and to the subprocessors that run the Service), for security purposes, or to comply with the law.
No advertising. We do not use or transfer Google user data for advertising, including retargeting or interest-based ads, and we do not sell it.
No AI training. We do not use Google user data to develop, improve or train AI or machine-learning models.
No human reading. No person at Mfini reads Google user data unless the End User has agreed to it for specific data, it is needed for security purposes (such as investigating abuse), or it is required by law.

Google user data passing through a call is not kept beyond the call, except as described in Section 4.

8. How we share information

With the Customer. We give the Customer what its Agents ask for through the API, within the grants and settings in force, and the events it subscribes to.

With our subprocessors. We use a small number of companies to run the Service: Composio (API connections), Browserbase (remote browsers for website sign-in and browsing), Render (the API, worker and database; with Cloudflare in front), Vercel (the website and dashboard), Clerk (dashboard sign-in), SendGrid (email), Stripe (card payments), ZipTax (sales-tax rates; it receives a billing address only) and Google Workspace (our own email). Each receives only what it needs for its task. The subprocessors page lists what each one receives and where.

Two of them see End User data directly:

Composio holds the OAuth tokens for API connections it manages and runs those tool calls, so it receives the calls and their results.
Browserbase runs the remote browser, so it receives the pages visited, the session loaded into the browser, and what the End User types on the sign-in page. Browserbase keeps session data and files downloaded during a browse as long as its standard terms provide.

With Third-Party Services, on the End User's instruction. When an Agent uses a Connection, we send its request to that Third-Party Service (Gmail, a website, an MCP server the End User added). These are the End User's own accounts, under those services' own terms and privacy policies. They are not our subprocessors.

For legal reasons. We may disclose information if the law, a court order or a government request requires it, or where needed to protect the rights, property or safety of our Customers, End Users, the public or Mfini.

We do not share personal information for any other purpose.

9. Cookies and local storage

The website (www.onexnect.com) sets no cookies and runs no analytics.
The dashboard (app.onexnect.com) uses Clerk's cookies to keep staff signed in. They are strictly necessary. It also keeps, in your browser's local storage, which Customer you last used.
The hosted sign-in page (api.onexnect.com/sign-in/…) sets one strictly necessary cookie, for 30 minutes, so that a sign-in link opens only in the first browser that used it.

Because we use no tracking or analytics cookies, there is no cookie banner. If that changes, we will update this section first.

10. Security

We protect information with measures including:

credentials and website sessions encrypted at rest, with a key only the Service holds, which we rotate;
credentials added to requests at the network layer, never returned to an Agent or a model, never written to a log, and removed from a Third-Party Service's response even when it repeats one;
database row-level security that separates each Customer and each End User, with the application connected as a restricted database role;
API keys and End User tokens stored only as hashes; a Customer's key alone cannot act for any End User;
sign-in links that are signed, expire after 30 minutes, open in the first browser only and are spent when finished;
identity-provider sessions (Google, Apple, Microsoft) never placed in a browser a person or an Agent drives;
actions that change data ask the End User by default; limits can be changed only on the dashboard, by owners;
no browser runs on our servers (remote browsers only);
TLS for all traffic; secrets kept in our host's environment, not in code; a weekly audit of our software dependencies.

We hold no security certification (such as SOC 2 or ISO 27001). No system is perfectly secure. If we learn of a breach affecting personal information, we will notify affected Customers without undue delay, and within 72 hours of confirming it, and others where the law requires. To report a vulnerability, email security@onexnect.com.

11. Retention and deletion

We keep information for the periods in Sections 3 and 4, then delete it.

Deleting an End User. A Customer deletes an End User through the API. Everything kept for that End User is deleted, and the End User's Connections are revoked at the Third-Party Service (at Composio for Composio-managed connections).
Deleting a Connection. A Customer can delete one Connection on its own. For a website, it can ask us to sign out on the website first.
Closing a Customer account. An owner emails support@onexnect.com; we close the account and delete its data within 30 days. Records that tax law requires us to keep are kept for that period.
Dashboard staff. An owner can remove a member from the team. To delete your account, use Delete account on the dashboard's Account page where it is offered, or email support@onexnect.com.
Backups. Deleted data may remain in our database host's backups until they expire, as Render keeps them under its standard terms.

12. Your rights

12.1 Dashboard staff, billing contacts, visitors and people who email us

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy;
correct it;
delete it;
receive it in a portable format;
object to, or ask us to restrict, how we use it;
not be treated differently for using these rights.

Many details can be changed directly: your name, email addresses and sign-in methods on the dashboard's Account page. For anything else, email support@onexnect.com. We may need to confirm your identity first. We will answer within the time the law requires (for example, one month under the GDPR, or 45 days under California law). If we decline a request, we will say why, and you can appeal by replying to that decision; we answer an appeal within 45 days.

EEA and UK. You may also complain to your local data protection authority.

California and other US states. In the last 12 months we collected the categories in Section 3: identifiers (name, email address, IP address), commercial information (billing records), and internet activity (request logs). We used them only for the purposes in Section 5. We did not sell them or share them for cross-context behavioral advertising, and we do not use sensitive personal information to infer anything about you.

12.2 End Users

The Customer decides about your data, so please send your request to the business whose app you use. It can delete you through the API, which deletes everything kept for you and revokes your Connections. If you contact us directly, we will tell you to contact the Customer and, where we can identify it, let it know. We help Customers answer their End Users' requests.

13. Where your information is stored

We store information in the United States (Oregon), and our subprocessors process it mainly in the United States (see the subprocessors page). If you are outside the United States, your information is transferred there. Where the law requires a transfer mechanism for personal information from the EEA, UK or Switzerland, we rely on the one it provides, such as the European Commission's Standard Contractual Clauses, which our Data Processing Agreement (available on request) includes.

14. Children

The Service is for businesses. It is not directed at children under 16 (under 13 in the United States), and we do not knowingly collect their personal information. If we learn that we hold a child's information in breach of this, we will delete it, or ask the Customer to.

15. Changes to this policy

We may update this policy as the Service changes. For a material change, we will email each Customer's owners and post the new version on this page at least 30 days before it takes effect. The effective date at the top shows the current version. Earlier versions are available on request.

16. Contact

For questions about privacy, or to exercise your rights:

Mfini Inc. 1401 Lavaca St, Ste 558 Austin, TX 78701 United States

Email: support@onexnect.com