Privacy Policy

Star and Starspace, by Mainstar Inc. Version 1.0, effective 20 October 2026.

What we collect, why, and how you stay in control.

The short version

We keep what Star needs: your account, conversations, recordings, files and notes.
Your space and its backups are in the Netherlands; some providers are elsewhere.
AI and voice providers process what is needed to answer you.
No model is trained on customer content today. We may start, de-identified where practical. Anyone can object; Enterprise customers can opt out by contract.
We never sell your personal data and never use it for advertising.
You can export or delete your content in your space, or by e-mailing legal@mainstar.ai.

1. Who we are and our role

Mainstar Inc., a Delaware corporation, 2261 Market Street STE 64609, San Francisco, CA 94114, United States (“Mainstar”, “we”, “us”). Contact for all privacy matters: legal@mainstar.ai.

Personal accounts: Mainstar is the controller of your account, content and usage data.
Organisation spaces: the organisation is the controller of the content; we process it and related service data on its instructions to provide the Service. Mainstar is controller for account administration, billing, service-wide security, and its own evaluation and training (section 4). Section 3 covers our controller uses.
For organisations, our Data Processing Agreement forms part of the Terms on acceptance; no signature is needed.

Send every data-protection request to legal@mainstar.ai. If you are in the EU, the UK or Switzerland, you can also contact your local data protection supervisory authority.

We may receive personal data about you from people who use a space (for example a recording or a contact record), from their organisations, from services you connect, and from public company and contact sources.

2. What we collect

Account: your name, sign-in name and password (stored only as a one-way hash).
Your content: what you say (voice recordings and their transcripts) and type, files you upload, the companies, contacts, tasks and notes in your space, and what Star remembers about how you like to work.
Conversation records: transcripts kept in your space so Star can continue them. When a recording has several voices, our speech provider labels them as speaker 1, speaker 2 and so on for that recording only. We do not create voiceprints or use your voice to identify you.
Usage and technical data: when you accepted which version of our terms and this policy, sign-in times, IP address, browser type, error logs, which features you use and how well Star’s answers worked. We filter secrets out of logs.

Sensitive data. We do not ask for sensitive data (such as health, religion, political views or biometric data). Do not add it without a lawful ground and any consent the law requires, including any special-category condition; adding it or accepting our terms is not explicit consent.

3. How we use it, and our legal basis

To run your space and do what you ask: contract, where we have one with you; otherwise our legitimate interest in providing the Service to the organisation that uses it, or the organisation’s own basis where it is controller.
To keep the Service secure, prevent abuse, fix problems and send service notices: legitimate interest.
To understand how our sites and the Service are used (analytics): consent where the law requires it, otherwise legitimate interest (section 9).
To measure quality: we automatically score every conversation to find and fix failures (legitimate interest). The scores stay with your space and are deleted with it.
To evaluate, improve and train our own models and services: legitimate interest, see section 4.
To meet legal obligations: legal obligation.

We do not sell your personal data, share it for cross-context behavioural advertising, or use it for advertising of any kind. We make no decisions with legal or similar effects about you by automated means alone.

4. Evaluation, training and improvement

Today. No model is trained on content from customer spaces. Some of our test sets, which check Star’s answers, contain de-identified lines from customer conversations.
What we may do. Use content and usage data to evaluate, improve and train our own models and services.
How. Before using personal data this way we document an assessment that it is necessary and that people’s rights do not override our interest, and we remove names, contact details and other direct identifiers where practical. Data that does not meet these requirements, including sensitive data without the extra legal ground it needs, is excluded or anonymised. Only the people who build and test our models can access it.
Your right to object, wherever you live. Anyone, with or without an account, can object at legal@mainstar.ai. While we confirm who you are, we do not knowingly select your identifiable data for new training or test sets. Once verified, your content and usage data, past and future, are excluded from our later evaluation, test sets, improvement and training, including reuse of existing test sets. In-space quality scoring (section 3) continues.
Enterprise opt-out. Customers on an Enterprise plan can opt out in their agreement with us. The opt-out covers the customer’s content and usage data, past and future, in the same way.
Organisations. An organisation can object for its whole space. For our own uses, Mainstar gives any notice the law requires, including to people without an account.
Limits. Objections and opt-outs cover future use and do not ordinarily require retraining existing models. Your legal rights over identifiable data in our datasets or models still apply; removing identifiers does not always make data anonymous.
Memory. Star’s notes about you are content you can see and delete.

5. Who processes it for us

The parts of your content needed for each request go to providers in these categories, only for that purpose:

AI language models, AI routing services that pass requests to model providers, web search, speech recognition and voice;
hosting, storage and encrypted backups (Netherlands);
network delivery, encryption in transit and secure server access;
storage of our keys;
only if you use the related feature: sign-in with another account, company and contact look-ups, e-mail, calendar, messaging and social accounts you connect, e-mail sending, images, weather, phone notifications and payments.

The current provider list, with each one’s role and location, is at trust.mainstar.ai/subprocessors and from legal@mainstar.ai. We update that list before a new provider starts processing your content; organisations get 30 days’ notice and a right to object under our Data Processing Agreement. Our rule is to use AI and voice providers only on terms or settings under which they do not train their own models on content we send them. Some keep data for a limited time under their own terms, for example to detect abuse.

We also share data when the law requires it, to protect safety or our rights (telling you first where allowed), or with a successor in a merger or sale, under this policy.

6. International transfers

Mainstar and several providers are in the United States; the provider list names each provider’s processing countries. For transfers from the EU, UK or Switzerland, we use the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, and otherwise the European Commission’s standard contractual clauses with the UK and Swiss addenda. Ask legal@mainstar.ai for a copy of the safeguards, with confidential terms removed.

7. Where it is stored and how long

Files you upload are encrypted on disk by the app. Conversations, notes and other records are protected by access controls but are not separately encrypted on disk. Backups stay on our own servers or, when held by our storage provider, are encrypted first. We keep five-minute change copies for 7 days, nightly copies for 90 days, then delete them. Monthly copies are moving to the same 90-day limit; until that change is complete, older monthly copies may be kept longer.
Your content is kept while your account exists. Content you delete, or all content when you close your account, leaves your space at once. For organisations, return and deletion after the Service ends follow the Data Processing Agreement. Backups may keep it, outside ordinary use, for up to 90 days (older monthly copies longer, as above). If we restore a backup, we reapply deletions before the data is used again.
Test sets and any training data: kept while used to check or improve Star, reviewed at least every 12 months, and subject to your deletion and objection rights unless genuinely anonymous.
Acceptance records: as long as needed to show what you accepted. Billing records: as tax law requires.
Technical logs are kept only as long as needed for security and troubleshooting.
Providers processing for us keep data only as our terms with them allow; any retention for their own purposes, such as abuse monitoring, is noted in the provider list.

8. Your choices and rights

Export or delete your content: in your space, or by e-mailing legal@mainstar.ai; we confirm it is you first.
Ask us: anyone, with or without an account, can write to legal@mainstar.ai for access, a copy, a correction, a deletion, or to restrict or object to how we use their data. For content an organisation controls, we pass the request to it and help it answer. We answer within the legal deadline (generally one month) and confirm deletions in writing. You can complain to your data protection authority.
U.S. residents: where your state’s law applies, you can confirm, access, correct, delete or port your data, without being treated differently. An authorised agent may act for you with proof of authority. To appeal a refusal, write to the same address saying you are appealing; we answer within the legal deadline and tell you how to contact your state attorney general.
Categories (U.S. notice). In the last 12 months we collected identifiers; commercial information (subscriptions and billing); internet or network activity; audio and electronic information; professional information; and account login credentials, which are sensitive personal information. Sources: as in section 1. Purposes: section 3. We disclosed them to the providers in section 5 and, where section 5 applies, to authorities or a successor. We did not sell or share them for advertising. We use sensitive information to run the Service and, only where the law allows (section 4), for evaluation or training; where your law gives a right to limit that use, write to us.

9. Cookies

We use cookies and similar technology for sign-in, settings such as language and theme, and to understand how our sites and the Service are used (analytics), including across Mainstar’s own sites (for example star.mogos.ch and mainstar.ai). We do not sell this data or use it for third-party advertising. Where the law requires consent (for example in the EU, UK and Switzerland), we ask before setting non-essential cookies, and you can change your choice at any time.

10. Security

Passwords are hashed; connections, files you upload and backups held by our storage provider are encrypted. Each person’s data is kept separate. If a breach affects your data we tell you without undue delay and, where we can, within 72 hours of learning of it. No system is perfectly secure.

More on our security practices: trust.mainstar.ai

11. Children

The Service is for adults 18 and over and is not directed to children. If we learn we hold a child’s data, we delete it.

12. Changes and contact

We show you material updates in the Service before they take effect and ask you to acknowledge them. Acknowledging this policy is not consent to processing; where the law requires consent, we ask for it separately. Mainstar Inc., 2261 Market Street STE 64609, San Francisco, CA 94114, United States. E-mail legal@mainstar.ai.

Version 1.0 (privacy-public-v1.0), effective 20 October 2026. The English text is the binding version, except where mandatory consumer law requires otherwise.