PrimeGraph is a graph-based development platform that lets you define your system architecture as a graph and compiles it into production-ready code deployable to Firebase, Supabase, and Convex.

How does PrimeGraph work?

You describe your system using any AI agent (Claude, Cursor, Codex, Gemini) or built-in PrimeGraph agents. PrimeGraph transforms your description into connected architecture graphs (Models, Database, Frontend, Backend, Components, Service) and compiles them into deployable code.

What platforms does PrimeGraph deploy to?

PrimeGraph deploys to Supabase, Convex, and Firebase. You can create unlimited environments (dev, staging, prod) or export compiled code to GitHub.

Privacy Policy

Effective date: September 9, 2026

This policy describes how PrimeGraph, Inc. collects and processes personal data of users of the website at primegraph.ai and of the PrimeGraph application (together, the “Service”). Cookies and similar trackers are covered in the Cookie Policy, which forms part of this document.

1. Owner and Data Controller

PrimeGraph, Inc., a Delaware C Corporation incorporated on October 2, 2025 1111b South Governors Avenue, STE 40586, Dover, DE 19904, United States Phone: +1 (302) 520-3583 Representative and privacy contact: Andrei Mikhalenia, andrei@primegraph.ai

PrimeGraph, Inc. is the data controller (“Owner”) for the personal data described here. It is not the controller for the data handled by the applications you build and deploy with the Service in your own cloud projects; for those, you are the controller.

2. Types of Data collected

Personal data collected, directly or through third parties, includes:

Identity and contact data: email address, display name, profile picture, and the identifiers issued by the sign-in provider you use (Google, GitHub), as reported by Firebase Authentication.
Credentials: a password, when you sign up with one. It is handled by Firebase Authentication as a salted hash; the Owner never sees or stores the plaintext value. Sign-in by email link and password reset send a one-time link to your email address.
Account and membership data: the projects you belong to and your role in each (owner, editor, viewer), invitations, and sign-in timestamps.
Project content: architecture graphs, models, configuration, folders, versions, the code compiled from them and its exports, images and videos you upload to a project, environment variable names and values, and chat sessions with the built-in agents (your messages, the agents’ answers, and the graph changes they propose).
Secrets: values you mark as secret for your projects. They are stored only in Google Secret Manager, encrypted at rest, and are never displayed again after you set them.
Integration data: the GitHub App installation identifier and account, the repositories you select, an optional personal GitHub token for packages (stored encrypted in Google Secret Manager); the identifiers, project numbers, and display names of the Firebase projects you link, and the email of the deployer service account created in each.
Usage data: IP address, browser type and version, operating system, the pages and actions requested, timestamps, response codes, and other diagnostic information recorded by the servers and functions that run the Service.
Contact form data: name, email address, and the message you send through the website’s contact form.
Trackers: cookies and browser storage described in the Cookie Policy.

Complete details on each type of data are provided in the dedicated sections below. Data is provided by you directly or collected automatically when you use the Service. Except where stated otherwise, providing the data is necessary to use the Service: if you decline, the Owner may not be able to provide it. Where the Owner states that some data is optional, you are free not to provide it without consequences for the availability of the Service.

3. Mode and place of processing the Data

Methods of processing

The Owner processes data using computers and IT-enabled tools, following organizational procedures and modes strictly related to the purposes indicated. Besides the Owner, data may be accessible to internal personnel involved in operating the Service and to external processors (hosting providers, communication tools) appointed by the Owner. An up-to-date list of processors is in section 5.

Legal basis of processing

The Owner may process personal data relating to you if one of the following applies:

you have given consent for one or more specific purposes (for example, linking a Google Cloud project);
processing is necessary for the performance of an agreement with you or of pre-contractual obligations, in particular to provide the Service you signed up for;
processing is necessary for compliance with a legal obligation of the Owner;
processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party, such as keeping the Service secure, preventing abuse, and improving it.

In any case, the Owner will gladly clarify the specific legal basis that applies to a given processing, and in particular whether providing data is a statutory or contractual requirement.

Place

Data is processed at the Owner’s operating offices and in the data centers of the processors listed in section 5, which are located in the United States. Depending on your location, transfers to the United States may take place under safeguards described in section 7.

Retention time

Personal data is processed and stored for as long as required by the purpose it was collected for, and may be retained longer where a legal obligation or an order of an authority requires it:

Account, membership, and integration data: for as long as your account exists. There is no self-service account deletion yet; write to the contact in section 1 and the account and its data are deleted within 30 days of the request.
Project content, variables, secrets, and uploaded files: until the project owner deletes the project (which removes them from all storage and from Secret Manager), or with the account on request.
Usage data and operational logs: up to 30 days, unless a longer period is required for a security investigation or by law.
Contact form messages: for as long as needed to answer them and for the Owner’s records.

Once the retention period expires, the data is deleted and the rights of access, erasure, rectification, and portability can no longer be enforced.

4. The purposes of processing

Data is collected to:

provide the Service: registration and authentication, hosting of your projects, compilation and publishing of code, and the integrations you configure;
contact you about your account, your projects, and changes to the Service, and answer your requests;
keep the Service secure, prevent fraud and abuse, and diagnose failures;
improve the Service using aggregated usage information;
comply with legal obligations.

The Owner does not sell personal data and does not use it for advertising.

5. Detailed information on the processing of Personal Data

Personal data is processed with the following services, all of which are provided by the processors named next to them.

Registration and authentication

Firebase Authentication (Google LLC, United States) Sign-up and sign-in by email and password, Google, or GitHub. Personal data processed: email address, name, profile picture, provider identifiers, password hash, sign-in timestamps. Privacy policy

Hosting and backend infrastructure

Firebase Hosting, Cloud Firestore, Realtime Database, Cloud Storage, Cloud Functions, and Cloud Run (Google LLC, United States) Hosting of the website and application, storage of accounts, projects, graphs, variables, integration records, and job status, and execution of the backend that compiles and publishes code. Personal data processed: all data listed in section 2 except secret values and usage data. Privacy policy

Google Secret Manager (Google LLC, United States) Encrypted storage of secrets you enter for your projects and of integration tokens. Personal data processed: secret values, GitHub personal access tokens. Privacy policy

Infrastructure monitoring

Google Cloud Logging (Google LLC, United States) Server and function logs used for security, debugging, and abuse prevention. Personal data processed: usage data as described in section 2. Retained up to 30 days. Privacy policy

Integrations you enable

GitHub App and GitHub API (GitHub, Inc., United States) Delivery of compiled code and packages to the repositories you select. Personal data processed: installation identifier, account login, repository names, and, if you connect it, a personal access token. Privacy policy

Google Cloud APIs for Firebase project linking (Google LLC, United States) When you link a Firebase project to a project environment, the Service asks for the Google Cloud Platform scope (https://www.googleapis.com/auth/cloud-platform) and uses the resulting access token only during that request to: list the Firebase projects you can see; enable the Google APIs needed for the setup in the project you select; create a service account named primegraph-deployer there and grant it the roles required to deploy Cloud Functions, Firestore rules and indexes, and Realtime Database rules; and allow the Owner’s deployer identity to obtain short-lived tokens for that service account. The token is not stored. Personal data processed: Google account email, Firebase project identifiers and display names. Afterwards, the Service accesses your project only through the service account you authorized, and only to deliver what you publish.

The Owner’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements: Google user data is never sold, never used for advertising, and never read by humans except with your consent, for security purposes, or to comply with the law. You can withdraw the access by unlinking the environment in the Service, by removing the primegraph-deployer service account or its IAM binding in your Google Cloud project, or at myaccount.google.com/permissions .

AI agents

Google Cloud Vertex AI (Gemini models) (Google LLC, United States) The built-in agents that edit graphs and answer questions send your chat messages and the relevant project content (graphs, variable names, configuration) to Google’s Gemini models and to models the Owner fine-tuned on its own DSL corpus, both served through Google Cloud Vertex AI, in order to generate the answer. The search sub-agent may additionally send queries derived from your messages to Google Search grounding. Under the Google Cloud terms, Google does not use data submitted to Vertex AI to train its models, and the Owner does not use your messages or project content to train models either. Personal data processed: chat messages, project content, account identifiers attached to the session. Privacy policy , Google Cloud data processing terms

Contacting the user

Contact form (this website) By filling in the contact form you authorize the Owner to use the details you provide to answer your request. The submission is written to a mail queue in Cloud Firestore (Google LLC, United States) and delivered as an email to the Owner through the Firebase “Trigger Email” extension and Google Workspace. Personal data processed: name, email address, message content.

Transactional email (Firebase “Trigger Email” extension and Google Workspace, Google LLC, United States) Project invitations, wait-list confirmations, sign-in links, and password reset emails are sent to the address you provided from the Owner’s Google Workspace account. Personal data processed: email address, name, the project you were invited to. Privacy policy

The Service uses trackers. To learn more, read the Cookie Policy.

7. Further information for Users in the European Union

This section applies to users in the European Economic Area, the United Kingdom, and Switzerland and supplements the information above.

You may exercise the following rights, to the extent permitted by law:

Withdraw consent at any time where processing is based on consent.
Object to processing based on legitimate interests; the Owner will stop unless it has compelling legitimate grounds.
Access your data and obtain a copy.
Rectify inaccurate or incomplete data.
Restrict the processing, in which case the Owner will only store the data.
Erase your data.
Data portability: receive your data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
Lodge a complaint with your competent data protection authority.

Requests are addressed to the contact in section 1 and are answered free of charge as early as possible, and in any case within one month.

Transfers to the United States

The Owner and its processors are located in the United States. Transfers take place on the basis of the European Commission’s Standard Contractual Clauses or of another lawful safeguard, and you may request a copy of the safeguards used.

8. Further information for Users in the United States

This section applies to residents of California and of other US states with comparable privacy laws.

Categories of personal information collected: identifiers, account and commercial information, internet and network activity, and the content you submit, as described in section 2.
Sources: you, your sign-in provider, and the automatic operation of the Service.
Purposes and disclosures: those in sections 4 and 5. Information is disclosed only to the processors listed in section 5.
Sale or sharing: the Owner does not sell personal information and does not share it for cross-context behavioral advertising. No sensitive personal information is used to infer characteristics.
Your rights: to know what personal information is collected, used, and disclosed; to delete it; to correct it; to opt out of sale or sharing (not applicable, as none occurs); and not to be discriminated against for exercising these rights. Requests are addressed to the contact in section 1 and verified through your account.

9. Additional information about Data collection and processing

Legal action: your data may be used by the Owner for legal purposes, in court or in the stages leading to possible legal action arising from improper use of the Service.
System logs and maintenance: the Service and its processors may collect files that record interaction with the Service (system logs) and use other personal data such as IP addresses for operation and maintenance.
Security: data is encrypted in transit (TLS) and at rest; secrets and tokens live in Google Secret Manager; production access is restricted to authorized personnel; cross-project access to your Firebase projects uses short-lived tokens issued through Google IAM, and the Owner never stores service account keys.
Children: the Service is not directed to children under 16, and the Owner does not knowingly collect their data.
Changes to this policy: the Owner may update this policy; the effective date shows the latest version, and material changes are announced in the Service or by email.

10. Definitions and legal references

Personal Data: any information that directly, indirectly, or in connection with other information identifies or makes identifiable a natural person.
Usage Data: information collected automatically through the Service, such as IP addresses, browser and device details, request timestamps, and the pages or actions requested.
User: the individual using the Service who, unless otherwise specified, coincides with the data subject.
Data Controller (Owner): the natural or legal person that determines the purposes and means of the processing of personal data.
Data Processor: the natural or legal person that processes personal data on behalf of the Owner.
Service: the website at primegraph.ai and the PrimeGraph application.
Tracker: any technology, such as cookies, unique identifiers, or local storage, that enables tracking of users, as described in the Cookie Policy.

This policy is drafted with reference to the General Data Protection Regulation (EU) 2016/679 and to applicable United States state privacy laws.