Privacy Policy

When you visit the website or talk to us about the products, we collect your name, work email, and company, along with anything else you tell us in a message or a form. Standard web analytics — pages visited, referring site, approximate location from your IP address, device and browser type — come through Google Analytics, and Cloudflare handles performance and abuse monitoring at the network edge.

Data collection from the deployed products is limited by design, because Quin, Aegis, and Drona are built to operate inside your environment rather than to send data back to us. Quin's scanner reads source code, dependency manifests, and running environments to identify agents and their permissions; what happens to that information is set out in your order form, since the right answer depends on the deployment. Aegis's Policy Server records identity and policy metadata for each access decision, not the request content your agents are acting on. What Gaincontrol itself collects about product usage is account information, support records, and operational telemetry about the software — error rates, latency, uptime. Your audit ledger is not something we have visibility into.

This information is used to respond to inquiries, set up and support accounts, invoice for services, and operate and improve the website and products. Product improvement draws on the operational telemetry described above, not on customer security data. If you've asked us for something — a reply, a product update — we send it; contacts are not added to a marketing list without an opt-in.

The website sets three cookies: one for your language preference, one that Cloudflare assigns based on your approximate country (used only to suggest a locale — it does not change what search engines or AI crawlers see), and the standard Google Analytics set. Disabling any of them in your browser has no effect beyond the site forgetting your language setting.

A small number of vendors run parts of the business for us: Cloudflare for hosting and network security, Google for analytics, and standard CRM and email tools for sales and support. Each is bound by a contract limiting their use of the data to that specific function. Personal information is not sold, and it is not disclosed beyond these vendors except where required by law or necessary to protect someone's safety.

Business records are kept for as long as the relationship requires, plus any additional period a tax or audit obligation imposes. Analytics data follows Google's standard retention window, currently 14 months. Data the products generate about your environment is retained according to your order form, typically for the life of the deployment.

We protect the information we hold with encryption in transit, access controls scoped to what each system needs, and the practices described on our Trust page. No system is fully secure, and we don't represent otherwise.

If you find a vulnerability in gaincontrol.ai, Quin, Aegis, or Drona, email security@gaincontrol.ai with details and reproduction steps. We acknowledge credible reports promptly and will not pursue legal action over good-faith testing conducted against your own account or a system you're authorized to test.

Depending on where you live, you may have rights under GDPR, UK data protection law, or a U.S. state privacy law to access, correct, delete, or obtain a copy of the personal information we hold about you, or to object to certain processing. We have not sold personal information, so there is nothing to opt out of on that basis. Send requests to privacy@gaincontrol.ai with enough detail to identify the relevant record, and we will respond within the period the applicable law requires. If you're in the EEA or UK, you may also lodge a complaint with your local data protection authority.

Gaincontrol is based in Singapore and uses infrastructure and vendors in multiple countries, so personal information may be processed outside your own. Where the law requires a specific safeguard for that transfer, such as standard contractual clauses, we apply it.

Our website and products are built for security and platform teams and are not directed at children. We do not knowingly collect personal information from anyone under 16.

We update the date at the top of this page when it changes, and provide more direct notice if a change is significant.

Privacy questions and data requests: privacy@gaincontrol.ai. Security reports: security@gaincontrol.ai. Everything else: our Contact page.