Version 2026-10-05-v0.3 · Effective date 2026-10-11
ActAs Privacy Policy
Last updated: 19 October 2026
This policy explains how BRAIN TRUST PRIVATE LIMITED (Singapore, UEN 202416698H), trading as Fray, which provides ActAs ("we"), handles personal data. It covers actas.dev, the ActAs app, API and CLI, and email received for the domains customers connect (the "Service"). The Service is for businesses and developers. This policy still applies to the people who use it on their behalf.
1. Our role, your role, and Link's role
- Data about you as a customer: we decide. For your account, usage and support data, we're the organisation responsible under Singapore's Personal Data Protection Act 2012 (PDPA), and the "controller" under the EU and UK GDPR.
- Your Content: you decide. We process on your behalf the email your Agents receive or send, saved accounts, credentials and secrets, files and identity profiles. For that data, you're the controller and we act for you (a "data intermediary" under the PDPA, a "processor" under the GDPR). If someone emails your Agent, their data is part of your Content. They should contact you about it, and we'll help you respond.
- Payments: Link decides. Payments are handled by Stripe's affiliate Sold through Link, LLC ("Link") as merchant of record. Link collects your payment details and billing information at checkout and processes them under its own privacy policy at link.com/privacy. We never receive your full card number.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | sign-in email address, workspace name, sign-in sessions | you |
| Billing (from Stripe and Link) | name, email, billing country and address, any tax ID you give at checkout, subscription status, payment and invoice history | Stripe and Link |
| Usage and security | IP address, browser type, request times, the API client or Agent connection used, email volumes, bounce and complaint events, and an audit log of who accessed which resource and whether it was allowed | collected automatically |
| Support | messages you send us | you |
| Your Content | received and sent email (headers, body, attachments), saved accounts, usernames, passwords and other secrets, identity profile fields, files | you, your Agents, and people who email your Agents |
Audit logs record who acted, on what, and the outcome. They don't record request bodies or secret values.
Browser storage and cookies. We keep your sign-in session in your browser's storage, and short-lived setup state in session storage (never passwords). These are strictly necessary for the Service. We don't use advertising or cross-site tracking cookies, or third-party analytics or error-tracking tools. Our network provider, Cloudflare, may set security cookies. A homepage response checked on 2026-10-04 set no cookies, and Turnstile pre-clearance is disabled. Depending on enabled Cloudflare security features, Cloudflare may set cf_clearance or __cf_bm; a complete per-feature cookie inventory has not been verified.
How people find ActAs. Our own servers count visits and sign-ups, without cookies or browser identifiers. When you visit, we briefly use your IP address and browser type to create a pseudonymous key that changes every day, so we don't count the same visit twice. We don't store your IP address for this, and the key is deleted within 2 days. We record the campaign code and the referring website's domain, not the full address. If you create an account, we link your first visit and your sign-up to it. That link is deleted when you delete your account. After that we keep only aggregate counts. Known automated traffic is filtered out.
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Run your account, and receive, store and release your Content as you instruct | contract |
| Manage your subscription with Stripe and Link, and keep accounting records | contract; legal obligation |
| Prevent abuse, spam and fraud, including monitoring email volumes, bounces and complaints, and enforcing limits | legitimate interests (protecting the Service, our email reputation and other customers) |
| Send service email: sign-in links, security notices, payment and account-closure notices, and changes to our terms | contract; legitimate interests |
| Measure how people find and sign up for ActAs, and the Service in aggregate, for example counts of active identities | legitimate interests |
| Comply with the law and respond to lawful requests | legal obligation |
We don't sell personal data or "share" it for advertising, and we don't use your Content to train AI models. We don't read your Content except to operate the Service at your request, to investigate abuse or a security incident, or where the law requires it. Access to production systems is limited to a small number of named operators, and is used only for support, security and maintenance. Administrative actions in ActAs, and changes to our infrastructure configuration, are logged. Not every direct read of production data is individually logged today.
Under the PDPA, we use personal data for the purposes above with your consent or under the exceptions the PDPA allows. You can withdraw consent by deleting your account.
4. Service providers (sub-processors)
These providers help us run the Service. Each processes personal data only on our instructions, under a contract with us.
| Provider | What they do | Data | Location |
|---|---|---|---|
| Amazon Web Services (SES, S3, Lambda) | receive email for customers' connected domains (and our own mail.actas.dev), deliver sign-in email, and store the raw copy of received email | email content and metadata, sign-in email address | Singapore (ap-southeast-1) |
| Cloudflare (Workers, D1, DNS, network) | host the app and API; store account data and encrypted content | all Service data | global network; database: observed running in APAC; exact location and residency are not guaranteed |
| Convex | sign-in and account identity | sign-in email address, account identifiers | United States (aws-us-east-1) |
| Stripe | subscription management for our account (Link is merchant of record; see section 1) | billing data | United States and other Stripe locations |
| AgentMail | sign-in email for some accounts created before our current sign-in system, and one internal operations alert inbox | sign-in email address for those accounts | United States |
We'll update this list before a new provider processes your Content.
5. International transfers
We're based in Singapore. Our providers may process data in the United States and other countries. When we transfer personal data out of Singapore, we make sure it gets protection comparable to the PDPA's, as the PDPA requires. For data from the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) or another lawful mechanism.
6. How long we keep data
| Data | How long |
|---|---|
| Visit measurement | daily keys: up to 2 days. First visit and sign-up linked to your account: until you delete your account. Aggregate counts: kept |
| Raw copies of received email | Received email is first stored as a raw file in our Singapore storage bucket. The raw file is deleted automatically 30 days after it was received, whether or not it was processed. The storage provider runs this deletion, which may finish a short time after the 30 days |
| Email in your inbox | The processed message is stored encrypted, separately from the raw file. It stays until you delete it, delete the identity, or delete your account |
| Saved accounts, secrets, files | until you delete them, delete the identity, or delete your account |
| Account data | while your account exists, then as described in section 7 |
| Audit and security logs | 1 year |
| Billing records | as long as tax and accounting law requires (in Singapore, generally 5 years). Stripe and Link keep their own records under their policies |
| Accounts with an overdue payment | readable and exportable while overdue. The account may be closed after at least 60 days of non-payment, following the notices and billing check in our Terms, and is then deleted as described in section 7 (see our Terms, section 7) |
7. Export and deletion
Export. You can export your data from your account settings at any time, including while a payment is overdue. The export is JSON containing workspace and resource metadata, identity/account records, access-grant descriptions, stored mail contents and application audit records. Current credentials and other encrypted resource values are excluded by default. To include them, you must explicitly choose the secret-values option and confirm EXPORT DECRYPTED SECRETS. ActAs authentication tokens, raw MIME copies, and data held only by other providers are excluded. The export reflects live data; concurrent changes may appear in different sections.
Deleting an identity. You can delete an identity in the app. This straight away:
- stops access for that identity's Agent connections;
- stops new mail to its address.
We then start deleting its mail, saved accounts, secrets and files straight away. Database records are removed within 30 days. Raw copies of its received email expire automatically about 30 days after each message was received (see section 6).
Deleting your account. You can delete your whole account in your account settings. This:
- signs you out and revokes every Agent connection;
- stops mail to all your addresses;
- cancels your subscription;
- starts deleting your Content and account data straight away. Database records are removed within 30 days, and raw copies of received email expire automatically about 30 days after each message was received (see section 6).
The same applies when we close an account for non-payment.
Our storage provider runs the raw-email expiry asynchronously, so physical removal can finish a short time after the 30 days.
Backups. Deleted data can remain in our database provider's recovery copies for up to a further 30 days before those copies expire. They're used only to recover from a failure.
What we keep after deletion:
- a minimal record that an email address existed, so that it's never reassigned to another identity anywhere in ActAs;
- security records kept for the 1-year period above;
- billing and tax records the law requires.
None of these include your Content.
Deleting ActAs data doesn't delete accounts your Agents created on other websites. Contact those services separately. To delete payment data held by Link, contact Link (see section 1).
8. Security
- Credentials, secrets, identity profile values and the text of stored email are encrypted at rest with AES-256-GCM, using a key kept separately from the database. Raw received email and files are stored in a private storage bucket in Singapore with the storage provider's AES-256 encryption.
- API credentials and Agent connection tokens are shown once and stored only as hashes. Access is limited to specific identities, resources and actions, and you can revoke it. Access attempts are logged.
- This is not end-to-end encryption. ActAs can decrypt your Content in order to deliver it to the Agent connections you authorise.
If a data breach affects your personal data, we'll tell you without undue delay, and notify regulators where the law requires (under the PDPA, the Personal Data Protection Commission within 3 calendar days of assessing that a breach is notifiable; under the GDPR, the supervisory authority within 72 hours).
9. Your rights
Depending on where you live, you may have the right to:
- access your personal data and, under the PDPA, learn how it's been used or disclosed in the past year;
- correct it;
- delete it, or restrict or object to how it's used (GDPR);
- receive it in a portable format;
- withdraw consent;
- know, delete and correct your data, and not be treated differently for using these rights (California). We don't sell or share personal data, so there's nothing to opt out of.
You can export and delete your data yourself in the app (section 7). For anything else, email privacy@actas.dev. We aim to respond within 30 days. If we need longer, we'll tell you within those 30 days when we'll respond. We may need to confirm your identity first. You can also complain to Singapore's Personal Data Protection Commission or your local data protection authority.
If your data is in another customer's Content (for example, you emailed their Agent), contact that customer. If you can't reach them, we'll pass your request on.
10. Children
The Service isn't for anyone under 18, and we don't knowingly collect children's data. If you believe we have, contact us and we'll delete it.
11. When we disclose data
We disclose personal data only:
- to the providers in section 4, and to Link for payments;
- when you direct us, for example by releasing a credential to your Agent;
- to comply with the law or a valid legal request. We'll resist requests that are too broad, and we'll tell the affected customer unless we're forbidden to;
- to protect people or the Service from harm or fraud;
- to a buyer of or successor to the Service, which must honour this policy.
12. Contact
Data Protection Officer: you can reach our Data Protection Officer at privacy@actas.dev, or write to the Data Protection Officer, BRAIN TRUST PRIVATE LIMITED, 230 Compassvale Walk, #14-420, Singapore 540230.
13. Changes
We'll post changes here and update the date above. For material changes, we'll tell you by email or in the app at least 30 days before they apply.
Support: support@actas.dev · Privacy: privacy@actas.dev · Security: security@actas.dev