Privacy policy

Last updated November 3, 2026

This text is still being finished. The parts marked "to be completed" are not final.

Who is responsible

The controller of your data (the person or company that decides how it is used) is [to be completed], tax ID [to be completed], with address at [to be completed]. You can write to us at [to be completed].

What we collect

  • Your account: your email, your name, your language, your time zone and your currency. There are no passwords: you log in with a link we email you.
  • What you write and store: notes, tasks, appointments, contacts, projects, comments, the files you attach, your conversations with the assistant and your history of searches. Everything is in a work group: the people in that group can see it.
  • Your devices: for each login, the browser and system, the last time it was used and, to help you notice a login that is not yours, an approximate city and country. To find the city we send the address of your connection to a public location service, ipwho.is, at the moment you log in. We do not store the address.
  • What you use and pay: the AI tokens and the storage you use, your balance and every movement of it, and your purchases (amount, currency, date and the reference of the payment). Your card details go to Stripe and never reach us.
  • Errors: when something breaks, the error is recorded to fix it, without the values you sent in the request.

We do not use your data to show advertising and we do not sell it.

Back to contents

Why we use your data

  • To give you the service you asked for (contract: what we need to do to give you what you signed up for): storing and organizing what you write, sending you the emails you need to log in and the notifications you choose.
  • To keep it safe (legitimate interest: our own reason, as long as it does not override your rights): recognizing your devices, limiting abuse and fixing errors.
  • To charge and to comply with the law (contract and legal obligation: what the law asks us to do): handling your purchases, refunds and the records that tax law asks us to keep.

Back to contents

The AI

When you write to the assistant, your text and the last messages of that conversation are sent to an AI provider to be understood and filed. When you ask it about what you already have, a few of your items (at most ten, with their titles and a short excerpt) are sent too. Nothing else of yours is sent to the AI.

The providers we use are chosen by us and may change; at this moment: [to be completed: list the AI providers in use and what each does with the data, including whether it uses it for training].

The AI can be wrong. Everything it does is shown to you and can be undone, and it cannot delete your data on its own.

Back to contents

Who else receives your data

We use these services to run Brain, each only for what is needed:

  • AI providers, to understand what you write (see above).
  • File storage, to keep your attachments: [to be completed: provider and region].
  • Hosting of the application and its database: [to be completed: provider and region].
  • Email delivery, to send you login links and notifications: [to be completed: provider].
  • Stripe, to take payments and make refunds.
  • ipwho.is, to find the approximate city of a login (see above).

Inside a work group, the other members see what is in the group. We give your data to authorities only when the law obliges us to.

Back to contents

Transfers outside your country

Some of these providers are in other countries, such as the United States. [to be completed: the safeguards used for each transfer, for example the standard contractual clauses or an adequacy decision].

How long we keep it, and deleting your account

  • Your content stays until you delete it. When you delete your account it is scheduled for 30 days later, so you can cancel; then your content, your files and the groups only you belong to are deleted.
  • Notifications you have read are deleted after 30 days.
  • Purchases and invoices are kept as long as the law requires: [to be completed: period].
  • Backups: [to be completed: how long backups are kept].

Back to contents

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a usable format. You can also withdraw any consent you gave.

  • You can change your details and delete your account yourself in Settings.
  • You can export your contacts as vCard files and download all the files of a workspace in one ZIP.
  • For anything else write to [to be completed]. We answer within one month.

If you think we are not handling your data properly you can complain to the data protection authority of [to be completed].

Back to contents

Cookies

We use only the cookies the service needs: one that keeps you logged in and the protections against forged requests. We do not use analytics or advertising cookies, so there is nothing to accept.

Changes and contact

If we change this policy in a way that matters, we will tell you by email before it applies. The date at the top is the last change. Questions: [to be completed].

The rules of the service are in the terms of use.

Back to contents