Privacy Policy

Brrainy is operated by Brrainy, Inc.(“we”, “us”). We are the data controller for the information described below. For anything in this policy, contact us at privacy@brrainy.com.

Brrainy is a memory layer. You connect sources - email, calendars, chat, documents, code, AI assistant conversations, health data - and we ingest that content, organise it, and serve it back to you and to AI agents you authorise.

That means the content you connect is the product. We hold it so we can search it, connect it, and generate briefs from it. This policy exists to be specific about what that involves.

Account data. Email address, name, authentication credentials, and the organisations and spaces you belong to.

Content you connect or create. Messages, emails, calendar events, documents, files, notes, highlights, AI assistant conversations, health and fitness metrics, and anything else captured by a connector you enable or a device you install. This includes derived data: extracted entities, embeddings, summaries, and the knowledge graph built from it.

Usage data. Product events such as sign-in, feature use and activation milestones, used to operate and improve the service.

Billing data. Handled by our payment processors. We do not store full card numbers.

Credentials for connected services. Access tokens for sources you connect, encrypted at rest and scoped to the space you added them to.

Where GDPR applies, we rely on: contract for operating the service you signed up for; legitimate interests for security, abuse prevention and product improvement; consent for optional marketing email and for connecting any individual data source; and legal obligation where we must retain records.

Connecting a source is always your action. You choose which sources to enable and can disconnect any of them at any time.

We do not sell your data and we do not use your content to train our own models.

We do use sub-processors, grouped as: cloud infrastructure and object storage; AI inference providers; speech-to-text and document-OCR providers; payment processors; and email and push-notification providers.

The current, named list is maintained on our Trust Center, including what each one can see. We keep the list there rather than here so it stays accurate as providers change.

Two things materially reduce this sharing, and both are under your control. If you bring your own model key, inference calls go to your own account with that provider rather than through ours. If you point us at a local model, the content does not leave the deployment at all and no third party is involved in that processing.

Data is processed in US-East. If you are outside the United States, your data is transferred there. We do not currently operate a European processing region.

We retain your content until you delete it. There is no scheduled expiry - automatically deleting a memory layer would defeat its purpose. Deleting a capture, a space, or your account removes the associated content.

Backups and logs persist for a limited period after deletion as part of normal operations. Billing records are retained as long as legally required.

Current limitation, stated plainly: self-serve account deletion and data export are not yet available in the product. Until they ship, email privacy@brrainy.com and we will action the request manually. We would rather tell you that than point you at a button that does not exist.

Subject to local law, you can request access to your data, correction, deletion, export in a portable format, restriction of processing, or object to processing. You can also withdraw consent for any connected source by disconnecting it.

Make any of these requests at privacy@brrainy.com. We respond within the period required by applicable law. If you are in the EEA or UK and are unsatisfied, you may complain to your local supervisory authority.

Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Credentials for connected services and model provider keys are encrypted at rest and scoped to a single space. Access is separated per space at the database layer.

Our current compliance posture, including certifications in progress, is on the Trust Center. No system is perfectly secure, and we will not claim otherwise.

Where you use Brrainy through an organisation, that organisation administers the spaces you belong to and may access content within them according to its permissions. Your personal space is separate. If you are unsure which applies, ask your administrator.

Brrainy is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will remove it.

We will update this page when our practices change and revise the date above. For material changes affecting how your data is used, we will notify you directly.