Privacy Policy

Brainyo is operated by AIProxy (“we”, “us”), which is the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR).

Privacy contact: hello@brainyo.app. We have not appointed a Data Protection Officer, because we are not required to. Write to the address above for anything privacy-related.

When an organisation uses Brainyo to store its documents, that organisation decides what is uploaded. For the personal data inside those documents, the organisation is the controller and we act as its processor. In that case the organisation's own privacy notice applies to you, and we process the data only on its instructions.

• Account data: your email address, name, password (stored only as a salted hash in our identity system) and your role in a workspace.
• Content you provide: documents you upload, project and folder names, questions you ask, and the answers Brainyo generates.
• Question history for improvement: to show workspace admins which topics your documents cannot answer, we keep the text of questions that were declined, weakly sourced or rated thumbs-down, a numeric fingerprint (embedding) of them, and any comment you add to a rating. Admins see these grouped by theme with emails, phone numbers and account numbers masked, and without who asked. A workspace can switch this off, after which question text is not stored.
• Usage data: counts of uploads, searches and AI queries per member, used for limits and for workspace admins.
• Technical data: IP address, browser type and request logs, kept for security and troubleshooting.
• Messages to us: what you send to our contact addresses.

• Provide Brainyo (sign-in, indexing your documents, search, chat, teams): performance of the contract with you, Art. 6(1)(b) GDPR.
• Keep the service secure (abuse prevention, rate limits, brute-force protection, logs): our legitimate interest, Art. 6(1)(f).
• Improve and fix the service using aggregate usage and error information: our legitimate interest, Art. 6(1)(f).
• Answer your messages and support requests: contract or legitimate interest, Art. 6(1)(b) and (f).
• Meet legal duties (for example tax and accounting once billing starts, or authority requests): legal obligation, Art. 6(1)(c).

To answer a question, Brainyo finds the relevant passages in your workspace and sends them, with your question, to a language-model provider that writes the answer. Documents are turned into numeric vectors by an embedding provider so they can be searched, and scanned or complex PDFs may be read by a vision model. These providers are listed in section 5.

• We send only what is needed to produce the answer or index, through the providers' business APIs.
• We do not use your documents or questions to train AI models.
• Answers are generated by AI and can be wrong or incomplete. Every answer shows its sources so you can check it. No decision with legal or similarly significant effect on you is made solely by automated means.
• Retrieval is limited to your own workspace. Other workspaces cannot see your content.

We share personal data only with providers that help us run Brainyo, under data processing agreements:

• Hetzner (Germany / Finland, EU): servers that run Brainyo and its database.
• Cloudflare, R2: storage of uploaded files.
• OpenAI (United States): writing answers, preparing your documents for search, and reading difficult or scanned PDFs.
• Tavily (United States): only if web search is switched on for a workspace; the search query is sent.
• Google (reCAPTCHA) (United States): only on the registration page, to protect against automated sign-ups. It loads a script and a font from Google and may receive technical data such as your IP address and browser information. See Google's privacy policy.

We do not sell personal data and we do not use it for advertising. We may disclose data if the law or a court requires it.

Some providers above are based in, or may process data in, the United States. Where that happens, we rely on an EU adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the safeguards at hello@brainyo.app.

• Documents, projects, conversations: until you or your workspace admin delete them, then removed from our systems, including search vectors and earlier versions of your files.
• Account: until you delete it. After you request deletion there is a 15-day grace period in which you can cancel. Then we erase your profile, your personal workspace with its documents, every conversation you started in any workspace (with its answers, ratings and cached copies), your saved searches, notifications and feedback, the invitations to workspaces you belonged to, and your name and email. Documents and projects you added to a workspace you share with others belong to that workspace and stay until its admin deletes them. If you own a shared workspace, it passes to another member.
• Question text and rating comments kept for analytics: 90 days. After that the text, its embedding and any rating comment are erased; only counts and quality metrics remain. They are also erased if you delete your account or the workspace is deleted.
• Notifications: the text of a notification (a document title or a short preview of an answer) is kept for up to 7 days so your notification list can show it, then deleted.
• Technical logs: kept for a short period for security and troubleshooting, then deleted or anonymised.
• Backups: we do not run scheduled, automated database backups yet. Before some maintenance work we may take a one-off copy of the database, kept on the server that runs Brainyo, and deleted data can remain in such a copy until we delete it. Brainyo is in beta, so please keep your own copy of important files. We will update this section once regular backups and a tested restore are in place.
• Accounting records: if you buy a paid plan, invoices are kept as long as tax law requires.

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15);
• correct inaccurate data (Art. 16);
• have it erased (Art. 17). You can delete documents and your account in the app;
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time where we rely on it.

Email hello@brainyo.app. We reply within one month. We may need to confirm your identity first. If you believe we handle your data unlawfully, you can complain to your national data protection authority. In Greece this is the Hellenic Data Protection Authority (dpa.gr). We would appreciate the chance to fix the problem first.

Brainyo uses strictly necessary cookies to keep you signed in, protect your session and remember your cookie choice. They do not track you across sites, and under the ePrivacy rules they are used without consent.

Analytics cookies are used only when we have analytics switched on, only on our public pages (never inside the app), and only after you accept them. Analytics is not switched on at the moment, so no analytics cookies are set.

Sign-in pages and emails. The sign-in, password-reset and account pages on auth.brainyo.app load their fonts, styles and images only from auth.brainyo.app, and load no third-party resources. The registration page uses Google reCAPTCHA to protect against automated sign-ups. It loads a script and a font from Google and may send technical data, such as your IP address and browser information, to Google. See Google's privacy policy (policies.google.com/privacy). The emails we send about your account use your device's own fonts and load images only from dashboard.brainyo.app.

Your cookie choice. The cookie brainy_consent stores your choice, the version of the cookie text you saw and the time you chose. No consent identifier is created and nothing about your choice is sent to our server.

You can change or withdraw your choice at any time in Cookie settings, in the site footer or in the app's sidebar. We do not use advertising or social-media cookies or trackers.

Our cookie policy lists every cookie and browser-storage item, who sets it and for how long.

We protect data with TLS in transit, encryption at rest at the storage layer, per-workspace isolation, role-based access and brute-force protection. Our security page explains this, including what we have not done yet. If a breach puts your rights at risk, we will notify you and the authority as the GDPR requires.

Brainyo is for people aged 18 and over, and is not directed at children. If you think a child has an account, write to us and we will delete it.

We will update this page when our practices change and show the date at the top. For material changes we will also tell account holders by email or in the app before they take effect.