Privacy Policy

Brainy is operated by AIProxy (“we”, “us”), which is the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR).

Privacy contact: hello@aiproxy.gr. We have not appointed a Data Protection Officer, because we are not required to. Write to the address above for anything privacy-related.

When an organisation uses Brainy to store its documents, that organisation decides what is uploaded. For the personal data inside those documents, the organisation is the controller and we act as its processor. In that case the organisation's own privacy notice applies to you, and we process the data only on its instructions.

• Account data: your email address, name, password (stored only as a salted hash in our identity system) and your role in a workspace.
• Content you provide: documents you upload, project and folder names, questions you ask, and the answers Brainy generates.
• Question history for improvement: to show workspace admins which topics your documents cannot answer, we keep the text of questions that were declined, weakly sourced or rated thumbs-down, a numeric fingerprint (embedding) of them, and any comment you add to a rating. Admins see these grouped by theme with emails, phone numbers and account numbers masked, and without who asked. A workspace can switch this off, after which question text is not stored.
• Usage data: counts of uploads, searches and AI queries per member, used for limits and for workspace admins.
• Technical data: IP address, browser type and request logs, kept for security and troubleshooting.
• Messages to us: what you send to our contact addresses.

• Provide Brainy (sign-in, indexing your documents, search, chat, teams): performance of the contract with you, Art. 6(1)(b) GDPR.
• Keep the service secure (abuse prevention, rate limits, brute-force protection, logs): our legitimate interest, Art. 6(1)(f).
• Improve and fix the service using aggregate usage and error information: our legitimate interest, Art. 6(1)(f).
• Answer your messages and support requests: contract or legitimate interest, Art. 6(1)(b) and (f).
• Meet legal duties (for example tax and accounting once billing starts, or authority requests): legal obligation, Art. 6(1)(c).

To answer a question, Brainy finds the relevant passages in your workspace and sends them, with your question, to a language-model provider that writes the answer. Documents are turned into numeric vectors by an embedding provider so they can be searched, and scanned or complex PDFs may be read by a vision model. These providers are listed in section 5.

• We send only what is needed to produce the answer or index, through the providers' business APIs.
• We do not use your documents or questions to train AI models.
• Answers are generated by AI and can be wrong or incomplete. Every answer shows its sources so you can check it. No decision with legal or similarly significant effect on you is made solely by automated means.
• Retrieval is limited to your own workspace. Other workspaces cannot see your content.

We share personal data only with providers that help us run Brainy, under data processing agreements:

• Hetzner (Germany / Finland, EU): servers that run Brainy and its database.
• Cloudflare, R2: storage of uploaded files.
• OpenAI (United States): writing answers, preparing your documents for search, and reading difficult or scanned PDFs.
• Tavily (United States): only if web search is switched on for a workspace; the search query is sent.

We do not sell personal data and we do not use it for advertising. We may disclose data if the law or a court requires it.

Some providers above are based in, or may process data in, the United States. Where that happens, we rely on an EU adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the safeguards at hello@aiproxy.gr.

• Documents, projects, conversations: until you or your workspace admin delete them, then removed from our systems, including search vectors.
• Account: until you delete it. After you request deletion there is a 15-day grace period in which you can cancel, then everything is permanently erased.
• Question text and rating comments kept for analytics: 90 days. After that the text, its embedding and any rating comment are erased; only counts and quality metrics remain. They are also erased if you delete your account or the workspace is deleted.
• Technical logs: kept for a short period for security and troubleshooting, then deleted or anonymised.
• Backups: encrypted database backups age out on a rolling schedule, so deleted data can remain in a backup for a limited time before it expires. It is not restored into the live service.
• Accounting records: if you buy a paid plan, invoices are kept as long as tax law requires.

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15);
• correct inaccurate data (Art. 16);
• have it erased (Art. 17). You can delete documents and your account in the app;
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time where we rely on it.

Email hello@aiproxy.gr. We reply within one month. We may need to confirm your identity first. If you believe we handle your data unlawfully, you can complain to your national data protection authority. In Greece this is the Hellenic Data Protection Authority (dpa.gr). We would appreciate the chance to fix the problem first.

Brainy uses only strictly necessary cookies: those that keep you signed in and protect your session. They do not track you across sites, and under the ePrivacy rules they need no consent.

We do not use advertising, social-media or third-party analytics cookies or trackers on this site. If that changes, we will ask for your consent first and update this section.

We protect data with TLS in transit, encryption at rest at the storage layer, per-workspace isolation, role-based access and brute-force protection. Our security page explains this, including what we have not done yet. If a breach puts your rights at risk, we will notify you and the authority as the GDPR requires.

Brainy is for people aged 18 and over, and is not directed at children. If you think a child has an account, write to us and we will delete it.

We will update this page when our practices change and show the date at the top. For material changes we will also tell account holders by email or in the app before they take effect.