Brainbox

Brainbox Data Processing Agreement

Last updated 2nd November 2026

This Data Processing Agreement explains how Brainbox handles personal data on your behalf, and how we work together to protect it.

1. Introduction

1.1 This Data Processing Agreement (the "Agreement" or "DPA") governs the processing of personal data in connection with Brainbox (the "Service"), provided by Roundapproach, Lda., NIF 517544083, Rua Rodrigues Sampaio, N.º 97, 1.º, 1150-279 Lisboa, Portugal ("we", "us", or the "Processor"). It is between us and the organisation using Brainbox ("you", "your").

1.2 This Agreement forms part of the Brainbox Terms of Service (the "Terms") and is accepted together with them. No separate signature is required.

2. Definitions

2.1 Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the General Data Protection Regulation (EU) 2016/679 (the "GDPR").

2.2 You are the Controller, and Roundapproach, Lda. is the Processor for personal data processed on your behalf through Brainbox.

2.3 For clarity, we act as an independent controller for certain information, such as account administration and billing data, as explained in our Privacy Policy. That processing is not covered by this Agreement.

3. Scope

3.1 We process personal data on your behalf to provide Brainbox, following your instructions and the Terms.

3.2 If there's a conflict between this Agreement and the Terms regarding the processing of personal data, this Agreement takes precedence.

3.3 This Agreement remains in effect for as long as we process personal data on your behalf, including any applicable period after your subscription ends.

4. Our responsibilities as Processor

4.1 Following your instructions

We only use personal data in the ways you tell us to. That includes whether it may be transferred outside the European Economic Area.

Your documented instructions are:

  • the Terms and this Agreement; and
  • how you use and configure Brainbox, for example the Coworkers and Automations you set up, the apps you connect and the AI models you select.

The only exception is where EU or Member State law requires us to do something else with the data. If that happens, we'll tell you before we do it, unless the law prevents us from telling you.

4.2 Coworkers and Automations

Brainbox lets you create and configure Coworkers and Automations, which may use artificial intelligence to process information and take actions across your connected apps.

They operate based on your instructions, configurations, permissions and connected accounts. This may include reading, creating, sending, editing or deleting content.

You determine what Coworkers and Automations are authorised to do through their configuration, prompts, permissions and approval settings. We process personal data on your behalf to support these activities, in accordance with your documented instructions.

4.3 Unlawful instructions

If we believe an instruction violates the GDPR or other applicable EU or Member State data-protection law, we'll inform you immediately.

4.4 Security

We implement appropriate technical and organisational measures to protect personal data, as described in Section 8.

4.5 Assistance with GDPR obligations

Taking into account the nature of the processing and the information available to us, we'll reasonably assist you with:

  • Responding to requests from individuals exercising their data-protection rights.
  • Meeting your security and personal data breach obligations.
  • Conducting data protection impact assessments and, where necessary, consulting supervisory authorities.

This assistance covers the obligations described in Articles 28 and 32–36 of the GDPR.

4.6 Additional assistance

Where assistance goes beyond Brainbox's standard features or requires substantial additional work, we may charge reasonable fees, agreed with you in advance. This does not limit the assistance we're legally required to provide under the GDPR.

4.7 Personal data breaches

If we become aware of a personal data breach affecting your data, we'll notify you without undue delay.

We'll provide the information reasonably available to us that you need to assess the incident and meet your own notification obligations. We'll also cooperate with you in investigating and addressing the breach.

4.8 Data requests and disclosures

If anyone contacts us about personal data we process for you, we'll let you know, unless the law forbids us from telling you. This applies to requests from individuals and from public authorities, such as courts or the police.

If an individual asks to exercise their data-protection rights, for example to see or delete their data, we won't answer the request ourselves. We'll ask them to contact you, unless you've authorised us to respond on your behalf.

4.9 Confidentiality and access

Everyone authorised to process personal data on our behalf is bound by confidentiality obligations.

Our team accesses your workspace data only when necessary to provide requested support, maintain security or comply with legal obligations. Such access is controlled and logged.

These confidentiality obligations continue after this Agreement ends.

4.10 Third-party services you choose

Some services you use with Brainbox are governed by your or your users' own agreements with their providers:

  • third-party apps you connect;
  • AI providers and models you use through your own API keys or contracts;
  • AI subscriptions your users connect themselves;
  • AI apps you connect to Brainbox through MCP, such as Claude, ChatGPT or Microsoft Copilot.

When an AI app connected through MCP retrieves information through Brainbox, we send it to that app on your instruction. Its provider then processes it under its own terms.

Brainbox has no integrations of its own with the apps you connect. Every connection uses credentials that belong to you or your users: API keys, OAuth apps registered in your own accounts (for example your Google Cloud project or Microsoft Entra tenant), and the accounts your users sign in with.

You control those credentials, the permissions they grant and your relationship with each provider. That includes choosing those services, making sure their use is appropriate and complying with each provider's terms.

We store the credentials encrypted and use them only to act on your instructions. If you revoke or change them at the provider, Brainbox's access ends or changes with them. We delete them when your subscription ends, together with your other data.

We remain responsible for our own processing of personal data when connecting Brainbox to those services, but not for independent processing by providers you've engaged directly.

4.11 Anonymous usage statistics

We may use aggregated, anonymised statistics about how Brainbox is used to operate, secure and improve the Service.

These statistics do not identify you or any individual. We don't analyse your workspace content for our own purposes.

4.12 AI training

We never use your personal data or workspace content to train AI models.

Third-party AI model providers process the data needed for your requests under their own terms. Information about these providers is available on our Subprocessors page.

AI subscriptions your users connect, and AI apps connected through MCP, follow their own providers' terms (Sections 4.10 and 7.2). Depending on the plan and its settings, those providers may use the data to improve their models.

5. What data we process and why

5.1 Purpose

We process personal data to provide Brainbox and its features, including:

  • Hosting and operating your dedicated workspace.
  • Running Coworkers, Automations and AI models based on your instructions.
  • Accessing and exchanging information with your connected apps.
  • Providing support, maintaining security and preventing misuse.

Account administration and billing data that we process as an independent controller are covered separately by our Privacy Policy.

5.2 Types of processing

Processing may include collecting, storing, organising, retrieving, consulting, analysing, transmitting, modifying and deleting personal data, including processing by AI models.

5.3 Duration

We process personal data for the duration of your subscription and any additional period described in Section 10.

5.4 People whose data may be processed

This may include your users, anyone whose personal data appears in the information you bring into Brainbox or make available through connected apps (such as employees, customers, suppliers and business contacts), and visitors to pages you share, including anyone who submits information through them.

5.5 Categories of personal data

Depending on how you use Brainbox, this may include:

  • Names, contact details and other identification information.
  • User and account information contained in your workspace.
  • Emails, messages, documents, files, calendars and other connected records.
  • Prompts, AI-generated outputs and activity logs.
  • Memories Coworkers keep, and information visitors enter into pages you share.
  • Technical information, such as IP addresses.

The specific data processed depends on your use and configuration of Brainbox.

6. Your responsibilities as Controller

6.1 You're responsible for ensuring that the personal data you process through Brainbox is collected and used lawfully, including having an appropriate legal basis and providing any required privacy notices.

6.2 You're also responsible for the accuracy and lawfulness of the data you provide, the instructions you give, and how you configure and manage your Coworkers, Automations and connected apps.

6.3 Brainbox is not specifically designed for processing special categories of personal data under Article 9 GDPR, such as health information or religious beliefs. If you choose to process this type of information, you're responsible for ensuring that doing so is lawful and appropriate, and for implementing any additional safeguards required. This doesn't affect our own obligations as Processor under the GDPR.

7. Sub-processors and international transfers

7.1 Sub-processors

You give us general written authorisation to engage trusted service providers ("sub-processors") to help deliver Brainbox.

We maintain an up-to-date list of our sub-processors, their purposes and relevant processing arrangements at app.mybrainbox.ai/legal/subprocessors.

7.2 AI model providers

Brainbox can run AI models in several ways:

  • Brainbox AI credits. We give access to third-party AI models through OpenRouter, which routes each request to a provider your settings allow. These requests run on our OpenRouter account and use your credits. Your administrators can require zero data retention, limit which providers may serve your requests and choose which models are available.
  • Your own API keys. On request, we can set your Brainbox to use your own API key, for example an OpenRouter key. Requests then run on your account with that provider (see Section 4.10).
  • Your own models. On request, we can connect Brainbox to a model you host or contract directly. Requests then run under your agreement with that provider.
  • Your users' personal subscriptions. If your administrators allow it, your users can connect their own AI subscriptions, such as ChatGPT or GitHub Copilot. Requests using those models run on that user's own account, under the terms that user has accepted with the provider.

When you or your users select a model, you're instructing Brainbox to send the information needed for the request to that model's provider. The providers process it under their own terms. Only the providers used with Brainbox AI credits are listed on our Subprocessors page.

7.3 Our responsibility

We require the sub-processors that host and operate Brainbox to provide data-protection commitments that meet the requirements of Article 28 GDPR and offer a level of protection equivalent to this Agreement. AI model providers are covered by Section 7.2.

We remain responsible for the performance of those sub-processors' data-protection obligations.

7.4 International transfers

Your dedicated Brainbox workspace is hosted in the European Union.

Some of our sub-processors may process personal data outside the European Economic Area (EEA). Where they do, we ensure that appropriate safeguards are in place, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with any additional measures required by applicable law.

AI model providers, including OpenRouter, may also process personal data outside the EEA. They rely on their own transfer safeguards, as described in Section 7.2 and on our Subprocessors page.

7.5 Changes to sub-processors

We'll notify your account administrators at least 30 days before adding or replacing a sub-processor.

You may object during that period on reasonable data-protection grounds.

If we can't resolve your concerns, you may terminate your subscription and receive a pro-rata refund for the unused prepaid period.

8. Security

8.1 Our security measures

We maintain technical and organisational measures appropriate to the risks of processing personal data, in accordance with Article 32 GDPR.

These include:

  • A dedicated, isolated server for each customer organisation, hosted in ISO 27001:2022-certified data centres in the EU.
  • Encryption of data in transit.
  • Encryption of stored credentials, with encryption keys managed through an HSM-backed key management service.
  • Access controls and activity logging.
  • A separate consent for each AI app connected through MCP, short-lived access tokens, revocation by users and administrators, and automatic revocation when a user is removed.
  • Permission and approval controls for Coworkers and Automations.
  • Daily backups retained for 7 days.
  • Incident-response procedures to identify, investigate and address security incidents.

We regularly review our security practices and may update these measures as the Service evolves, provided we maintain an appropriate level of protection.

8.2 Your security responsibilities

You're responsible for assessing whether Brainbox's security measures are appropriate for your intended use and for managing security within your organisation.

This includes managing user access, roles, Coworker and Automation permissions, approval settings, the credentials and access rights of connected apps, and the AI apps your users connect through MCP.

9. Audits and compliance

9.1 We'll give you the information you reasonably need to check that we comply with this Agreement and Article 28 GDPR. Usually that means written documentation, answers to your security questionnaires and, where available, our sub-processors' certifications and audit reports.

9.2 You can also audit us once a year, and more often after a significant security incident or when the law or a supervisory authority requires it. Please give us at least four weeks' notice and an audit plan. Anyone auditing on your behalf must be qualified and bound by confidentiality.

9.3 Audits take place during business hours and must not disrupt the Service or expose other customers' data.

9.4 You pay your own audit costs. If an audit needs substantial work from us, reasonable fees may apply (Section 4.6).

10. When your subscription ends

10.1 This Agreement remains in effect for as long as we process personal data on your behalf, including after your Brainbox subscription ends.

10.2 When your subscription ends, your Brainbox workspace is switched off, including its Coworkers and Automations. You may then ask us to send you an export of your personal data or to delete it. Unless you request earlier deletion, we'll keep your workspace data for up to 90 days after termination so that you can request an export.

10.3 After that period, we'll delete your personal data and existing copies, unless EU or Member State law requires us to retain certain information. Copies held in backups will be deleted within a further 30 days.

10.4 Exports and deletion requests are included in the Service at no extra charge. If you need help beyond that, reasonable fees may apply under Section 4.6.

11. Changes to this Agreement

11.1 If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions will continue to apply.

11.2 We may update this Agreement as Brainbox evolves or legal requirements change. We'll follow the notice and change procedures described in the Terms.

11.3 For data-protection matters, you can contact us at hello@mybrainbox.ai. We'll use your account administrators as our primary contacts. Both parties agree to keep their contact information up to date.

12. Liability

12.1 Each party remains responsible for its obligations and liabilities to data subjects under Article 82 GDPR.

12.2 To the extent permitted by applicable law, liability between the parties under this Agreement is governed by, and counts towards, the limitation of liability in the Terms. Nothing in this Agreement limits rights or liabilities that cannot legally be excluded or restricted.

13. Governing law and jurisdiction

13.1 This Agreement is governed by Portuguese law. The courts of Lisbon, Portugal, have exclusive jurisdiction over disputes arising from this Agreement, except where applicable law requires otherwise.