Brainbox Privacy Policy

In short: we collect only what we need to run Brainbox, we never sell your data, and we never use it to train AI models.

Who we are

Brainbox is provided by Roundapproach, Lda., NIF 517544083, Rua Rodrigues Sampaio, N.º 97, 1.º, 1150-279 Lisboa, Portugal ("we", "us"). Contact: hello@mybrainbox.ai.

We handle two kinds of data, in two different roles:

• Your account data — who you are, your organisation and your billing details. We decide how this is used, so we are the controller, and this policy applies.
• Your workspace content — the emails, files, chats, memories, pages, databases and other content you and your AI agents (Coworkers and Automations) work with in Brainbox. Your organisation decides how this is used, so it is the controller and we are its processor. Your organisation's administrators may be able to access it. Our Data Processing Agreement covers this content, and your organisation's own privacy notice applies.

What we collect

• Account data: your name, work email address, organisation, role, and the sign-in links and codes we email you.
• Billing data: company name, VAT number, billing address, invoices and payment records, and your organisation's credit usage.
• Usage data: which features are used, when and how often, kept in aggregated form wherever possible.
• Technical data: IP address, browser and device type, error reports when something breaks, and which AI apps you connect through MCP and the tool calls they make.
• Support data: the messages you send us and our replies.

We do not buy data about you from third parties, and we do not track you across other websites.

Why we use it

We use your data to create and run your account, sign you in, bill your organisation and keep the accounting records the law requires. We also use it to keep Brainbox secure and prevent misuse, fix errors and improve the product, answer your support requests, and send you service notices about security, billing or changes to our terms.

We only send you product news if you've agreed to receive it, and you can opt out at any time. We never sell your data, and we never use it, or your workspace content, to train AI models.

We rely on our legitimate interest in running and securing Brainbox, on our contract with your organisation, on legal obligations such as keeping accounting records, and on your consent for product news.

Who we share it with

We share data only with the service providers that help us run Brainbox, under contracts that protect it:

• Hetzner (Germany) — hosting
• Neon (Germany, AWS Frankfurt) — account database
• OVHcloud (France) — encryption keys
• Cloudflare — DNS and network protection
• Resend (EU, Ireland) — sign-in and notification emails
• Sentry (EU region) — error reports
• InvoiceXpress (Portugal) and our accountants — invoices and accounting

AI models. If your organisation uses Brainbox AI credits, the content needed for your request is sent, through OpenRouter, to a model provider your organisation's settings allow. These providers process it under their own terms. The available models and providers are listed in the app and on our Subprocessors page. On request, your organisation can use its own API keys or models instead, under its own agreement with those providers.

If you connect your own AI subscription, such as ChatGPT or GitHub Copilot, your requests to those models go to that provider under your own agreement with them.

If you connect an AI app to Brainbox through MCP, such as Claude or ChatGPT, the information it retrieves goes to that app's provider under your agreement with them.

The full, current list is at app.mybrainbox.ai/legal/subprocessors. We may also disclose data when the law requires it, or to a buyer if our business is sold, in which case this policy continues to apply.

Transfers outside the EU. We host Brainbox workspaces in the EU. Some of our service providers, such as Cloudflare, may process data outside the European Economic Area. Where they do, we rely on adequacy decisions such as the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. AI model providers may also process data outside the EEA, under their own transfer safeguards.

How long we keep it

We keep personal data only for as long as we need it for the purposes in this policy, or as the law requires. For example, Portuguese tax law requires us to keep invoices for 10 years. When your organisation leaves Brainbox, we delete the account data we no longer need, except what we must keep for legal, accounting, security or legal-claim purposes. Backup copies are deleted within a further 30 days.

Cookies

We use only the cookies needed to keep you signed in and to keep Brainbox secure. When you open a page someone shared with you by link, we set an anonymous cookie for that page only, so your changes on it are attributed to you. We use no advertising or tracking cookies, so we do not show a cookie banner.

Your rights

You can ask us to access, correct, delete or export your data, to restrict how we use it, or to stop using it where we rely on legitimate interest. Email hello@mybrainbox.ai and we will reply within one month.

If your request concerns workspace content, we will pass it to your organisation, which controls that data.

You can also complain to the Portuguese data protection authority, the CNPD, or to the authority in your own EU country.

Security

Each customer runs on its own isolated server in ISO 27001:2022-certified data centres in the EU. Data is encrypted in transit, stored credentials are encrypted with keys managed in an HSM-backed key management service, and staff access is limited and logged.

Changes to this policy

We will post any change on this page with a new "last updated" date. If a change is significant, we will also email account administrators before it takes effect.

Contact

Questions or concerns: hello@mybrainbox.ai, or Roundapproach, Lda., Rua Rodrigues Sampaio, N.º 97, 1.º, 1150-279 Lisboa, Portugal.