Privacy Policy

This Privacy Policy ("Policy") describes how brainis ("Company", "we", "our", or "us") collects, uses, discloses, and safeguards information when you access or use our platform and related services (the "Service"). By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, you must not use the Service.

1. Data Controller & Data Processor Roles

You (the account holder or organization) are the data controller for all personal data relating to candidates, employees, and other individuals whose data you upload, input, or process through the Service ("User Data"). The Company acts solely as a data processor, processing User Data on your behalf and in accordance with your instructions.

As data controller, you bear full responsibility for:

• Determining the lawful basis for processing personal data
• Obtaining all necessary consents and authorizations from data subjects
• Providing required privacy notices to data subjects
• Complying with all applicable data protection and privacy laws, including GDPR, CCPA, and local regulations
• Responding to data subject access requests and rights exercises

The Company is not liable for your failure to comply with your obligations as data controller.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password. If you register on behalf of an organization, we also collect company name, industry, size, and relevant business information.

User Data

Our platform stores data that you and your team enter, including but not limited to candidate information (names, contact details, resumes, interview notes, assessments), employee records, financial data, project information, and communications. You are solely responsible for the content and lawfulness of all User Data.

Usage & Technical Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, timestamps, device information (browser type, operating system, device identifiers), IP addresses, and referring URLs.

Cookies & Tracking Technologies

We use cookies and similar browser storage to keep you signed in, to remember your choices, for analytics, and to measure our own advertising. Whether analytics and advertising measurement run depends on where you are and what you choose:

• In Europe (the EU, the EEA, the UK, Switzerland and the rest of the continent, which we tell by your browser’s time zone), no analytics or advertising cookie is set until you accept them in the small card that asks once. The Cookie Policy says exactly what loads before you answer.
• Everywhere else, they are on by default until you say no. The website shows a short notice saying so on your first visit.
• Global Privacy Control: when your browser sends it, no advertising cookie is set and the advertising pixels do not load, wherever you are.
• Your choice holds on brainis.ai and app.brainis.ai alike, and you can change it at any time: Your privacy choices.

Our Cookie Policy lists every cookie by category, who sets it and how long it lasts. The services that run analytics and advertising measurement for us are named on our sub-processor list, with where each keeps its data.

What the public website (brainis.ai) keeps in your browser

These are the items the website writes itself: cookies, local storage (kept until you clear it) and session storage (gone when you close the tab). The analytics and advertising services may add their own; the Cookie Policy lists those.

Not governed by your cookie choice. Each is written only when the part of the site it serves is used:

• brainis_consent (cookie) — Remembers your cookie choice, so we ask once and both sites honour it.
• brainis_notice (cookie) — Remembers that you have seen the short cookie notice, so it shows once. It does not change your choice.
• brainis_theme (cookie and local storage) — Remembers whether you picked the light or the dark look for this site, so every page opens that way. Set only when you press the switch, in a cookie and in your browser's storage.
• brainis_offer (cookie) — Remembers when your first chat with Brainis on this device began, so a sign-up bonus counts from that moment. It holds the chat's number and nothing about you.
• brainis_zd (cookie) — Lets the free chat count how many chats and answers this device has had today, so the daily limits stay fair for everyone. It holds a random number and nothing about you, and goes to our server with each chat message.
• brainis.support.visitor (local storage) — Keeps your chat on this site between visits: the conversation's number and this browser's chat token. Both go to our server with each chat message, so the conversation can be read again.
• brainis.site-zen.visitor (local storage) — Keeps this browser's chat token after you start a new chat, so your sign-up bonus clock and free answers carry on instead of starting again. It goes to our server with each chat message.
• brainis.support.email-left (local storage) — Remembers that you left an email in a chat and it reached our team, with the address as our server masked it and whether our email to you went, so the chat does not ask again.
• brainis.site-zen.offer-ended-said (local storage) — Remembers that the chat has told you your sign-up bonus window ended, so it says so once.
• brainis.site-zen.resting (session storage) — Notes, for ten minutes, that Brainis's free answers are resting, so the next chat button can offer sign-up first.
• brainis.site-zen.door (session storage) — Remembers which button opened the chat, so “Continue in the app” opens the app the same way.
• brainis.site.offer.visit (session storage) — Notes that the chat's small corner offer was shown, so it shows at most once a visit.
• brainis.site.offer.days (local storage) — Notes the pages where the corner offer was shown today, so it shows at most once a day on each. Only today's pages are kept.
• brainis.site.offer.dismissed (local storage) — Notes when you closed the corner offer, so it stays away for 7 days.
• brainis.funnel.pains (session storage) — Remembers the problems you picked on our home and campaign pages, so they stay picked as you move between pages.
• brainis:your-business (local storage) — Keeps the private address of the Your Business page made for you, so you can open it again. It holds the page's token, never your answers.
• brainis:yb-popup (session storage) — Notes that the Your Business card was shown, so it shows once a visit.
• brainis.map.viewport:<…> (session storage) — Remembers where you moved and zoomed the map on a Your Business page.
• brainis:film-watched (local storage) — Set to 1 once you have watched more than 60% of the product film, and nothing else. Not written when your browser asks for reduced data or refuses storage.
• brainis:persona (session storage) — Records whether you arrived through a link marked ?p=founder or ?p=operator, and nothing else. Not written when your browser asks for reduced data or refuses storage.
• brainis:tier-cap (local storage) — Remembers that effects were turned down — with “Reduce effects” in the footer, or “Reload with fewer effects” after a page failed — so pages stay calm.
• brainis:sound (local storage) — Remembers whether you turned the site's sounds on or off.
• brainis:manifesto-i (session storage) — Remembers which line the footer showed last, so the next page shows the next one.
• brainis:rt-scroll (session storage) — Remembers how far down each page you were, so Back returns you to the same place.
• brainis:analytics-consent (local storage) — A copy of your cookie choice, kept by the website's product analytics. The brainis_consent cookie decides first.
• __brainis_probe__ (local storage and session storage) — Written and deleted at once, to check that your browser lets the site keep anything before it tries.

Analytics — on by default outside Europe until you say no; in Europe only after you accept:

• brainis_exp (cookie) — Remembers which version of our home and campaign pages you were shown, so you see the same one each visit and we can learn which version helps people more. Set only while such a test runs; never in Europe (told by your connection's country) and never once you have said no.
• brainis:exp:funnel1:first (local storage) — The day this browser was first counted in that test, so a return visit is not counted as new. Kept only by a browser that carries brainis_exp; all that is sent, to our own server, is whether this is a first visit.
• brainis:visitor-id (local storage) — A random visitor number for our founders' pages (/arman and /ashot), sent with those pages' measured events. Kept only when analytics may run; otherwise a new number is made for each visit and not kept.
• brainis:visitor-first-seen (local storage) — When you first opened one of our founders' pages, kept beside the visitor number under the same rule.

Advertising — on by default outside Europe until you say no; in Europe only after you accept, and never when your browser sends Global Privacy Control:

• brainis_attr (cookie) — Remembers which campaign link brought you, so a sign-up can be credited to it. Written only when advertising measurement may run — never when your browser sends Global Privacy Control.

3. How We Use Your Information

We use collected information for the following purposes:

• To provide, operate, maintain, and improve the Service
• To authenticate your identity and manage your account
• To send transactional communications (account verification, password resets, security alerts, service notifications)
• To send marketing communications about features, updates, and promotions (with opt-out available)
• To perform analytics, research, and product development
• To generate aggregated, anonymized, or de-identified data for analytics, benchmarking, and product improvement
• To detect, prevent, and address fraud, security issues, and technical problems
• To provide customer support
• To comply with legal obligations and enforce our Terms of Service
• To protect the rights, property, and safety of the Company, our users, and the public

You acknowledge that aggregated and anonymized data derived from your use of the Service is not considered personal data and may be used by the Company for any lawful business purpose, subject to the one exception stated immediately below: training shared AI models is not covered by this paragraph and requires consent.

AI processing & model training

We do not train on your data without explicit consent. Your workspace’s state and outcomes improve your own company’s recommendations by default. Contribution to shared model improvement is explicit, consented, and de-identified — and the exact policy lives in the Trust Center, not in a marketing page’s fine print. This is the same commitment stated at /security, on /product/memory, and in the AI governance note on /trust; the four are intended to be read as one.

In practice this means: (a) User Data is sent to the model providers listed in our sub-processor list only as scoped context for a request you or your agents initiate, and is not contributed to shared model improvement without the consent described above; (b) no durable credentials for your connected systems are held by those providers; (c) consent to contribute to shared model improvement is given by your organization, recorded, and revocable, and withdrawal takes effect for processing that has not yet occurred; and (d) where consent has been given, the contributed data is de-identified before it is used for that purpose. Model versions ship visibly in the product, predictions are labeled with ranges and a model version, and abstention is treated as an honest output rather than a failure.

4. Data Sharing & Disclosure

We do not sell your personal data to third parties. We may share information in the following circumstances:

• Service Providers: Third-party vendors who assist in operating the Service (hosting, email delivery, analytics, payment processing, customer support). These providers are bound by contractual obligations to protect your data.
• Affiliates & Subsidiaries: Companies within our corporate group for internal business purposes, subject to this Policy.
• Organization Members: Other users within your organization's workspace who have been granted appropriate access permissions.
• Business Transfers: In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity. We will notify you of any such transfer.
• Legal Requirements: When required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Aggregated Data: We may share aggregated, anonymized, or de-identified data with third parties for research, analytics, benchmarking, or other lawful purposes. Such data cannot reasonably be used to identify you.

5. Data Security

We implement commercially reasonable administrative, technical, and physical security measures designed to protect your data, including encryption at rest and in transit, role-based access controls, regular security assessments, and secure infrastructure.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. To the maximum extent permitted by applicable law, the Company disclaims liability for any unauthorized access to, alteration, disclosure, or destruction of your data resulting from circumstances beyond our reasonable control, including but not limited to cyberattacks, system failures, or the actions of third parties. You acknowledge that you provide your data at your own risk.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Following account termination or deletion request, we will delete or anonymize your personal data within 90 days, except where retention is necessary for:

• Compliance with legal, regulatory, or reporting obligations
• Resolution of disputes or enforcement of our agreements
• Fraud prevention and security purposes
• Legitimate business interests (including maintaining aggregated analytics)

Aggregated and anonymized data may be retained indefinitely.

7. International Data Transfers

Your data may be processed and stored in any country where we or our service providers maintain facilities. By using the Service, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection standards. We take reasonable steps to ensure that your data is treated securely and in accordance with this Policy regardless of where it is processed.

8. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data, including the right to:

• Access and receive a copy of your personal data
• Rectify inaccurate or incomplete personal data
• Request deletion of your personal data ("right to be forgotten")
• Object to or restrict the processing of your personal data
• Data portability (receive your data in a structured, machine-readable format)
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us through our platform. We may require verification of your identity before processing your request. We reserve the right to charge a reasonable administrative fee for manifestly unfounded, excessive, or repetitive requests, or to refuse such requests, to the extent permitted by applicable law. We will respond to valid requests within 30 days, or as required by applicable law.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such data. The Company assumes no liability if a minor accesses the Service without parental consent.

10. Third-Party Services

The Service may contain links to or integrations with third-party websites, services, or applications. This Policy does not apply to third-party services, and we are not responsible for their privacy practices, content, or security. We encourage you to review the privacy policies of any third-party services you access through our platform.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Service. Your continued use of the Service after such changes take effect constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about our data practices, please contact us through our platform.