Privacy Policy

1. Who we are

This Privacy Policy explains how Brainbox AI LLC, a California limited liability company d/b/a BrainBox Labs (“BrainBox,” “we,” “us,” or “our”), collects, uses, and discloses personal information in connection with brainbox-ai.app and our Service.

Entity: Brainbox AI LLC | 2108 N ST STE N, Sacramento, CA 95816 | privacy@brainbox-ai.app

If you are using the Service on behalf of a business that has a separate written agreement with BrainBox (a Cloud Service Agreement and/or Data Processing Addendum), that agreement governs any data your organization submits to the Service in the course of using it. This Policy governs everything else: your account information, your use of our website, and our communications with you.

2. Information we collect

2.1 Information you provide

• Account and contact information: name, work email, company, role, password (hashed).
• Billing information: billing contact, address, and payment details (processed by our payment processor, Stripe; BrainBox does not store full card numbers).
• Communications: support requests, sales inquiries, survey responses.

2.2 Information collected automatically

• Usage data: features accessed, query volumes, timestamps, session duration.
• Device and log data: IP address, browser type, operating system, referring URLs.
• Cookies and similar technologies, as described in Section 8.

2.3 Information from third parties

• Single sign-on providers (e.g., Google Workspace, Okta, or similar identity providers), if a customer enables SSO for their account.

3. How we use information

• Provide, maintain, and secure the Service.
• Authenticate users.
• Respond to support requests and communicate about the Service.
• Bill for the Service.
• Improve the Service, including aggregated and de-identified analysis of product usage.
• Detect, investigate, and prevent security incidents, fraud, and abuse.
• Comply with legal obligations.

We do not sell personal information.

4. Legal bases for processing (EEA/UK users)

Where GDPR applies, we rely on the following legal bases:

• Performance of a contract (providing the Service to you or your employer).
• Legitimate interests (securing and improving the Service, preventing fraud).
• Consent (marketing communications, certain cookies and email tracking technologies).
• Legal obligation (tax, accounting, regulatory compliance).

5. Disclosure of information

We disclose personal information to the following categories of recipients:

• Subprocessors and infrastructure providers who help us operate the Service. Currently: Google Cloud Platform (including Vertex AI / Gemini) (hosting, storage, logging, monitoring, and large language model inference), Stripe (payment processing), Google Analytics (website analytics), and Langfuse (product analytics and performance monitoring). An up-to-date subprocessor list is published at brainbox-ai.app/dpa.
• Professional advisors (legal, accounting) as needed.
• Successors in a merger, acquisition, financing, or asset sale, subject to standard confidentiality protections.
• Law enforcement or regulators where required by law, or to protect the rights, property, or safety of BrainBox, our customers, or others.

We do not sell, rent, or lease personal information to third parties, and we do not disclose personal information to third parties for their own independent marketing purposes.

6. Data retention

We retain account information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements. Usage and log data is generally retained for up to 18 months.

7. Security and breach notification

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, including encryption in transit and at rest and access controls. No system is completely secure, and we cannot guarantee absolute security.

In the event of a security incident involving personal information, BrainBox will promptly investigate, take steps to contain and remediate the incident, and provide notice to affected individuals and, where required, applicable regulatory authorities, in the manner and within the timeframes required by applicable law.

8. Cookies and tracking technologies

We use Google Analytics (GA4) on brainbox-ai.app to understand how visitors use our website, and essential cookies to support authentication and site functionality. We do not currently use cookies for third-party advertising or marketing attribution. You can control or disable cookies through your browser settings; disabling some cookies may affect site functionality.

Emails we send for marketing, sales outreach, or promotional purposes may contain technology that notifies us when the email is opened or a link within it is clicked, so we can understand engagement with our communications. You can opt out at any time — see Section 9.

9. Your rights and choices

Depending on your location, you may have rights to:

• Access, correct, or delete personal information we hold about you.
• Object to or restrict certain processing.
• Request a portable copy of your information.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications at any time via the unsubscribe link included in the email, or by emailing unsubscribe@brainbox-ai.app.

California residents may have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and to opt out of the “sale” or “sharing” (as those terms are defined under California law) of personal information. BrainBox does not sell personal information and does not knowingly engage in “sharing” as defined by the CCPA for cross-context behavioral advertising purposes. To the extent any of our practices are later determined to fall within these definitions, you may opt out by contacting us at privacy@brainbox-ai.app; we do not currently operate a separate self-service opt-out web page for this purpose.

To exercise any rights described in this section, contact privacy@brainbox-ai.app. We will verify your request before acting on it. We may not be able to fully delete personal information where retention is necessary to complete a transaction, comply with a legal obligation, detect and prevent security incidents or fraud, or maintain the Service’s intended functionality.

10. International data transfers

We are based in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries where our subprocessors operate. Where required, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses.

11. Children’s privacy

The Service is a business product and is not directed to children. We do not knowingly collect personal information from children under the age of 13. Separately, and regardless of this threshold, use of the Service is restricted to business users who are 18 years of age or older. If you believe a child has provided us with personal information, contact us at privacy@brainbox-ai.app and we will take steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time, including when our services, data protection practices, or applicable law change. Material changes will be notified via the Service, by email to account administrators, and/or by a prominent notice on our website. Continued use of the Service after an update constitutes acceptance of the revised Policy.

13. Contact us

Brainbox AI LLC
2108 N ST STE N, Sacramento, CA 95816
Email: privacy@brainbox-ai.app | General inquiries: hello@brainbox-ai.app
Phone: (503) 208-6344