Privacy Policy
Last updated: 31 July 2026
AI Brain Business (“the Service”, “we”) is a knowledge centre for small businesses. You upload or forward business documents; we read them, classify them, and let you search and ask questions about them. This page explains what we hold, why, and how to get rid of it.
What we collect
Account information
- Your email address and authentication details.
- Your business name and workspace identifier.
- Phone numbers you choose to connect for WhatsApp, and the names you give them.
Documents you give us
- The files themselves — uploaded in the app, sent to your intake address, sent over WhatsApp, or imported from a mailbox you connect.
- Text extracted from them, including text read out of scans by optical character recognition.
- Information derived from that text: document type, dates, totals, supplier and customer names, summaries, tags, and numeric representations (embeddings) used for search.
Google account data, if you connect a mailbox
Connecting Gmail is entirely optional and the Service works without it. If you do connect it, we request two permissions and no others:
- Read your mail (
gmail.readonly) — to show your recent messages in the Service and to let you import attachments as documents. - Send mail on your behalf (
gmail.send) — only when you compose and send a message from within the Service.
We do not request permission to modify or delete your mail, and we cannot do either. We do not copy your mailbox: messages are fetched from Google when you look at them and are not stored by us. The exception is an attachment you explicitly import, which becomes a document and is then treated like any other document described here.
Limited Use disclosure
The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data to serve advertising, we do not sell it, and we do not allow humans to read it except where you have explicitly asked us to, where it is necessary for security purposes or to comply with applicable law, or where the data is aggregated and anonymised.
Automated processing, and who else sees your content
This is the part worth reading closely, because it is the part people assume rather than check.
Documents are processed automatically by third-party AI providers. To do that, the contents of a document — its text, and for scans its page images — are transmitted to those providers. Today they are OpenAI (text analysis, search embeddings, transcription) and Anthropic (reading scans, and deciding where a document should be filed). Where a Gmail attachment has been imported, it is processed in exactly the same way.
We do not use your documents or your mail to train our own models, and we do not sell them or share them with anyone other than the infrastructure providers listed below.
Where it is stored, and how it is protected
- Files and data are held in Supabase (Postgres and object storage), and the application runs on Vercel. Both encrypt data in transit and at rest.
- Each workspace is isolated at the database level. Members of one business cannot read another’s data.
- If you connect a mailbox, the credential that grants us access is encrypted with AES-256-GCM before it is stored, using a key held outside the database. A copy of the database alone does not give anyone access to your mail.
Removing your data
- Disconnect a mailbox — from the Inbox page, or at any time from your Google account permissions. Revoking there takes effect immediately and does not depend on us.
- Delete a document — deleted documents go to the archive and are removed permanently from there.
- Delete everything — write to us and we will remove your workspace, its documents and its stored files.
Retention
We keep your data for as long as your workspace exists. We do not keep copies of Gmail messages beyond what is described above.
Contact
Questions about this policy, or a request to delete your data: aviadms77@gmail.com.