Privacy Policy

1. Introduction

KIRLIA IA LTDA ("Brainside", "we"), Brazilian company registration (CNPJ) 64.911.533/0001-08, headquartered in Belo Horizonte, Brazil, is the controller of the personal data processed through Brainside (brainside.ai). Our data protection officer is named in Section 14.

This policy describes how we collect, use, store, share and protect your information when you use the website, the web application and related services, including connecting Brainside to third-party AI assistants over MCP (the "Service").

Read this policy to understand how we handle your data. It is not a contract: use of the Service is governed by the Terms of Use.

2. Information we collect

3. How we use your information

We use your information to:

• Provide, maintain and improve the Service;
• Manage your account and authenticate your access;
• Run the features you ask for, including AI features;
• Send communications about the Service, such as security notices and support replies;
• Detect, prevent and fix technical problems, abuse and security incidents;
• Measure product usage and follow the usage of each account (for example, the last day of use and the channel), without looking at content;
• Comply with legal and regulatory obligations.

4. Artificial intelligence

• Brainside uses third-party AI models for features such as chat, summaries, classification, reading documents and images, voice transcription and semantic search. Today, models are served mainly by Google Vertex AI (Gemini family) and, for some models, by OpenRouter.
• Your data is sent to the AI provider only to run the feature you asked for.
• We do not use your data to train AI models.
• Processing by providers follows each provider's API terms. More in the AI Notice.

5. Connecting third-party AIs (MCP)

You can connect Brainside to third-party AI assistants that speak MCP, such as Claude, Claude Code, ChatGPT and Codex. In that case:

• The connection only happens with your authorization, given via OAuth on the Brainside screen, with your login. Every new connection requires signing in again.
• The assistant reaches only your account — never anyone else's.
• Access keys (tokens) are stored only as a hash; we cannot read them back.
• What the assistant reads from Brainside is also processed by that assistant's provider, which decides on its own how to use that data, under its terms and privacy policy. Brainside does not control that processing. So choose an assistant you trust. You decide what to ask it, and you are responsible for the content it writes to your Brainside at your request. Notes and records it writes on its own are logged in the Brain Node history or in the audit log of the App it wrote to, even if it doesn't tell you, and you can review, edit or delete them at any time. Links it creates between notes show up in the Brain Node graph.
• If you leave the option that lets the assistant write to your Brainside checked on the authorization screen, you authorize the assistant to save things on its own. Brainside instructs it to tell you what it saved and to ask for your confirmation before replacing or deleting anything that already exists (it may add text to a note or fill in an empty field on its own, and tell you), and before saving sensitive data (such as health, religion, identity documents or bank details), content from an external source (an email, a web page, or someone else's file or message) or data belonging to a client or employer. An external assistant may not follow these instructions (see the AI Notice, Section 4), so check what it tells you and review what was saved. You can uncheck the option when connecting, for a read-only connection, and revoke access anytime in Settings → Connected AIs, which cuts off access immediately.
• Brainside remains responsible for its own part: we only deliver data to the assistant you authorized, only from your account, over a protected connection, and we log the writes in the audit trail, marked as coming from a connected AI.
• You can revoke access anytime in Settings → Connected AIs, which cuts off access immediately. You can also disconnect Brainside in the assistant's settings. If you prefer, ask at privacy@brainside.ai and we will revoke all connections on your account. To use it again, you must authorize again.

6. Cookies

You can also manage cookies in your browser settings. Turning off essential cookies may stop the Service from working.

7. Sharing

We do not sell your personal data. We share information only in these cases:

• Providers that run the Service: Google Cloud (hosting, database, file storage and encryption key management), Firebase (authentication), Google Vertex AI and OpenRouter (AI models), Upstash (temporary cache and usage control, such as read-aloud audio for a few hours), Tavily and, as a fallback, DuckDuckGo (web search, when the AI searches the internet; they receive only the search text) and Resend (transactional email). They access data only as needed to provide their service.
• People you share with: if you share an app with someone, they can see that app's data according to the permission you gave.
• Third-party AIs you connect over MCP, as described in Section 5.
• Legal obligations: when required by law, court order or a valid request from an authority.
• Protection of rights: to protect the rights, safety or property of Brainside, its users or others.
• Corporate transactions: in a merger, acquisition or asset sale, with prior notice to you.

8. Your rights (LGPD)

Under Brazil's General Data Protection Law (Law 13.709/2018), you may request:

• Confirmation and access: whether we process your data, and a copy of it;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary or excessive data;
• Portability of your data to another provider;
• Deletion of data processed based on your consent, including deleting your account;
• Information about who we share your data with;
• Withdrawal of consent, at any time;
• Objection to processing that does not comply with the LGPD.

9. Retention

• We keep your data while your account is active.
• A waitlist signup (email and language) has no automatic expiry: it is kept until you ask for its deletion at privacy@brainside.ai.
• When you delete an item, it goes to the trash and stays there until you empty it or delete the item permanently. From there, you can also restore it. While in the trash, the item does not show up in the Service and is not used by the AI.
• The history that lets you undo automatic reorganizations of your memory is erased about 30 days after they are applied.
• Access logs for the Service (IP address, date and time) are kept for 6 months, as required by Brazil's Internet Civil Framework (Law 12.965/2014, art. 15), and then deleted.
• The audit log of writes is kept while the account exists and is deleted together with it. For calls made by an AI connected through MCP, it includes the type of assistant and the source IP address.
• Daily activity records (date and channel of use) are deleted automatically after 13 months.
• To delete your account, write to privacy@brainside.ai from the account's email. We complete the deletion within 30 days of the request. Backups are erased in the regular rotation cycle, and in the meantime they are not used for any other purpose.
• We may keep data for as long as needed to meet a legal obligation or to exercise rights in judicial, administrative or arbitration proceedings (LGPD, art. 16).

10. Security

We use technical and organizational measures to protect your data, including:

• Your data is encrypted with keys specific to each user and each app (AES-256). Those keys are protected by a master key in Google Cloud KMS.
• All traffic over HTTPS.
• Authentication via Firebase Authentication; when you use email and password, the password stays with Firebase and Brainside does not store it.
• Access tokens for AIs connected over MCP stored only as a hash.
• An audit log of writes to your apps, with the origin of each one.
• Account isolation: each person reaches only their own data and what was shared with them.

No method of transmission or storage is 100% secure. If a security incident may cause you relevant risk or harm, we will notify you and the ANPD, as required by art. 48 of the LGPD.

11. Minors

The Service is intended for people 18 and over. We do not knowingly collect data from children or adolescents. If we learn that this happened, we will close the account and delete the data.

12. International transfers

Your data is stored and processed outside Brazil, mainly in the United States, where Google Cloud (us-central1 region) and the providers listed in Section 7 operate.

These transfers follow Article 33 of the LGPD. They are needed to provide the Service you signed up for (art. 33, IX, together with art. 7, V). With the providers that offer them, we also use the standard contractual clauses approved by the ANPD (art. 33, II, "b"; ANPD Resolution No. 19/2024). Providers are bound to protect data at a level compatible with the LGPD.

You can ask for more information about these transfers through the data protection officer's contact (Section 14).

13. Changes to this policy

We may update this policy. For relevant changes, such as a new purpose, a new type of data or new sharing, we will notify you by email or in the Service before they take effect. When a change depends on your consent, we will ask for it again.

14. Data protection officer (DPO)

Brainside's data protection officer is Pedro Muniz. He receives complaints and communications from data subjects and from Brazil's National Data Protection Authority (ANPD), provides clarifications and guides our team on data protection.

Contact the data protection officer at privacy@brainside.ai.

15. Contact

Questions about this policy or your data: privacy@brainside.ai. For anything else, see the Support page.