Privacy policy

The controller of the data described in this policy is MAJENTIA FORMACION Y DESARROLLO, S.L. ("Brainstack", "we"), tax ID B27683648, registered address Calle José Enrique Marrero Arquitecto, 21, 35017 Las Palmas de Gran Canaria (Las Palmas). Contact for any privacy matter, including data protection officer requests: hola@brainstack.io.

• Controller for the data of people who visit the website, contact us, book a demo, or hold a Brainstack account (accounts, billing, support, security and service emails). Sections 3, 7 to 11 cover this role.
• Processor (Art. 28 GDPR) for the data a customer company puts into Brainstack: what its company brain reads from the tools it connects, what its agents handle, and what its team asks. The customer is the controller and decides what that data is for. Section 4 and the data processing agreement cover this role.

Fields marked as required in a form are needed to handle your request. Without them we cannot help.

Brainstack builds a company brain from the sources a customer connects (for example Gmail, Google Drive, Notion, HubSpot, Slack or Microsoft Teams) and runs agents that work from it, under the approval rules the customer sets. That data (documents, emails, client files, conversations, tasks, and the actions agents take) belongs to the customer, which is the controller. We process it as a processor, only on the customer's instructions, under the data processing agreement.

• It is read only from sources the customer connects. Nothing else is scanned.
• Each person sees only what their role and permissions allow, including when they ask from their own AI app.
• We do not use it for our own purposes, we do not sell it and we do not use it to train AI models.
• If you are a client or contact of a company that uses Brainstack and want to exercise your rights, contact that company. If you write to us, we will pass your request to it and help it answer.

To answer a question or do a task, an agent sends the content it needs to an AI model. Every customer connects its own subscription with Anthropic (Claude), OpenAI (ChatGPT) or Google (Gemini). That provider is chosen and contracted by the customer, which needs its own terms and, where applicable, its own data processing agreement with it. We send content to it only on the customer's instruction. Your server is in Germany, but the AI provider may process data outside the EU under its terms (see section 8).

People in a customer's team can also connect their own AI app (Claude, ChatGPT or Cursor) to the company brain. Each connection signs in as that person and never sees more than that person is allowed to. What they retrieve goes to their AI provider under their company's plan.

• One server per customer. Each customer gets its own virtual server at Hetzner Online GmbH in Germany (Nuremberg or Falkenstein), with its own database, its own vault for passwords and keys, and its own file storage. No other customer shares it.
• Encrypted backups. Backups run every 6 hours, plus daily and monthly copies. Each one is encrypted and signed before it leaves the server and is stored with our backup provider in Ireland (EU).
• Outside the EU. We say "your server is in Germany", not "your data never leaves the EU": AI providers, and some tools you connect, may process data elsewhere under their terms.

When we act for a customer, the services that customer chooses and connects (its AI provider, its channels such as Slack, Telegram, Discord, Microsoft Teams, Gmail or Outlook, and its other integrations) also process data, under their own terms. The current list of our sub-processors is in the data processing agreement.

Stripe, Resend, Meta, Google and the AI providers may process data in the United States or access it from there. Each transfer relies on the EU-US Data Privacy Framework when the provider is certified, or on the standard contractual clauses approved by the European Commission (Decision 2021/914) with supplementary measures where needed. For AI providers the customer contracts directly, the customer holds those safeguards. You can ask us for a copy of ours at hola@brainstack.io.

• Website and security logs: usually no more than 30 days, unless an incident requires longer.
• Demo and contact requests: up to 12 months after the last contact, unless you become a customer.
• Accounts: while the account is active.
• Billing records: 6 years, as Spanish accounting and tax law requires (Commercial Code, art. 30).
• Support: 2 years after the issue is closed.
• Customer data: as the customer decides. When an account closes, the customer has 30 days to export its data; then we delete it and the customer's server.
• Backups: they rotate automatically. Deleted data disappears from them when they expire, within 365 days.

If a law requires us to keep something longer, we keep it blocked and use it only for that purpose.

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting what was done before. Email hola@brainstack.io and tell us which right you want to use. If we have reasonable doubts about who you are, we may ask for more information.

We answer within one month, extendable by two more for complex requests (we will tell you). You can also complain to a data protection authority, in particular where you live or work, or to our lead authority, the Spanish Data Protection Agency (AEPD, aepd.es).

We apply technical and organisational measures suited to the risk (Art. 32 GDPR), including: one isolated server per customer, encrypted traffic (TLS), a vault for passwords and keys, least-privilege access, permissions per person and per role, approvals before an agent sends, publishes, spends or deletes, a record of what each agent did, and encrypted, signed backups every 6 hours. The full list is in the data processing agreement. No system is invulnerable; if a breach affects you, we will act and inform you as the law requires.

Brainstack agents are AI systems. Under Art. 50 of the EU AI Act, people who interact with one should know it unless it is obvious, and our terms require customers to make it clear. We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR). What a customer's agent does is configured by that customer, who can require a person's approval before any action.

Brainstack is not aimed at minors and we do not knowingly collect data from children under 16. If you think we have, write to us and we will delete it.

We explain them in the cookie policy. You can change your choice any time from Cookie settings.

If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will also email customers before it applies.