Privacy Policy

1. Who we are

The Service and the brainattic.ai website are operated by Finite Software Systems Ltd. (Bulgarian: ФИНИТ Софтуер Системс ЕООД) ("FSS", "we", "us"), the provider of the brainattic product.

• Registered office: 4 Gorotzvet Street, Sofia, Bulgaria
• Company No. (ЕИК): 175276896 · VAT: BG175276896
• Privacy contact: privacy@brainattic.ai
• Data Protection Officer: none appointed (not required at our scale); privacy enquiries are handled through the contact above.
• Supervisory authority: Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — www.cpdp.bg

2. Scope

This notice covers (a) the brainattic.ai website and its public contact and registration surfaces and (b) the brainattic Service — the knowledge-base web application and the connector that exposes it to AI clients over the Model Context Protocol (MCP). brainattic is a business-to-business service for organisations and their authorised users aged 18 or over. It is not directed to consumers or children.

3. Controller and processor — who decides what

The split matters because it determines who is responsible for which data:

• Customer Content and customer-directed service records — documents, attachments, search queries, reminders, and in-product audit entries created through your organisation's use of brainattic, including personal data you choose to put in them. Here your organisation is the controller and FSS is a processor acting on documented instructions. This processing is governed by our Data Processing Agreement.
• Account, identity, authentication, access-control, contract-acceptance, website, support, marketing, and operational security data — described below. Here FSS is the controller because FSS determines why and how that data is used to operate, secure, administer, and support the Service.

4. What we process

Account and identity data (FSS as controller). Name, work email, organisation, a securely hashed password where you set one, provider account identifiers and identity claims returned by a sign-in provider (such as name, email, and email-verification status), workspace membership and role, and OAuth/session tokens used to authenticate and authorise you.

Customer Content (FSS as processor). Documents, attachments, vector embeddings derived from content, search queries (for each search: the query text, up to 500 characters, the searching account's identifier, the search mode, the number of results, any project or group filter you applied, and timing and diagnostic data about how the search was served), reminders, edit-session drafts (a working copy of a document your AI client is editing, held with the editing account's identifier for a short period after the edit is committed or discarded), and in-product audit entries, each recording the acting account's identifier and workspace role, the OAuth client identifier of the AI client where the action came through the connector, and the request correlation identifier — plus personal data your organisation chooses to include. When you connect an AI client, the connector returns to that client the knowledge-base content you direct it to retrieve — document bodies, passages, revisions, rule documents and attachment files, the names and descriptions of the projects and groups that organise them, the differences between two versions of a document, and the passage your client asked us to replace when an edit cannot be applied — together with the connector response data described below.

Connector response data (FSS as processor). Alongside content, connector responses carry: record identifiers of the objects you work with (document, revision, attachment, edit-session, reminder and schedule identifiers); the names, short names (slugs) and links that locate content in your workspace (workspace, project, group and document slugs, permalinks, revision numbers, the position of a retrieved passage within its document, and whether a returned snippet is a shortened view of the document it came from); last-modified, archival, document, due, expiry, schedule start and next-run, revision and delivery timestamps; file metadata (name, type, size) for attachments; relevance signals for search results (a relative score, the matching channel, and a confidence level for passage retrieval); counts and sizes (documents in a project or group, recipients on a reminder, total matches, the byte size of a revision, and, in a refusal, the number of workspaces your token is entitled to or the limit the call exceeded); the state of an object after a call (created, updated, archived, attached, detached, linked, unlinked, discarded, resumed, deleted, whether a write changed anything, whether a schedule is active, the delivery channels a reminder uses, a reminder or delivery status and, where a delivery failed, the reason recorded for it, a rule layer or scope) and the display preferences your workspace has set for a project or group (pinned to the menu, hidden); a short-lived download link for an attachment, only when your client asks for one; and, when a call fails, an error reference code you may quote to support, together with the field, tool or permission the refusal names and — where the refusal is a policy one — the link to the acceptance page, the policy bundle and document versions, and the date they take effect.

MCP access events (FSS as processor; FSS as controller for security use). Each connector call that touches your knowledge base — reads included — and each rule-resource read records the tool or resource name, the permission checked, the decision (allowed, denied or failed), your account identifier, the OAuth client identifier of your AI client, the identifier of the access token used (not the token itself), the correlation identifier your client supplied, and the time. Your organisation's administrators can view these events, disable or narrow the recording, set the retention period within the range stated in §10, and optionally store the token's scope and claim attributes with each event.

Reminder-delivery data (FSS as processor). The content and destination needed for a channel your organisation enables: an email address, a Slack member ID, or a mobile phone number.

Contract and registration evidence (FSS as controller). Company/workspace name, the policy bundle, document versions and content hashes presented to you, locale, acceptance time and source, and limited request metadata such as IP address, user agent, and request/correlation identifier. We use this evidence to establish and administer the customer relationship and demonstrate what was accepted.

Technical and security data (FSS as controller). IP address, timestamps, endpoint/request and status, correlation identifier, and basic device/browser metadata in operational and security logs. We use it to keep the Service reliable, investigate abuse, and protect tenants. Operational logs may also carry an error reference code and, for unexpected failures, the error text, which can include text your client sent.

Website, support, and marketing data (FSS as controller). Information you submit through the pilot/contact form, registration flow, or a support request, such as work email, company/workspace name, affected client, and the safe description you provide.

Acquisition and campaign data (FSS as controller). If you consent to optional acquisition-attribution storage, we may record the first allowlisted campaign source associated with your public-site and registration journey: utm_source, utm_medium, utm_campaign, utm_content, utm_term, the landing path without its query string, the referring origin (scheme and host only), a Meta click identifier derived from fbclid, and a LinkedIn first-party advertising click identifier derived from li_fat_id, where present. We do not store unrestricted query strings. Advertising click identifiers are collected only after consent. We preserve the first source rather than overwriting it with later visits and use the record for first-party acquisition and funnel measurement.

Funnel and commercial records (FSS as controller). We record a bounded set of product and commercial milestones, including registration, successful MCP connection and use, activation, commercial qualification, payment, and 7- or 30-day retention, together with the first-source snapshot, staff-controlled commercial status, and the account identifier of the user whose action produced the milestone or activity record. These records do not contain Customer Content and are used to understand whether acquisition results in an activated or commercial relationship.

Advertising-conversion delivery data (FSS as controller). If you separately consent, we may send limited conversion data to Meta Platforms Ireland Limited and/or LinkedIn Ireland Unlimited Company, depending on the campaign source and the advertising platform you consented to. The data are limited to the relevant platform click identifier, the event name and timestamp, and a pseudonymous event-deduplication identifier. For PaidWorkspace only, where a contracted value is recorded and platform delivery of value is enabled, we may also send that value and its currency. The only eligible events are ActivatedWorkspace, CommerciallyQualifiedWorkspace, PaidWorkspace, and, where enabled, RetainedWorkspace30d. We do not send an email address, phone number, name, company name, IP address, user agent, Customer Content, documents, prompts, search text, or unrestricted internal identifiers for this purpose.

reCAPTCHA security data (FSS as controller; Google as processor). Google reCAPTCHA protects the public contact form and, where shown, the public self-registration form against spam, fraud, and abuse. It processes IP address, device/browser or application signals, interaction signals, and a short-lived verification token. Google Cloud EMEA Limited processes that data on FSS's behalf. This is FSS-controlled website/account-security data, not Customer Personal Data processed on a Customer's instructions.

Cookies and security technologies. We use strictly necessary session and CSRF cookies and Google reCAPTCHA's _GRECAPTCHA security cookie. If you consent, we also use optional first-party browser storage to carry the first acquisition source and supported advertising click identifiers through the current public-site and registration journey. We do not install Meta Pixel, LinkedIn Insight Tag code, or any other third-party advertising, analytics, or behavioural-tracking runtime on the site. See the Cookie Statement.

What we do not collect. We do not request or store the broader content of your AI conversations or prompts. When you use brainattic through an AI client, the connector receives only the input needed for the action you request and returns a tenant-scoped result. We do not ingest the rest of your chat history, transcripts, or precise location.

5. How the connector handles data

brainattic exposes MCP tools that read and write your knowledge base under your instruction. Each tool processes only the inputs required for that call and returns the content you asked for plus the connector response data described in §4. Results are returned to your AI client in two equivalent forms — as structured data and as a text rendering of the same data — so clients that read only one form still receive the result. Every call that touches your knowledge base records one MCP access event (§4); a search additionally records a search-log entry; a write additionally records an in-product audit entry. Tools are permission-gated, tenant-scoped and paginated; write actions are explicit; attachment download links and document bodies on write confirmations are returned only when your client asks for them. An Authorised User who has not accepted a required material policy version is refused with an error naming the acceptance page, and the refusal records nothing.

6. Why we process data and our legal bases (GDPR Art. 6)

We do not sell personal data, use Customer Content for advertising, build behavioural advertising profiles inside brainattic, or make automated eligibility decisions. If you consent, limited conversion events may be sent to Meta and/or LinkedIn for attribution, measurement, personalisation, and optimisation of FSS advertising. The recipient may match and use those events under its applicable advertising and data-protection terms. FSS does not send Customer Content, email addresses, phone numbers, names, company names, IP addresses, or user agents for this purpose.

7. AI models and clients

brainattic does not send Customer Content to a third-party AI model. The AI client you choose, such as Claude, ChatGPT, or Mistral, connects to brainattic as your client. Your use of that AI is governed by your relationship with its provider. That provider is not our Sub-processor, and we are not theirs, for this purpose. The client may receive content that you direct brainattic to return.

8. Who else is involved

The core Service is self-hosted on FSS-controlled infrastructure in the EU, including document storage, search and embeddings, email, and FSS's authorisation server. The following external parties may be involved:

Google Cloud EMEA Limited acts as our processor for reCAPTCHA data used to protect the public contact and self-registration forms. This processing is outside the customer DPA and its Annex III because FSS controls it for its own website and account-security purpose. Google, Meta, and Apple act as separate controllers for their optional sign-in services and are outside Annex III for that distinct reason. Separately, Meta's role for consented Meta Conversions API processing is allocated by the Meta Business Tools Terms as described above. LinkedIn Ireland Unlimited Company acts as an independent controller for LinkedIn Marketing Solutions Conversion Tracking and Conversions API under the LinkedIn Independent Controller Addendum and may use the data to deliver, support, and improve those products, including conversions, and for its own reporting and performance analysis. These controller-side advertising activities are outside the customer DPA and Annex III.

9. International transfers

FSS stores core Service data on infrastructure in Bulgaria, European Union. Processing outside the EEA may occur when your organisation enables Slack delivery in the United States, you choose an identity provider whose international operations process the sign-in interaction, Google processes reCAPTCHA data in a country where Google or its Subprocessors maintain facilities, or consented advertising-conversion data is processed through Meta's or LinkedIn's international operations. Restricted reCAPTCHA transfers rely on the mechanisms and safeguards in the Google Cloud Data Processing Addendum. Meta conversion processing is governed by the Meta Business Tools Terms, incorporated processing terms, and applicable transfer safeguards. For the LinkedIn relevant products described above, restricted EU transfers use Module 1 controller-to-controller Standard Contractual Clauses under the LinkedIn Independent Controller Addendum. Other recipients must use an appropriate GDPR Chapter V mechanism where required. SMS delivery through Yettel stays within the EU.

10. How long we keep data

During the bounded 90-day post-closure period, the tenant remains disabled. Retained records are sanitized and used only for security investigation, abuse prevention, service-integrity verification, contract evidence, and the establishment, exercise, or defence of legal claims. A legal hold must be explicit and documented; it is not the default. When the hold or legal duty ends, deletion resumes.

The acquisition, funnel, conversion-delivery, and commercial records listed above are FSS's own business and marketing records. They are stored separately from Customer Content, remain usable without retaining a closed workspace or its content, and may survive workspace closure for the listed periods. They do not preserve Customer Content. When the applicable period ends, identifiers are deleted or the remaining statistics are made genuinely anonymous, unless a documented legal duty or hold requires longer retention.

11. How we protect data

We use TLS encryption in transit, role-based access controls and least-privilege administration, logical isolation of customer tenants, network segmentation, and physical security at our data-centre facility. Our practices are aligned with the principles of ISO/IEC 27001, ISO/IEC 20000, and ISO 9001; FSS was previously certified to these standards, but certifications are not currently maintained. Operational logs do not contain broader AI prompts and do not record document bodies in the ordinary course; where an unexpected failure is recorded, the error text may include content your client sent, as described in §4. Search text is held only in the search log described in §4 and §10. We do not log or persist the reCAPTCHA token or Google's raw verification response.

12. Your rights

Subject to the GDPR, you may have rights of access, rectification, erasure, restriction, and data portability, and the right to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. To exercise rights concerning data for which FSS is controller, email privacy@brainattic.ai; we normally respond within one month.

You may object to first-party acquisition, funnel, and commercial measurement based on legitimate interests. If the objection is upheld, we suppress future use and future advertising-platform delivery linked to the identifiable record. You may withdraw advertising-conversion consent at any time through the site's cookie choices or by emailing privacy@brainattic.ai; withdrawal stops future delivery to Meta and LinkedIn but does not reverse processing already completed by either recipient. We erase identifiers where no overriding legal basis requires retention; genuinely anonymous aggregate campaign counts may remain.

For advertising-conversion data, FSS remains your first contact for FSS-controlled collection and disclosure and will coordinate with the relevant recipient where the applicable role allocation requires it. Meta and LinkedIn may also provide their own advertising and off-platform-activity controls under their respective services.

For Customer Content for which your organisation is controller, direct your request to that organisation; we will assist it as processor. For data processed independently by Google, Meta, or Apple during sign-in, exercise your rights with the relevant provider. For reCAPTCHA data, FSS remains your controller contact and Google processes the data on our behalf.

You may complain to the Commission for Personal Data Protection (CPDP), www.cpdp.bg, or another competent EU supervisory authority.

13. Children

brainattic is intended for business users aged 18 or over. It is not directed to children, and we do not knowingly process children's personal data through the public registration flow.

14. Changes to this notice

We may update this policy. We publish each version with its publication and effective dates. For material changes, we normally give at least 14 days' notice and notify customers through the Service or by email. We may require renewed acceptance before tenant-data web or MCP access continues after the effective date.

15. Contact

Privacy and data-protection enquiries: privacy@brainattic.ai. Product support: brainattic.ai/support or hello@brainattic.ai.

Finite Software Systems Ltd. — 4 Gorotzvet Street, Sofia, Bulgaria.