Privacy Policy

1. Who we are

The Service and the brainattic.ai website are operated by Finite Software Systems Ltd. (Bulgarian: ФИНИТ Софтуер Системс ЕООД) ("FSS", "we", "us"), the provider of the brainattic product.

• Registered office: 4 Gorotzvet Street, Sofia, Bulgaria
• Company No. (ЕИК): 175276896 · VAT: BG175276896
• Privacy contact: privacy@brainattic.ai
• Data Protection Officer: none appointed (not required at our scale); privacy enquiries are handled through the contact above.
• Supervisory authority: Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — www.cpdp.bg

2. Scope

This notice covers (a) the brainattic.ai website and its public contact and registration surfaces and (b) the brainattic Service — the knowledge-base web application and the connector that exposes it to AI clients over the Model Context Protocol (MCP). brainattic is a business-to-business service for organisations and their authorised users aged 18 or over. It is not directed to consumers or children.

3. Controller and processor — who decides what

The split matters because it determines who is responsible for which data:

• Customer Content and customer-directed service records — documents, attachments, reusable Skills and their supporting files, search queries, reminders, and in-product audit entries created through your organisation's use of brainattic, including personal data you choose to put in them. Here your organisation is the controller and FSS is a processor acting on documented instructions. This processing is governed by our Data Processing Agreement.
• Account, identity, authentication, access-control, contract-acceptance, website, support, marketing, and operational security data — described below. Here FSS is the controller because FSS determines why and how that data is used to operate, secure, administer, and support the Service.

4. What we process

Account and identity data (FSS as controller). Name, work email, organisation, a securely hashed password where you set one, provider account identifiers and identity claims returned by a sign-in provider (such as name, email, and email-verification status), workspace membership and role, and OAuth/session tokens used to authenticate and authorise you.

Customer Content (FSS as processor). Documents, attachments, reusable Skills (procedural instructions, their names and descriptions, licence and compatibility text, author-supplied metadata, requested tool permissions and supporting files), vector embeddings derived from content, search queries, reminders, edit-session drafts, and in-product audit entries — plus personal data your organisation chooses to include. Document-search logs contain the query text, up to 500 characters, the searching account's identifier, the search mode, the number of results, any project or group filter you applied, and timing and diagnostic data about how the search was served. A Skills search processes the query to search the current Skill name, description and instruction body; supporting-file content, earlier revisions and drafts are excluded from that search. Edit-session drafts hold working content and staged files with the editing account's identifier while a document or Skill is being edited and for the short terminal-retention period stated in §10. In-product audit entries record the acting account's identifier and workspace role, the OAuth client identifier where the action came through the connector, and the request correlation identifier. Skill changes additionally record the Skill's identifiers and name, selected revision numbers, a previous name where it changes, the changed file paths and requested tool-permission text where present. When you connect an AI client, the connector returns to that client the knowledge-base content you direct it to retrieve — document bodies, passages, revisions, rule documents, attachment files, and Skill instructions and supporting-file bytes, including scripts, as well as names and descriptions, differences between versions, and the passage your client asked us to replace when an edit cannot be applied — together with the connector response data described below.

Connector response data (FSS as processor). Alongside content, connector responses carry: record identifiers of the objects you work with (document, revision, attachment, edit-session, reminder, schedule and Skill identifiers, and the identifier of a queued deletion or revision-purge operation); the names, short names (slugs) and links that locate content in your workspace (workspace, project, group and document slugs, Skill names, permalinks, rule and Skill resource links, file paths, revision numbers, the position of a retrieved passage within its document, and shortened document or Skill-body snippets); last-modified, archival, document, due, expiry, schedule start and next-run, revision, purge and delivery timestamps; file metadata (name or path, type, byte size and text or base64 representation) for attachments and Skill files; SHA-256 content digests in native Skill file descriptors, used to verify the exact file bytes; relevance signals for document-search results (a relative score, the matching channel, and a confidence level for passage retrieval); counts and sizes (documents in a project or group, recipients on a reminder, total matches, listing totals, the byte size of a revision or file, the maximum file-upload or inline-delivery size, and, in a refusal, the number of workspaces your token is entitled to or the limit the call exceeded); the state of an object after a call (created, updated, archived, attached, detached, linked, unlinked, discarded, resumed, deleted or purged, whether a write changed anything, whether a schedule is active, delivery channels and status, the recorded reason for a failed delivery or queued operation, and a rule layer or scope); available or unavailable rule-linked Skill recommendations; fixed warnings and notices identifying untrusted procedural content, content not approved for execution and a requested tool permission that is not a grant; your workspace's display preferences for a project or group (pinned to the menu, hidden); a short-lived download or upload link for an attachment, only when your client asks for one; and, when a call fails, an error reference code you may quote to support, the field, tool, permission, caller-supplied path, selected Skill or revision the refusal names, an allowed retry delay where a call budget is exceeded, and — where the refusal is a policy one — the acceptance-page link, policy bundle and document versions, and the date they take effect.

Attachment transfer data (FSS as processor). When your AI client imports an attached file, we use the temporary file download URL and provider file ID it supplies only to retrieve the original bytes; neither is retained. If a client sends original bytes directly, we create an upload session bound to the selected document and acting account. Its upload capability expires after five minutes and can be used once. We store session metadata linking it to that document and account, including a hash of the capability, the filename, the expiry time and any expected file checksum; we never store the raw capability. An hourly cleanup removes expired session metadata after 24 hours and no later than 25 hours after expiry.

MCP access events (FSS as processor; FSS as controller for security use). For connector calls that touch your knowledge base — reads included — and rule-resource or Skill catalogue/file reads, MCP access-event recording captures the tool or resource name, the permission checked, the decision (allowed, denied or failed), your account identifier, the OAuth client identifier of your AI client, the identifier of the access token used (not the token itself), the correlation identifier your client supplied, and the time. Your organisation's administrators can view these events, disable or narrow the recording, set the retention period within the range stated in §10, and optionally store the token's scope and claim attributes with each event.

Reminder-delivery data (FSS as processor). The content and destination needed for a channel your organisation enables: an email address, a Slack member ID, or a mobile phone number.

Contract and registration evidence (FSS as controller). Company/workspace name, the policy bundle, document versions and content hashes presented to you, locale, acceptance time and source, and limited request metadata such as IP address, user agent, and request/correlation identifier. We use this evidence to establish and administer the customer relationship and demonstrate what was accepted.

Technical and security data (FSS as controller). IP address, timestamps, endpoint/request and status, correlation identifier, and basic device/browser metadata in operational and security logs. We use it to keep the Service reliable, investigate abuse, and protect tenants. Operational logs may also carry an error reference code and, for unexpected failures, the error text, which can include text your client sent. To apply Skills call limits, we keep short-lived call counters and timer values under a protected key associated with the workspace and account; these counters do not contain content or access tokens.

Website, support, and marketing data (FSS as controller). Information you submit through the pilot/contact form, registration flow, or a support request, such as work email, company/workspace name, affected client, and the safe description you provide.

Acquisition and campaign data (FSS as controller). If you consent to optional acquisition-attribution storage, we may record the first allowlisted campaign source associated with your public-site and registration journey: utm_source, utm_medium, utm_campaign, utm_content, utm_term, the landing path without its query string, the referring origin (scheme and host only), a Meta click identifier derived from fbclid, and a LinkedIn first-party advertising click identifier derived from li_fat_id, where present. We do not store unrestricted query strings. Advertising click identifiers are collected only after consent. We preserve the first source rather than overwriting it with later visits and use the record for first-party acquisition and funnel measurement.

Funnel and commercial records (FSS as controller). We record a bounded set of product and commercial milestones, including registration, successful MCP connection and use, activation, commercial qualification, payment, and 7- or 30-day retention, together with the first-source snapshot, staff-controlled commercial status, and the account identifier of the user whose action produced the milestone or activity record. These records do not contain Customer Content and are used to understand whether acquisition results in an activated or commercial relationship.

Advertising-conversion delivery data (FSS as controller). If you separately consent, we may send limited conversion data to Meta Platforms Ireland Limited and/or LinkedIn Ireland Unlimited Company, depending on the campaign source and the advertising platform you consented to. The data are limited to the relevant platform click identifier, the event name and timestamp, and a pseudonymous event-deduplication identifier. For PaidWorkspace only, where a contracted value is recorded and platform delivery of value is enabled, we may also send that value and its currency. The only eligible events are ActivatedWorkspace, CommerciallyQualifiedWorkspace, PaidWorkspace, and, where enabled, RetainedWorkspace30d. We do not send an email address, phone number, name, company name, IP address, user agent, Customer Content, documents, prompts, search text, or unrestricted internal identifiers for this purpose.

reCAPTCHA security data (FSS as controller; Google as processor). Google reCAPTCHA protects the public contact form and, where shown, the public self-registration form against spam, fraud, and abuse. It processes IP address, device/browser or application signals, interaction signals, and a short-lived verification token. Google Cloud EMEA Limited processes that data on FSS's behalf. This is FSS-controlled website/account-security data, not Customer Personal Data processed on a Customer's instructions.

Cookies and security technologies. We use strictly necessary session and CSRF cookies and Google reCAPTCHA's _GRECAPTCHA security cookie. If you consent, we also use optional first-party browser storage to carry the first acquisition source and supported advertising click identifiers through the current public-site and registration journey. We do not install Meta Pixel, LinkedIn Insight Tag code, or any other third-party advertising, analytics, or behavioural-tracking runtime on the site. See the Cookie Statement.

What we do not collect. We do not request or store the broader content of your AI conversations or prompts. When you use brainattic through an AI client, the connector receives only the input needed for the action you request and returns a tenant-scoped result. We do not ingest the rest of your chat history, transcripts, or precise location.

5. How the connector handles data

brainattic exposes MCP tools and native resources that read and write your knowledge base under your instruction. Each call processes the inputs required for that call and returns the content you asked for plus the connector response data described in §4. Tool results are returned as structured data and a text rendering of the same data; native Skill and resource responses use the protocol's file and content representations. Calls that touch your knowledge base, including native Skill listing and file reads, pass through the same tenant, permission, policy and access-event controls. Document searches additionally record the search-log entry described in §4; Skills searches do not create a document-search log entry. Committed content and lifecycle changes record an in-product audit entry; Skill draft staging and no-op calls do not create a committed-content audit entry. Tools are permission-gated, tenant-scoped and paginated; write actions are explicit; attachment download and upload links and document bodies on write confirmations are returned only when your client asks for them. Full-content Skill tools can return the complete instruction file and selected supporting-file bytes, subject to the stated delivery limits; Skill search returns the current name, description and an optional bounded body snippet. A Skill or requested tool-permission header is customer-authored content, not an access grant or approval to execute it. brainattic stores and serves this content and does not execute scripts; your organisation and AI client decide whether to load or execute returned content under their own permissions and approval controls. Skill content digests let an AI client bind its approval to the exact file bytes. They are unsigned values from the server and do not establish authenticity, trust or a security boundary. Approval of an earlier revision does not approve a newly current revision. An Authorised User who has not accepted a required material policy version is refused with an error naming the acceptance page, and that policy refusal records nothing.

6. Why we process data and our legal bases (GDPR Art. 6)

We do not sell personal data, use Customer Content for advertising, build behavioural advertising profiles inside brainattic, or make automated eligibility decisions. If you consent, limited conversion events may be sent to Meta and/or LinkedIn for attribution, measurement, personalisation, and optimisation of FSS advertising. The recipient may match and use those events under its applicable advertising and data-protection terms. FSS does not send Customer Content, email addresses, phone numbers, names, company names, IP addresses, or user agents for this purpose.

7. AI models and clients

brainattic does not send Customer Content to a third-party AI model. The AI client you choose, such as Claude, ChatGPT, or Mistral, connects to brainattic as your client. Your use of that AI is governed by your relationship with its provider. That provider is not our Sub-processor, and we are not theirs, for this purpose. The client may receive content that you direct brainattic to return.

8. Who else is involved

The core Service is self-hosted on FSS-controlled infrastructure in the EU, including document storage, search and embeddings, email, and FSS's authorisation server. The following external parties may be involved:

Google Cloud EMEA Limited acts as our processor for reCAPTCHA data used to protect the public contact and self-registration forms. This processing is outside the customer DPA and its Annex III because FSS controls it for its own website and account-security purpose. Google, Meta, and Apple act as separate controllers for their optional sign-in services and are outside Annex III for that distinct reason. Separately, Meta's role for consented Meta Conversions API processing is allocated by the Meta Business Tools Terms as described above. LinkedIn Ireland Unlimited Company acts as an independent controller for LinkedIn Marketing Solutions Conversion Tracking and Conversions API under the LinkedIn Independent Controller Addendum and may use the data to deliver, support, and improve those products, including conversions, and for its own reporting and performance analysis. These controller-side advertising activities are outside the customer DPA and Annex III.

9. International transfers

FSS stores core Service data on infrastructure in Bulgaria, European Union. Processing outside the EEA may occur when your organisation enables Slack delivery in the United States, you choose an identity provider whose international operations process the sign-in interaction, Google processes reCAPTCHA data in a country where Google or its Subprocessors maintain facilities, or consented advertising-conversion data is processed through Meta's or LinkedIn's international operations. Restricted reCAPTCHA transfers rely on the mechanisms and safeguards in the Google Cloud Data Processing Addendum. Meta conversion processing is governed by the Meta Business Tools Terms, incorporated processing terms, and applicable transfer safeguards. For the LinkedIn relevant products described above, restricted EU transfers use Module 1 controller-to-controller Standard Contractual Clauses under the LinkedIn Independent Controller Addendum. Other recipients must use an appropriate GDPR Chapter V mechanism where required. SMS delivery through Yettel stays within the EU.

10. How long we keep data

Committed Skill revisions and supporting-file bytes remain Customer Content while they are retained in the active workspace. Archiving a Skill hides its live entry and frees a Skill slot, but does not delete its retained files or history. An authorised revision purge removes that revision's retained content and leaves a minimal tombstone in the retained Skill history. An authorised Skill deletion removes the aggregate, its retained history and its referenced content. The corresponding audit entries, including audited file paths, remain under the audit retention rules above. Copies in an open draft and files still referenced by another retained revision remain until that reference is removed. Workspace export and the dormancy-only encrypted recovery archive include retained Skill content under the lifecycle periods in this section; derived search caches and vectors are rebuilt rather than restored from that archive.

During the bounded 90-day post-closure period, the tenant remains disabled. Retained records are sanitized and used only for security investigation, abuse prevention, service-integrity verification, contract evidence, and the establishment, exercise, or defence of legal claims. A legal hold must be explicit and documented; it is not the default. When the hold or legal duty ends, deletion resumes.

The acquisition, funnel, conversion-delivery, and commercial records listed above are FSS's own business and marketing records. They are stored separately from Customer Content, remain usable without retaining a closed workspace or its content, and may survive workspace closure for the listed periods. They do not preserve Customer Content. When the applicable period ends, identifiers are deleted or the remaining statistics are made genuinely anonymous, unless a documented legal duty or hold requires longer retention.

11. How we protect data

We use TLS encryption in transit, role-based access controls and least-privilege administration, logical isolation of customer tenants, network segmentation, and physical security at our data-centre facility. Our practices are aligned with the principles of ISO/IEC 27001, ISO/IEC 20000, and ISO 9001; FSS was previously certified to these standards, but certifications are not currently maintained. Operational logs do not contain broader AI prompts and do not record document bodies in the ordinary course; where an unexpected failure is recorded, the error text may include content your client sent, as described in §4. Document-search text is held in the search log described in §4 and §10; a Skills search does not create that log entry. We do not log or persist the reCAPTCHA token or Google's raw verification response.

12. Your rights

Subject to the GDPR, you may have rights of access, rectification, erasure, restriction, and data portability, and the right to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. To exercise rights concerning data for which FSS is controller, email privacy@brainattic.ai; we normally respond within one month.

You may object to first-party acquisition, funnel, and commercial measurement based on legitimate interests. If the objection is upheld, we suppress future use and future advertising-platform delivery linked to the identifiable record. You may withdraw advertising-conversion consent at any time through the site's cookie choices or by emailing privacy@brainattic.ai; withdrawal stops future delivery to Meta and LinkedIn but does not reverse processing already completed by either recipient. We erase identifiers where no overriding legal basis requires retention; genuinely anonymous aggregate campaign counts may remain.

For advertising-conversion data, FSS remains your first contact for FSS-controlled collection and disclosure and will coordinate with the relevant recipient where the applicable role allocation requires it. Meta and LinkedIn may also provide their own advertising and off-platform-activity controls under their respective services.

For Customer Content for which your organisation is controller, direct your request to that organisation; we will assist it as processor. For data processed independently by Google, Meta, or Apple during sign-in, exercise your rights with the relevant provider. For reCAPTCHA data, FSS remains your controller contact and Google processes the data on our behalf.

You may complain to the Commission for Personal Data Protection (CPDP), www.cpdp.bg, or another competent EU supervisory authority.

13. Children

brainattic is intended for business users aged 18 or over. It is not directed to children, and we do not knowingly process children's personal data through the public registration flow.

14. Changes to this notice

We may update this policy. We publish each version with its publication and effective dates. For material changes, we normally give at least 14 days' notice and notify customers through the Service or by email. We may require renewed acceptance before tenant-data web or MCP access continues after the effective date.

15. Contact

Privacy and data-protection enquiries: privacy@brainattic.ai. Product support: brainattic.ai/support or hello@brainattic.ai.

Finite Software Systems Ltd. — 4 Gorotzvet Street, Sofia, Bulgaria.