Privacy Policy

Last updated 23 June 2026

This policy explains how Cerebrain handles your personal data. We built Cerebrain so your data stays hosted in Europe, is read only by default, and is never sold. We work in line with the EU General Data Protection Regulation (GDPR).

1. Who we are

2. What data we process

• Account data: your name, work email, company, and sign-in identity (for example through Microsoft or Google) so you can log in.
• Connected business data: only the sources you choose to connect (such as mail, files, calendar, accounting or chat). Cerebrain reads these to answer your questions and run the workflows you ask for. By default this access is read only.
• Usage data: basic technical logs (for example time of a request and which model was used) to run, secure and bill the service.

3. How we use it and the legal basis

• To provide the service you asked for, and to read and answer from the sources you connected. Legal basis: performance of our contract with you.
• To keep the service secure and reliable, and to prevent abuse. Legal basis: our legitimate interest.
• To bill you and meet our legal and accounting obligations. Legal basis: legal obligation and contract.

We do not sell your data, and we do not use the content of your connected business data to train AI models.

4. Where your data lives

Your data is hosted on servers in the European Union. Our architecture is built around one database per customer; we are moving every account onto it, and the current state is published on our security page. Access tokens for the sources you connect are stored on your own server and you can revoke them at any time.

5. Sub-processors

To deliver the service we rely on a small number of carefully chosen providers. The AI engine you pick determines who processes a given request:

When you choose a US AI engine (Claude or GPT), the text of your request is processed in the US under appropriate safeguards. If you want every request to stay inside the EU, choose the European engine (Mistral). See our security page for the full sub-processor list and data-flow diagram.

6. How long we keep it

We keep account and billing data for as long as you have an account and as long as the law requires afterwards. Connected business data and access tokens are kept only while the connection is active; remove a connection or close your account and we delete them.

7. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. To exercise any of these, email info@cerebrain.app. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, gegevensbeschermingsautoriteit.be).

8. Security

Data is encrypted in transit (HTTPS) and at rest per tenant, and access is restricted. We work toward SOC 2 and ISO 27001; until those audits are complete we do not claim them. See our security page for what is in place today and what is still in progress. A data processing agreement is available on request at info@cerebrain.app.

9. Cookies

The website uses only what is needed to remember your language choice and keep you signed in. We do not use advertising or third-party tracking cookies.

10. Changes

We may update this policy. We will change the date at the top and, for significant changes, let you know.

11. Contact

Questions about your data? Email info@cerebrain.app.