Privacy Policy

The service is operated by MyBrain ("we"), the controller of your personal data under Brazil's LGPD and, where applicable, the EU GDPR. The controller is Human Brains Ltda (details in the footer).

For anything concerning your data, or to exercise your rights, talk to our privacy team. Our Data Protection Officer (DPO) is Marcos Nader, reachable at privacy@mybrain.ai.

Data you provide

• Account and sign-in: your name, your email and the details of the login you choose — LinkedIn, Google or a code sent by email.
• Your content: everything you capture — text, notes, documents, audio and voice interviews with Maia — and everything you add to your MyBrain. It is the heart of the product and gets the strongest protection in this policy (sections 4 and 5).
• Content from apps you connect: if you connect services such as Notion, Google Drive, Dropbox, OneDrive, Box or your email, we import only what you authorize, within the permission granted, and you can disconnect whenever you want.
• Content you import from other AI tools: you can bring in your history from assistants such as ChatGPT or Gemini. You represent that you hold the rights to that content (see the Terms of Use).
• Communications:what you exchange with the team in support and in beta feedback conversations. You choose when to start a voice conversation with Maia. While the microphone is capturing, the screen shows it. The audio and the transcript go into your MyBrain like any other source you add, stay under your control and remain there until you delete them. They count toward your plan's storage.

Data from public sources: during onboarding, with your authorization, we look up public information about you (on LinkedIn, for example) to suggest sources for your MyBrain — and you approve item by item what goes in.

Data generated by usage: usage telemetry (which features you use, when), performance metrics and error logs — designed to record events, not the content of your captures — plus technical data (IP, device, browser, operating system, language).

What we do not collect: we do not ask for or deliberately collect sensitive data (racial origin, religious belief, political opinion, health, biometrics). If you capture something sensitive in your MyBrain, we handle it with the protections in section 5 and never use it for any purpose of our own.

• We do not sell or rent your personal data or your content.
• We do not use your data for advertising, nor do we let third parties do it on MyBrain's behalf.
• We do not use your content to train AI models— neither ours nor third parties'. We work only with providers whose policies forbid using customer data for training.
• We do not access your content, unless you request support and authorize it, or we are under a legal obligation.

The exception is up to you. If you turn on the option to use your own key for an external AI model (section 5), that flow then follows the terms of the provider you chose, and the commitments above no longer apply to it. We tell you clearly before you turn it on.

MyBrain organizes your knowledge in a graph of its own. The language model is only the query interface: it serves the graph, which is why your content does not have to become training data for the product to work.

You choose how your content is processed.

Privacy mode (the default during the beta). Your private content is processed by models we run on our own infrastructure. Three flows still use an external provider (OpenAI) today: reading your public LinkedIn profile during onboarding; a short summary of your five main topics, used to write your welcome message; and the question you send when MyBrain searches the web.

Quality mode. Your content is sent to external AI providers, as it is, to get stronger answers.

In both modes, providers are contractually forbidden from training on your data.

Not live yet. A pseudonymization layer, which would replace names, emails and other identifiers with neutral markers before anything reaches an external model, is on our roadmap. It is not in production today. We will update this page when it is.

Your key, your rules. You can connect your own key from an external provider and use it directly — a deliberate trade of more capability for less protection. The option is off by default. Actions that leave the protected environment, such as web search, are listed above. You can see and change your mode at any time in Settings.

We share personal data only with:

• Processors acting for MyBrain: cloud infrastructure (Amazon Web Services and Google Cloud), external AI model providers and product analytics tools. All under contracts that forbid using the data for their own purposes. The list of sub-processors can be requested at privacy@mybrain.ai.
• Public authorities, upon a legal obligation, court order or request from a competent authority.
• Successors in a corporate transaction (merger, acquisition), in which case we notify you beforehand and this policy remains in force until formally changed.

International transfers. Part of the infrastructure and of the AI providers sits outside Brazil and outside the European Economic Area. In those cases, the transfer takes place with adequate safeguards — including the European Commission's Standard Contractual Clauses and equivalent contractual guarantees, under arts. 33 to 36 of the LGPD — which ensure protection compatible with applicable law.

We keep your data for as long as necessary for the purposes in this policy. You can delete your account at any time in the product's data controls; deletion erases your data within 30 days, backups included, except what we must retain under a legal obligation or for the regular exercise of rights. Waitlist data that never becomes an account is kept for up to 12 months after the last contact.

Under art. 18 of the LGPD, you may request: confirmation that processing takes place; access; correction; anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; deletion of data processed on the basis of consent; information about sharing; and withdrawal of consent. You also control your MyBrain directly in the product: you can review, correct and delete pieces of knowledge that do not represent you.

Exporting your data: during the beta, upon request, we send a copy of your data in a readable format within 15 days.

To exercise any right, write to privacy@mybrain.ai. We answer within 7 days. You may also petition Brazil's National Data Protection Authority (ANPD) or, in the European Union, your local supervisory authority.

We adopt technical and organizational measures appropriate to the nature of the data: encryption in transit and at rest, the option to keep AI processing on our own models (Privacy mode), and no-training contracts with external AI providers, role-based access control, and telemetry that records usage events, not the content of your captures. No system is invulnerable, which is why we describe our stage and next steps honestly. In the event of a security incident with risk to your rights, we notify you and the competent authority — the ANPD under art. 48 of the LGPD and, where EU users are affected, the supervisory authority within 72 hours, under art. 33 of the GDPR.

The website and the app use essential cookies (authentication, security), preference cookies (language, settings) and usage analytics cookies. We do not use advertising cookies or cross-site tracking. You manage them in your browser settings; the essential ones are required for the product to work. For users in the European Union, non-essential cookies depend on your prior consent.

MyBrain is not intended for people under 18 and we do not deliberately collect data from minors. By creating an account, you declare that you are 18 or older. If we identify an account belonging to a minor, we close it and delete the data.

We may update this policy to reflect changes in the product or in the law. The date at the top indicates the version in force. We notify you of relevant changes by email; changes that depend on consent only take effect after you consent, and we record the acceptance with date, time and the version of the documents then in force.

Questions about this policy, your data or your rights: privacy@mybrain.ai.

If you are in the European Economic Area or the United Kingdom, in addition to the rights above you have the right to object to processing based on legitimate interest and to direct marketing (art. 21), to restrict processing (art. 18) and not to be subject to a decision based solely on automated processing with significant effect (art. 22). The legal bases correspond to arts. 6 and 9 of the GDPR. Transfers of data outside the European Economic Area rely on the European Commission's Standard Contractual Clauses, with a transfer impact assessment. In the event of a data breach with risk to your rights, we notify the competent supervisory authority within 72 hours (art. 33). For any of these rights, talk to privacy@mybrain.ai.

What we access. If you sign in with Google, we receive your email address to authenticate you. If you connect Google Drive, we read only files you own — not files other people shared with you, and not shared drives — across your whole Drive or only in the folders you choose. We download those files to assess what would be worth bringing into your MyBrain, and nothing is added without your approval unless you turn on automatic approval. MyBrain never writes to, changes or deletes anything in your Drive.

What we use it for. Solely to deliver the product's features to you: organizing that content in your MyBrain, keeping it in sync as files change, and answering your own queries. None of it serves any purpose of ours, of a third party, or of another user.

What we never do. We do not sell or rent information received from Google APIs, we do not use it for advertising, and we do not use it to train or improve AI models. AI processing happens in order to answer you, about your own content, with the protection described in section 5. No one on the team reads that content, unless you request support and authorize it, for security reasons, or where the law requires.

Limited Use. MyBrain's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to stop it. You can disconnect Google Drive at any time in the connected-apps area, and disconnecting ends our access. Content already imported follows the retention and deletion rules in section 7, and you can also delete it item by item in the product. You can also revoke access directly in your Google Account.