Privacy Policy

01Controller and contact

Company

Hypersonic Machine Intelligence Services F.Z.E

Address

Office C1 — 1F — SF10191, Ajman Free Zone, United Arab Emirates

Email

andreas@andreaskra.com

If you use the Service through your employer or another organisation (the “Customer”), that Customer decides which accounts and data are connected. For that content, the Customer is the controller and we process it on the Customer’s behalf as a processor, under a data processing agreement. This policy then describes how we handle the data; the Customer’s own privacy notice also applies.

02What the Service does

Company Brain lets an organisation connect Google Drive and Gmail accounts in read-only mode. It indexes the documents and messages those accounts can access, and answers questions with citations to the underlying sources. It never sends emails and never changes or deletes files in connected accounts.

03Data we process

a) Account data: username, display name, email address, role and group memberships, password hash, sessions and API keys (stored only as fingerprints where technically possible).

b) Connected account data (Google Drive and Gmail):

• account identifier and email address of the connected Google account;
• OAuth tokens, stored encrypted;
• file and message metadata such as names, types, versions, folders and sharing status;
• the text content of supported files and messages (for example documents, PDFs, plain-text emails and supported attachments), split into excerpts with a numeric search representation (“embedding”).

c) Questions and answers: the questions you ask, the answers generated, the sources cited, and the conversation history.

d) Usage and security data: access logs, sign-in attempts, security events, error reports, and technical metadata such as timestamps, request paths and IP addresses.

e) Cookies: we use only cookies that are strictly necessary to keep you signed in and to protect against cross-site request forgery. We do not use advertising or analytics cookies.

04Purposes and legal bases

We do not sell personal data, use it for advertising, or make decisions with legal effect about you based solely on automated processing.

05Google user data (Google API Services: Limited Use)

The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We request read-only access to Google Drive and Gmail. We use this data only to provide and improve the user-facing features of the Service: indexing, search and cited answers for the connecting user and the people that user’s organisation has authorised.
• We do not transfer Google user data to others, except as necessary to provide or improve these features (see section 6), to comply with law, for security purposes, or as part of a merger or acquisition with notice to users.
• We do not use Google user data for advertising, and do not sell it.
• Humans do not read Google user data, except with your explicit permission for specific items, where necessary for security purposes or to comply with law, or where the data has been aggregated and anonymised.
• We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.

You can revoke our access at any time by disconnecting the account in the Service, or in your Google Account under Security → Third-party apps with account access.

06Recipients and processors

We use the following service providers, bound by data processing agreements where required:

Search embeddings are computed on our own server; your content is not sent to a third party for that.

Under its commercial terms, Anthropic does not use data received through its API to train its models.

07Transfers outside the EU/EEA

Where data is transferred to the USA (our hosting server at Hostinger, Anthropic, Google), we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

08Retention

• Connected content: kept while the account remains connected and the user still has access in Google. Content the source account loses access to is withheld from answers and deleted in the normal course of operation. Disconnecting an account stops further access and removes its content from the Service within 30 days.
• Captured excerpts used as evidence: retained for at most 30 days after capture unless refreshed.
• Conversations: until deleted by the user or Customer, or 12 months after the account is closed.
• Security and access logs: 90 days, unless needed longer to investigate an incident.
• Backups: overwritten on a rolling basis within 30 days.
• Accounting records: as required by law, currently 7 years.

09Security

We use encryption in transit (TLS) and encryption of stored OAuth tokens, separate databases for content and authorisation, role-based access control, regular re-checks of source permissions, logging and monitoring. No system is perfectly secure; we notify affected parties and authorities of personal data breaches as required by law.

10Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. Contact us at andreas@andreaskra.com. If you use the Service through a Customer, we may forward your request to that Customer.

You have the right to lodge a complaint with a supervisory authority, in Austria the Datenschutzbehörde (www.dsb.gv.at), or the authority in your country of residence.

11Children

The Service is intended for businesses and is not directed at children under 16.

12Changes

We may update this policy. The current version is always available at https://andreaskra.com/brain/privacy. We will inform users of material changes in advance.