PRIVACY POLICY

What we collect: the information you give us (such as your name, email address and the profile or website URLs you submit), the content you add to your agents, conversations with agents, and technical and usage data collected through cookies and analytics.

Google user data: if you sign in with Google, we receive only your name, email address, profile picture and Google account identifier. We use it only to create and sign you in to your Brainstormer account. We do not access your Gmail, Google Drive, Calendar, Contacts or any other Google service.

Sharing: we do not sell your data. We share it only with the service providers who help us run the Services, when the law requires it, or as part of a business transfer.

Protection: data is encrypted in transit using HTTPS/TLS, and access to it is restricted to authorized personnel.

Retention and deletion: we keep data only for as long as we need it and delete it when you delete your account or ask us to. See section 9.

Information you give us.

• Account information: your name, email address and password (stored only as a secure hash), or the details we receive from Google if you sign in with Google (see section 2).
• Agent-building information: the YouTube or Instagram profile URL or the store website URL you submit to build an agent, and the email address you provide so we can send you the result.
• Agent content: documents, links, instructions and other material you upload or connect to train and configure your agents.
• Enquiries: your name, email address, company and message when you contact us or request a demo.
• Billing information: if you purchase a paid plan, your billing details are collected and processed by our payment processor. We do not store full card numbers.

Information from conversations with agents.When you chat with an agent built on Brainstormer, we process the messages you send and the agent's replies so the agent can respond, and so the agent's owner can review conversations.

Publicly available information. When you submit a public YouTube or Instagram profile or a store website, we retrieve publicly available content from it (such as video titles, captions, transcripts, post text and product pages) to build the agent you asked for.

Information collected automatically.IP address, browser and device type, pages visited, referring URLs, and approximate location derived from your IP address, collected through cookies and similar technologies (see section 6). We also store a small amount of state in your browser's local storage (the URL and email you entered and the status of your agent build) for up to 7 days so you can return to your demo.

Sensitive information. We do not ask for or intentionally collect sensitive personal information, such as health, financial account, biometric or government ID data.

The Brainstormer application at https://app.brainstormer.io lets you sign in with your Google account. This section explains exactly what Google user data we access and how we handle it.

Data we access. With your consent, we request only the standard sign-in scopes (openid, email and profile). Through them we receive:

• Your name
• Your email address and whether Google has verified it
• Your profile picture
• Your unique Google account identifier

We do not request access to, and cannot read, your Gmail messages, Google Drive files, Google Calendar, Google Contacts, YouTube account or any other Google service data.

How we use it. We use Google user data only to:

• Create your Brainstormer account and sign you in securely.
• Show your name and profile picture inside the application.
• Send you service messages about your account and agents, such as sign-in, security and billing notices.
• Link an agent you built on our website to your account when the email addresses match.

How we share it. We do not sell, rent or trade Google user data. We do not transfer or disclose it to third parties for any purpose other than those listed above. It is processed only by the infrastructure providers that host our application and database, under contracts that require them to protect it, or disclosed where required by law.

How we store and protect it. Google user data is stored in our application database, transmitted only over encrypted HTTPS/TLS connections, and accessible only to authorized personnel who need it to operate the Services.

Retention and deletion. We keep Google user data for as long as your account is active. You can delete your account at any time, or email [email protected] from the address on your account to ask us to delete it. We will then delete your Google user data within 30 days, except where we must keep it longer to meet a legal obligation. You can also revoke Brainstormer's access at any time from your Google account at https://myaccount.google.com/permissions.

Limited Use. Brainstormer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not:

• Use Google user data for advertising, including targeted, personalized or retargeted advertising.
• Sell Google user data, or transfer it to data brokers or information resellers.
• Use Google user data to determine creditworthiness or for lending purposes.
• Use Google user data to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.
• Allow humans to read Google user data, unless you give us permission, it is necessary for security purposes or to comply with the law, or the data has been aggregated and anonymized for internal operations.

We use the information described in section 1 to:

• Build, train, host and run the AI agents you create, and let visitors chat with them.
• Create and manage your account and authenticate you.
• Respond to your enquiries and provide customer support.
• Send you service messages and, where you have agreed or the law allows, product updates. You can unsubscribe from marketing emails at any time.
• Understand how the website is used so we can improve it.
• Detect and prevent fraud, abuse and security incidents.
• Comply with our legal obligations and enforce our terms.

Google user data is used only as described in section 2.

Where the GDPR or UK GDPR applies, we rely on:

• Contract: to provide the Services you signed up for.
• Consent: for example, when you sign in with Google or agree to marketing emails. You can withdraw consent at any time.
• Legitimate interests: to secure, analyze and improve the Services, where those interests are not overridden by your rights.
• Legal obligation: where processing is required by law.

Canada: we rely on your express or implied consent, or on the limited exceptions permitted by law.

We do not sell your personal information. We share it only in these cases:

• Service providers who process data on our behalf under contract: cloud hosting and database providers, AI model providers (see section 7), our customer relationship management system, email delivery, payment processing, and analytics (Google Analytics and Google Tag Manager).
• Agent owners: if you chat with an agent built by one of our customers, that customer can see the conversation.
• Legal requirements: when required by law, court order or a government request, or to protect the rights, property or safety of Brainstormer, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this Privacy Policy.

Yes. We use cookies, local storage and similar technologies to:

• Keep the website and application working and remember your preferences.
• Measure traffic and how visitors use the website, using Google Analytics and Google Tag Manager.

You can block or delete cookies in your browser settings, and opt out of Google Analytics using the tools below:

• https://tools.google.com/dlpage/gaoptout
• https://adssettings.google.com

Brainstormer is an AI agent platform. To build agents and generate their replies, we send the relevant content (agent training material and conversation messages) to third-party AI model providers, such as OpenAI, Anthropic and Google, through their business APIs. These providers process the data only to return results to us and, under their API terms, do not use it to train their models.

We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine learning models, and we do not send Google user data to AI model providers.

We protect your information with technical and organizational measures, including:

• Encryption of all data in transit using HTTPS/TLS.
• Passwords stored only as salted hashes.
• API keys and credentials kept on our servers and never exposed to the browser.
• Access to production systems and personal data limited to authorized personnel.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by law.

• Account data, including Google user data: kept while your account is active and deleted within 30 days after you delete your account or ask us to delete it.
• Agents, agent content and conversations: kept while the agent exists and deleted with the agent or your account.
• Demo agents built on our website that are never claimed: deleted within 90 days.
• Enquiries and lead information: kept for up to 24 months after our last contact with you, unless you ask us to delete them sooner.
• Browser local storage: cleared automatically after 7 days, or whenever you clear your browser data.

When a retention period ends, we delete the data or anonymize it so that it can no longer identify you. Where the law requires us to keep certain records longer, such as billing records, we keep only what is required and only for as long as required.

To request deletion, email [email protected] from the address associated with your data.

Depending on where you live (for example the EEA, UK, Switzerland, Canada or certain U.S. states), you may have the right to:

• Access, or get a copy of, the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your information.
• Restrict or object to our processing.
• Receive your information in a portable format.
• Withdraw consent at any time, without affecting processing that happened before.
• Complain to your local data protection authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days and may need to verify your identity first.

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

We and our service providers may process your information in the United States, India and other countries. Where the law requires it, we use appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

There is no agreed standard for browser Do-Not-Track signals, so we do not currently respond to them. If such a standard is adopted, we will update this Privacy Policy.

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia may have the right to:

• Know what personal information we collect, use and disclose.
• Access, correct or delete their personal information.
• Get a copy of their personal information.
• Appeal our decision on a privacy request.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use Google user data for targeted advertising, marketing or profiling. We will not discriminate against you for exercising your rights.

To make a request, email [email protected].

We may update this Privacy Policy from time to time and will change the "Last updated" date at the top of this page. If we make a material change, including any change to how we use Google user data, we will notify you by email or in the application before the change takes effect and, where required, ask for your consent again.

BRAINSTORMER INNOVATIONS INC

8 The Green

Dover, DE 19901

United States

[email protected]