Legal
Privacy Policy
On this page
In short. HeyBrain connects to tools you already use, indexes what you point it at, and answers questions about it under access controls. Connected agents may also send visible messages and final responses as session history, depending on their version and settings. We process this information to provide the features you use.
We do not sell personal data, we do not use your content or data from connected sources to train any AI model, and we do not use it for advertising. You can request deletion using the contact details below.
This summary is a reading aid. The sections below are the operative text.
1. Who we are
HeyBrain (“HeyBrain”, “we”, “us”) is a governed memory and retrieval platform for teams and their AI agents. This policy explains what we do with personal data and with the content you connect to the service.
This policy covers the HeyBrain web application, its API, and the MCP endpoint that external AI agents connect to.
Controller and jurisdiction. HeyBrain is operated by Hey Brain Inc. Company address: 8 The Green, STE A, Dover, Delaware 19901, USA. Hey Brain Inc is the controller for personal data it collects directly through HeyBrain. Where HeyBrain processes content on behalf of a business customer, we act as a processor and that customer is the controller.
2. What we collect
Account data
Your email address, and a display name and organisation name if you provide one. We do not collect or store passwords for user accounts — sign-in uses a short-lived email link or supported Google sign-in. Google sign-in uses basic account identity; it does not require access to your mailbox. Authentication records use token hashes; a sign-in email necessarily contains the link and is processed by our email provider.
Content you connect or create
Documents, files, messages and other material you upload, author in the product, or import from a connected source; the text extracted from those files; and the entities and relationships derived from them to build your knowledge graph.
Connected agents and session history
Depending on the client version and enabled settings, an agent connector may send your current prompt to HeyBrain to retrieve context. It may separately send visible user messages and final assistant responses for storage as session history. Messages can include text you paste or information reproduced from documents. Deriving reusable knowledge later does not make the initial transmission facts-only. Automatic recall, session capture and explicit saves are separate paths. A pause or setting in one client does not necessarily control another path, device or client.
Context retrieved from HeyBrain is returned to the connected agent. The agent may send that context to its own model provider under the terms and settings of that separate service. Review the information a connector sends and its current controls before enabling it.
Connected source credentials
Access and refresh tokens for sources you connect. These are encrypted at rest and are never returned to the browser or to any connected agent.
Usage and audit records
Activity and audit records include account, access and request metadata; some records can include query text or other supplied metadata. Their retention is separate from the underlying content.
Billing data
Plan, subscription status, usage counts and limited payment-method metadata, such as card brand, last four digits and expiry. Our payment processor handles full card numbers and security codes; those are not stored by HeyBrain.
Technical data
IP address, browser and device information, and product analytics used to understand how the product is used and to diagnose faults.
3. Google user data
If you connect Google Drive, we request read-only access to import the documents you choose to bring into your brain. Available Gmail and Google Calendar connectors can similarly read selected messages or calendar information for the connected feature. Gmail and Calendar remain restricted to internal quality assurance while Google verification is in progress; this notice does not open public enrollment or expand the requested permissions. We use connected content to index, search and cite it back to you.
We request your Google email address and basic profile identifier solely to identify the connected account.
Limited Use disclosure. HeyBrain’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data to train generalised AI or machine learning models; we do not transfer it to others except as necessary to provide or improve the features you are using, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and no human reads it except with your explicit consent, to resolve a specific support issue you have raised, for security purposes, or where required by law.
You can disconnect Google Drive at any time from the connectors screen in your dashboard, which revokes our stored tokens. You can also revoke access directly at your Google account permissions page. Disconnecting stops further syncing. It does not by itself remove content already imported; you can delete items in the product and contact us to request further deletion.
4. How we use data
- To operate the service: sign you in, sync connected sources, index content and answer questions about it.
- To enforce access control, so each person and agent sees only what they are cleared to see.
- To maintain the audit record that lets you prove what was accessed.
- To bill you and to enforce plan limits.
- To diagnose faults, prevent abuse, and keep the service secure.
- To communicate with you about the service.
We do not sell personal data. We do not use your content or data from connected sources for advertising, and we do not use it to train AI models.
5. Legal bases
Where the UK GDPR or EU GDPR applies, we rely on:
- Contract — to provide the service you have signed up for.
- Legitimate interests — to secure the service, prevent abuse, and improve it, balanced against your rights.
- Consent — for optional communications or tracking where required. Authorising a connector grants technical access; it is not automatically consent as a legal basis for every use of the connected data.
- Legal obligation — for tax, accounting and lawful requests.
6. AI processing
HeyBrain may send questions, conversation text, document passages and supported media to AI providers for the features you use. Processing can include embeddings, indexing, extraction, classification, memory curation, retrieval selection, research and answer generation. Different operations can use different providers.
Choosing an answer model or supplying a provider key does not by itself change the providers used for background processing. A configured key may route supported answer requests to your provider account; other operations can still use platform-managed accounts. The provider table describes these purposes. Our no-training commitment continues to apply. No-training is different from no retention: provider-side copies and exceptions depend on the applicable service, account controls and agreements. We do not claim Zero Data Retention for the production service.
Only material you are permitted to see is included in retrieval. Do not assume sensitive information will be masked on every processing route. Our commitment not to use your content or data from connected sources to train any AI model continues to apply.
7. Sharing and subprocessors
The following providers process data for the features and services indicated, when those features are used or enabled:
| Provider | Purpose | Data involved |
|---|---|---|
| Amazon Web Services | Application hosting and database | All service data |
| Wasabi | Object storage for uploaded and imported files | File contents |
| Anthropic | Answer generation, summaries and supported classification fallback | Questions, conversation context and relevant authorized content |
| OpenAI | Embeddings, indexing, extraction, classification, curation, retrieval selection and supported model processing | Questions, conversation context, relevant document text and supported submitted media, as required by the feature |
| Your selected model provider or compatible endpoint | Supported answer processing through the configured provider connection | Questions, conversation context and authorized excerpts required for the request |
| Stripe | Payments and subscriptions | Billing details and payment data |
| Resend or the configured SMTP provider | Transactional email, including sign-in links | Email address and message content |
| Google Workspace | Hosted company correspondence, including support and privacy requests | Sender and recipient details, message content, attachments and email metadata when you correspond with us |
| Calendly | Demo scheduling, when you use our booking link | Booking and contact details you submit, and scheduling metadata |
| PostHog | Product analytics and diagnostics; current client recording disabled, historical recordings considered separately | Account or pseudonymous identifiers, allowed interaction events, attribution and technical metadata; historical replay or console data where collected |
| Cloudflare | Website hosting, security and performance | Requests and technical data |
| Google Analytics and Google Ads | Website analytics and advertising measurement, when enabled | Page visits, interaction events, identifiers and technical data |
| Meta | Website and advertising measurement through Meta Pixel, when enabled | Page visits, interaction events, identifiers and technical data |
| SendX | Contact management, lifecycle and marketing communications, automation and engagement measurement | Contact email, fixed audience or status tags, signup and onboarding status, connected-source counts or types, first-query date, plan and subscription status or dates, card-added status, and credit status, dates or amounts. Email open, click and technical metadata may also be collected where enabled. |
Website analytics and advertising measurement may use cookies, pixels and similar technologies. Google and Meta may process the resulting events under their own applicable terms. These tracking choices are separate from agreeing to the Terms of Service. Learn more about Google’s partner-site processing and Meta’s privacy policy.
SendX messages may use open pixels or redirected links. Email preferences and tracking choices are separate from accepting the Terms. Optional marketing and tracking require separate choices where applicable law requires them.
The SendX contact and activity records described here exclude payment-card numbers or security codes, document or conversation bodies, file names or raw cancellation explanations. A card-added event records the fact of attachment, not card details. Existing contact name or mailing-list information can also remain in SendX. Its website tools may collect page, device, IP or cookie information separately from these server events; the server event restrictions do not control that browser script.
Lifecycle delivery paths that check existing suppression flags respect those flags. An unsuppressed contact or signup is not evidence of affirmative marketing consent. Some source and credit activity updates do not independently check those flags, so unsubscribing from email does not stop every contact or activity update sent to SendX. Communication preferences, browser analytics choices and provider-side deletion are separate. Account closure does not automatically erase SendX contact, event or workflow history.
Where Resend is used, it stores customer message and delivery data in the United States. Its published retention terms describe 30 days for email and log data on Free, Pro and Scale plans and seven days for backups; termination of the Resend account has a separate period. These published terms do not verify deletion of an individual HeyBrain message. Expiry of a sign-in link or deletion of a HeyBrain account does not itself erase provider copies. Contact legal@heybrain.io for an individual-message or other deletion request.
The app can use a configured SMTP provider, so Resend is not necessarily the destination of every email. Third-party Google, Meta and SendX browser tags have separate collection and preference behavior; the app’s analytics controls are not proof that every vendor tag honors the same signal. Historical provider data and retention settings require separate handling.
Messages you send to our company addresses, including support and privacy requests, can be held in Google Workspace mailboxes. Hosted correspondence is separate from app transactional delivery, SendX preferences and deletion of a HeyBrain account.
If you book a demo through our Calendly link, the booking page processes the information you submit and scheduling metadata. Its privacy notice and controls are separate from HeyBrain analytics choices and account deletion. See Calendly’s privacy notice.
We may also disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition — in which case we will tell you before your data becomes subject to a different privacy policy.
Our current web client disables PostHog session recording. This is separate from ordinary analytics events. Provider project settings and older client versions or recordings can differ; disabling future recording does not establish deletion of historical recordings. Session replay, where it was enabled, can contain page interactions, displayed elements and diagnostic console information depending on the masking and capture settings. Input masking alone does not hide all displayed text or images.
Optional tracking choices are separate from accepting the Terms of Service. Use Privacy choices to disable optional Google Analytics and PostHog collection in this browser. When you are signed in, that page can also request an account analytics opt-out and shows whether the request was saved. A browser choice does not apply to every other browser or device. Already loaded third-party code may continue until you reload the page or open a new document. Essential account, security, billing and transactional-message processing, SendX server-side contact or activity processing, and historical provider records are separate. The linked notice explains these limits. Contact legal@heybrain.io for a privacy request, including one concerning historical analytics or recordings.
8. Storage and security
We use technical and organisational safeguards to protect the service, including server-side access controls. No system is perfectly secure. We provide incident notifications where required by law.
9. Retention
The linked Data Retention and Deletion Schedule distinguishes active content, derived records, recovery copies, operational logs, analytics, communications and required billing or security records. Periods are category-specific; there is no universal 14-day or 30-day deletion guarantee. Contact legal@heybrain.io for the status and scope of an individual request.
Read our Data Retention and Deletion Schedule for the current categories, configured periods, cleanup scope and limitations. Account closure does not by itself establish deletion of every derived, provider-held or recovery copy.
10. Your rights and deletion
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to it. To exercise any of these, contact us using the details below.
Deleting your data yourself
- Individual items — delete files and documents from the Library at any time.
- A connected source — disconnect it from the connectors screen, which revokes our stored credentials.
- Your whole account — request deletion from account settings. Supported personal-account cleanup removes the live account and data within its verified scope; shared ownership, ongoing processing, billing or provider failures can leave a request pending. Self-service deletion does not confirm erasure of every retained copy. You can contact legal@heybrain.io at any time, including while team membership or ownership is unresolved.
You may submit a request concerning your personal data at any time to legal@heybrain.io, including if self-service deletion fails or you belong to a workspace or organisation. Shared ownership or administration may need to be resolved without deleting unrelated members’ content; this does not prevent us from receiving your request. Account closure, removal from active systems and deletion or expiry of retained copies are separate stages. We will explain the verified scope and any applicable residual retention or exception rather than treating disappearance from a list as proof that every copy is erased.
Where the EU or UK GDPR applies, we respond to rights requests without undue delay and normally within one month of receipt. Where the applicable law permits an extension, we explain the extension and its reasons within the initial period. Mandatory rights and complaint routes remain available.
If you are in the UK or EEA you have the right to complain to your data protection authority.
11. International transfers
Our providers may process data outside your country, including in the United States. Transfers subject to UK or EEA data-protection law require an applicable transfer basis. Contact legal@heybrain.io for information about the safeguards applicable to your data and how to obtain them.
12. Children
HeyBrain is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes
Revision history: this 20 October 2026 clarification follows the 19 October 2026 published Privacy Policy. Existing versioned notices and acknowledgment records remain separate and are not rewritten by updating this page.
This update clarifies agent transmission, provider processing, analytics, communications, retention and deletion stages. It does not authorise new uses of previously collected data, remove earlier commitments or retrospectively change consent or agreement records.
We may update this policy. If a change materially affects how we handle your data we will tell you by email or in the product before it takes effect. The date at the top of this page always reflects the current version.
14. Contact
Questions, or to exercise any right above: legal@heybrain.io.