the Electronic Brain Privacy Policy

1.1. This Privacy Policy explains how Electronic Brain Inc. (“Electronic Brain”, “we”, “us”) collects, uses, shares and protects personal data when you use the Electronic Brain platform at https://app.electronicbrain.ai and related services (the “Product”). It forms part of, and should be read together with, the Electronic Brain Terms of Use (the “Terms”). Capitalized terms not defined here have the meanings given in the Terms.

1.2. For the personal data described in this Policy, Electronic Brain acts as data controller within the meaning of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the United States, as a “business” under the California Consumer Privacy Act as amended (the “CCPA”). You can contact us about this Policy or your personal data at [email protected].

1.3. Where your Inputs contain personal data of other people, you act as data controller for that data and Electronic Brain processes it on your behalf as a data processor, as described in Section 15.2 of the Terms.

2.1. We collect the following categories of personal data:

1. (i)Account data: your name, email address, password (stored only as a one-way hash), profile photo, email verification status and, if you enable it, two-factor authentication data (the authenticator secret is stored encrypted and recovery codes are stored as hashes).
2. (ii)Sign in with Google: if you choose to sign in with Google, we receive your Google account identifier, name, email address, whether Google has verified that address, and your profile picture. We do not receive your Google password.
3. (iii)Workspace data: the workspaces and teams you create or join, their names and logos, your role, and the email addresses of people you invite.
4. (iv)Content: the messages, prompts, files and attachments you submit, the knowledge files and web addresses you add for indexing, the tasks, agents, skills, tools and schedules you configure, and the Outputs the Product produces. Credentials you enter for tools are stored encrypted.
5. (v)Memories: short facts the Product picks up from your conversations so that it can carry useful context into new ones. You can view and delete them at any time in your account settings.
6. (vi)Connected service data: if you connect a Third-Party Service (for example Google Workspace, Slack, Notion, GitHub, Linear, Airtable or Canva), the data the Product reads from or writes to that service while carrying out your requests.
7. (vii)Usage and billing data: the number of requests and the amount of AI processing each workspace uses, plan and subscription details and, once paid plans are offered, billing records. Payment card details are handled by our payment processor and are never stored by Electronic Brain.
8. (viii)Technical data: IP address, browser and device information, request timestamps and error records generated when you use the Product, and, if you turn on notifications, the push subscription your browser provides.
9. (ix)Communications: the emails you send us and the transactional emails we send you (such as verification, password reset and invitation emails).

2.2. We collect this data directly from you, automatically when you use the Product, from Google when you use Sign in with Google, from Third-Party Services you choose to connect, and from members of your workspace who invite you.

3.1. We use personal data to:

1. (i)create and operate your Account and workspaces, authenticate you and keep your Account secure;
2. (ii)provide the Services, including processing your Inputs, running agents and tasks, indexing knowledge, and performing the Actions you direct in connected Third-Party Services;
3. (iii)send transactional emails and, if you enable them, push notifications about your work;
4. (iv)measure usage, apply plan limits and, where applicable, bill for the Services;
5. (v)detect, prevent and investigate abuse, security incidents and violations of the Terms, and troubleshoot errors;
6. (vi)comply with our legal obligations and respond to lawful requests from authorities; and
7. (vii)improve the operation of the Services using anonymized and aggregated statistics, as described in Section 8.7 of the Terms.

3.2. Under Article 5 of KVKK, we rely on the following legal bases: the processing is necessary for the establishment and performance of the contract formed by the Terms; it is necessary for compliance with our legal obligations; it is necessary for the establishment, exercise or protection of a right; and it is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms. Where the law requires your explicit consent, we ask for it before processing.

3.3. We do not sell your personal data, we do not use it for targeted advertising, and we do not use your Content to train our own AI models or products.

4.1. To generate Outputs and carry out tasks, the Product sends the relevant Content — such as your messages, the files and knowledge you make available to a conversation or task, and memories relevant to it — to the AI service providers we use. These providers process the Content on our behalf to provide the Services.

4.2. A workspace administrator may configure additional AI model providers for that workspace; in that case, Content of that workspace is sent to the provider the administrator selected.

4.3. Outputs are generated automatically and may be inaccurate. You should review them before relying on them, as described in the Terms.

5.1. Electronic Brain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5.2. We use Google user data only to provide and improve user-facing features of the Product that you request: to sign you in with Google and, if you connect Google Workspace services, to read or act on that data as you direct. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and we do not allow humans to read it except with your affirmative agreement, where necessary for security purposes or to comply with applicable law.

5.3. Authorization for connected services is handled through an integration provider that stores the access tokens those services issue. So that agents can act on your behalf, a token is also placed in an encrypted credential vault held for your Account by our AI service provider, and is removed from it when you disconnect the service. You can disconnect a service at any time from the Product, and you can also revoke access from the connected service’s own settings.

5.4. Slack. If you connect Slack, the Product reads Slack data with your own Slack permissions and only when an agent needs it to carry out your request: it searches and reads messages, channels, files and canvases you can already see, looks up the people in your Slack workspace, and sends messages when you ask it to. We do not keep a copy of your Slack workspace. Slack data an agent uses is sent to our AI service provider to produce the Output, and excerpts that appear in a conversation or task are stored as part of that Content under Section 8. We do not use Slack data to train AI models, we do not sell it, and we do not use it for advertising. If your organization registers its own Slack app for the Product, its credentials are held by our integration provider and are never shown again in the Product.

6.1. We share personal data only with the service providers that help us operate the Product, to the extent necessary for them to do so and under agreements that require them to protect it:

6.2. We may also disclose personal data to the Third-Party Services you choose to connect, as needed to carry out your requests; to members and administrators of a workspace you belong to, in line with the workspace’s settings and Section 4.4 of the Terms; to competent authorities where required by law; and to a successor entity in the event of a merger, acquisition or sale of assets, subject to this Policy.

7.1. Because our service providers operate outside Türkiye, including in the European Union and the United States, your personal data is transferred and processed outside Türkiye. We carry out these transfers in compliance with the conditions set out in Article 9 of KVKK, including by relying on appropriate safeguards such as standard contractual clauses or, where required, your explicit consent.

9.1. We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit, hashing of passwords and recovery codes, encryption of authenticator secrets and stored credentials, optional two-factor authentication, network restrictions on our servers, and access controls that limit who can reach production systems. No system is completely secure; if you believe your Account has been compromised, contact us immediately as described in Section 4.3 of the Terms.

10.1. The Product uses only technologies that are necessary for it to work: a cookie that keeps you signed in, and your browser’s local storage for your session and interface preferences. Cloudflare may set cookies needed to protect the Product against automated abuse. We do not use advertising cookies, and we do not use third-party analytics or tracking technologies.

11.1. Under Article 11 of KVKK, you have the right to: learn whether your personal data is processed; request information about that processing; learn the purpose of the processing and whether the data is used for that purpose; know the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction of the data under the conditions set out in Article 7 of KVKK; request that third parties to whom the data was transferred be notified of such correction or deletion; object to a result to your detriment arising from analysis exclusively through automated systems; and claim compensation for damages arising from unlawful processing.

11.2. Many of these rights can be exercised directly in the Product: you can update your profile; delete conversations, files, knowledge sources, memories, API keys and connected services; and delete your Account in your account settings, which also disconnects your connected services and removes the credentials agents held for them. To request a copy of your data, or to exercise any other right, email [email protected] from the address associated with your Account. We may need to verify your identity before acting on a request, and we respond within 30 days.

11.3. If you are not satisfied with our response, you may lodge a complaint with the Turkish Personal Data Protection Authority or with the data protection authority of your country of residence.

12.1. Notice at collection. In the preceding 12 months, and going forward, we collect the following categories of personal information, for the purposes described in Section 3, from the sources described in Section 2.2, and retain them as described in Section 8:

12.2. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. We do not knowingly sell or share the personal information of consumers under 16.

12.3. California residents have the right to know what personal information we collect, use and disclose; to access and obtain a copy of it; to correct inaccurate personal information; to delete it; and not to be discriminated against for exercising these rights. To exercise these rights, email [email protected]. You may use an authorized agent, in which case we may require proof of the agent’s authority and verify your identity directly. Residents of other states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia and Texas, may exercise the equivalent rights in the same way, and may appeal our decision by replying to it.

12.4. Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.

13.1. The Product is not directed to children under 13, and we do not knowingly collect personal data from them. If we learn that we have collected such data, we will delete it. Parents or guardians who believe this has happened may contact us at [email protected].

14.1. We may update this Policy from time to time. We will post the updated version on the Platform with a new date and, where the changes are material, notify you by email or through the Product before they take effect.

15.1. Questions, requests and complaints about this Policy or your personal data can be sent to Electronic Brain Inc. at [email protected].