Privacy Policy

Last updated: May 12, 2026

Braintunnel, LLC ("Braintunnel," "we," "us," or "our") operates the Braintunnel service. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website or use our service. This Privacy Policy applies to all users of the Braintunnel service, including residents of states with comprehensive data privacy laws.

Braintunnel is currently in invite-only private beta, limited to approximately 100 users while we validate and harden the system. For details on how we protect your data, see our Security page.

Please read this Privacy Policy carefully before using Braintunnel. If you do not agree with the practices described here, please do not use the service.

Categories of personal information we collect

We collect the following categories of personal information.

Information you provide directly

• Account information — when you sign in with Google, we receive basic profile information from Google, including your name and email address, to create and identify your account. This constitutes identifiers and personal records under applicable state privacy laws.
• Content you connect — if you connect email, calendar, Google Drive (read-only), or other data sources, we store that content to power search, the inbox, wiki, Hub and agent features, Drive/document indexing, and assistive features. Depending on the content of your connected sources, this may include identifiers, personal records, professional or employment-related information, communications content, and document content.
• Feedback — if you submit feedback through the product, our feedback tool makes best efforts to remove personally identifiable information before you review and approve submission.
• Communications — if you contact us at our support or privacy email addresses, we collect the information you provide in those communications.

Information collected automatically

• Operational telemetry — we collect non-personally-identifiable technical data (e.g., error rates, performance metrics, feature usage counts) via New Relic to keep the service reliable. This telemetry does not include the content of your emails, files, or personal information.
• Log and device data — we may automatically collect internet protocol (IP) addresses, browser type, operating system, referring URLs, and timestamps when you access the service. This constitutes internet or electronic network activity information under applicable state privacy laws.

Tracking technologies

Braintunnel does not use advertising cookies, tracking pixels, or similar technologies for interest-based advertising purposes. We use only those cookies and similar technologies that are strictly necessary for the operation of the service, such as session authentication. We do not engage in cross-site tracking.

Sensitive personal information

We do not intentionally collect sensitive personal information, such as Social Security numbers, financial account credentials, precise geolocation, racial or ethnic origin, health information, or biometric data. However, because you may connect email or other data sources that contain such information, sensitive personal information may be present in the content you connect. We process such content solely to provide the features you request and do not use sensitive personal information for any purpose other than providing and improving the Braintunnel service.

How we use your information

We use the information we collect for the following business and commercial purposes:

• Operate, maintain, and improve the Braintunnel service
• Authenticate your account and maintain your session
• Provide features you request, including search, chat, inbox, wiki, Hub, agent, and Drive/document indexing functionality
• Monitor service health, diagnose technical problems, and ensure security
• Respond to your support requests and communications
• Comply with legal obligations and enforce our terms of service
• Protect against fraud, abuse, and unauthorized access

We do not use your personal information for purposes materially different from those disclosed in this Privacy Policy without providing you with notice and, where required by law, obtaining your consent.

What we do not do

• We do not sell or share your personal information. We do not sell, rent, or trade your personal information or content to third parties. We do not "share" your personal information for cross-context behavioral advertising as those terms are defined under applicable state privacy laws, including the California Consumer Privacy Act.
• We do not access your content for our own purposes. Our team does not read your emails, files, or workspace content. Automated systems process your data only to operate the features you use.
• We do not build advertising profiles. We do not use your data to target ads, build profiles for advertising purposes, or engage in targeted advertising as defined under applicable state privacy laws.
• We do not engage in profiling that produces legal or similarly significant effects. We do not use automated decision-making or profiling in a manner that produces legal or similarly significant effects on you without human involvement.

Third-party services and disclosures

To operate Braintunnel, we disclose limited information to the following categories of service providers and processors:

• AI providers (e.g., Anthropic, OpenAI) — when you use chat or agent features, content relevant to your request may be sent to these providers to generate responses. These providers act as processors on our behalf and are contractually prohibited from using your data for their own purposes, including training their models on your data. See our Security page for details.
• Infrastructure and observability (e.g., New Relic) — we send non-PII operational metrics to monitor service health.
• Authentication (Google) — we use Google OAuth to sign you in and receive basic profile information; Google receives only what is necessary for authentication.
• Google API Services — Braintunnel's use and transfer to any other app of information received from Google APIs, including basic profile information, Gmail, Google Calendar, and read-only Google Drive data, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: (a) we only use Google user data to provide and improve the Braintunnel service features you request, including search, inbox, calendar context, Hub and agent features, and Drive/document indexing; (b) we do not transfer Google user data to third parties except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger, acquisition, or asset sale with adequate user notice; (c) we do not use Google user data for serving advertisements; and (d) human access to Google user data is limited to purposes permitted by the Limited Use requirements, including security purposes, to comply with applicable law, or with your affirmative consent.

We require all service providers and processors to protect data consistent with this Privacy Policy and applicable law through written data processing agreements. These providers are permitted to process your data only as necessary to perform services on our behalf and are prohibited from using your personal information for their own commercial purposes.

We do not disclose your personal information to third parties for their own direct marketing purposes.

Data processing locations. Our service providers, including AI providers and infrastructure providers, may process your data in the United States or other jurisdictions. By using the service, you acknowledge that your data may be processed in jurisdictions that may have different data protection standards than your jurisdiction of residence.

Data retention and deletion

We retain your personal information for as long as your account is active or as reasonably necessary to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention practices include:

• Account information — retained for the duration of your account and deleted upon account deletion, subject to the backup retention period described below.
• Connected content (email, calendar, Google Drive, and other data sources) — retained for the duration of your account and deleted upon account deletion or disconnection of the relevant data source.
• Operational telemetry and log data — retained in accordance with our infrastructure provider's standard retention schedule, currently no longer than 13 months.
• Backup data — some data may persist in encrypted backups for up to 30 days following deletion before being purged.

You can delete your account and data at any time through the self-serve option in the product. When you delete your account, we remove your content from our active systems within a commercially reasonable timeframe.

Backups

When we maintain backups of Braintunnel data, we do not back up email or calendar data. That information is already backed up and maintained by your email and calendar provider.

On our near-term roadmap, we plan to add secure backups for wiki files and other product-generated content (for example, chat history). We do not and will not include email contents or other raw document sources that come from connected integrations in those backup scopes — those materials stay with your providers.

Security

We use technical and organizational measures to protect your information, including encryption in transit (TLS), provider-managed encryption at rest, access controls, and regular security assessments. No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee the absolute security of your data. For more details, see our Security page.

Children's privacy

Braintunnel is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you are under 16, please do not use the service or provide any personal information. If we learn that we have collected personal information from a child under 16, we will take steps to delete such information promptly. If you believe we may have collected information from a child under 16, please contact us at privacy@braintunnel.io.

For purposes of the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under the age of 13, and we do not have actual knowledge that we sell or share personal information of consumers under the age of 16.

Your privacy rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable law, including the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and other state privacy laws. These rights may include:

• Right to know and access — you have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which personal information is collected, the business or commercial purposes for collecting your personal information, and the categories of third parties with whom we share your personal information.
• Right to correct — you have the right to request that we correct inaccurate personal information we maintain about you.
• Right to delete — you have the right to request that we delete the personal information we have collected from you, subject to certain exceptions permitted by law. You may also delete your account at any time through the self-serve option in the product.
• Right to data portability — you have the right to request a copy of your personal information in a portable, readily usable format.
• Right to opt out of sale, sharing, and targeted advertising — although we do not sell or share your personal information or engage in targeted advertising, you have the right to opt out of such activities. We honor the Global Privacy Control (GPC) and similar opt-out preference signals recognized under applicable law as valid opt-out requests.
• Right to limit use of sensitive personal information — to the extent we process sensitive personal information, you have the right to limit the use and disclosure of such information to what is necessary to provide the service.
• Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights. We will not deny you the service, charge you different prices, or provide you a different level or quality of the service for exercising your rights.
• Right to appeal — if we decline to take action on your request, you have the right to appeal that decision. You may submit an appeal by contacting us at privacy@braintunnel.io. We will respond to your appeal in accordance with applicable law.

How to exercise your rights. To submit a request to exercise any of the rights described above, please contact us at privacy@braintunnel.io. You may also exercise your right to deletion directly through the account deletion feature in the product.

Verification. When you submit a request, we will take reasonable steps to verify your identity before responding. We may ask you to verify your identity by confirming information associated with your account, such as your email address. If you submit a request through an authorized agent, we may require the authorized agent to provide proof of written authorization and may separately verify your identity.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. An authorized agent must provide written proof of authorization or a power of attorney. We may contact you directly to confirm the authorized agent's authority and verify your identity.

Response timing. We will respond to verifiable consumer requests within 45 days of receipt, or such other timeframe as required by applicable law. If we require additional time, we will inform you of the reason and extension period in writing.

Do Not Track and opt-out preference signals

Braintunnel honors the Global Privacy Control (GPC) signal and any similar universal opt-out mechanisms recognized under applicable state privacy laws. Because we do not engage in the sale of personal information, sharing of personal information for cross-context behavioral advertising, or targeted advertising, receipt of such signals will be acknowledged but will not change the processing activities described in this Privacy Policy.

We do not currently respond to browser-based Do Not Track signals, as there is no universally accepted standard for how to respond to such signals. However, we do not engage in the tracking practices that Do Not Track signals are designed to prevent.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where required by applicable law, we will provide you with additional notice, such as an in-product notification or an email to the address associated with your account. We encourage you to review this page periodically. Your continued use of the service after the updated Privacy Policy becomes effective constitutes your acknowledgment of the revised policy.

Contact us

If you have questions about this Privacy Policy, our privacy practices, or wish to exercise any of your privacy rights, contact us at:

Braintunnel, LLC
Email: privacy@braintunnel.io

If you are not satisfied with our response to your privacy request, you may have the right to lodge a complaint with your state attorney general or applicable regulatory authority.