# Brain Scanner Terms of Service

Version free-release-3. Prepared 2026-10-18. This version applies only when selected for service and accepted where required.

Brain Scanner is operated by Kevin Lozada Santos, Florida, United States. These Terms govern the hosted service and connector when this version is lawfully accepted. Earlier accepted versions and accrued rights remain available in the policy archive. Viewing this document does not change your agreement or enable optional processing.

## 1. Definitions

- "Project Intelligence" means the structured, privacy-filtered project records you or your agent submit to the Service, together with the retained history generated from supported changes: opaque identifiers, node and edge structure, types, statuses, counts, digests, bounded labels and summaries, roadmap assessments, authored reports, finding notes and evidence, task and session records, selected before-and-after values, publication receipts, activity assertions, and the repository-relative and local file paths of mapped files.
- "Agent" means an AI coding assistant or repository tool (for example Codex, Claude, or a comparable tool) that you authorize to work in your environment and connect to the Service. "Local Tools" means Brain Scanner software running in that environment, including local mapping, change-review, editor, and test-execution functions.
- Code diffs submitted through the dedicated `finish_agent_session.codeChanges` field for authorized agent work are permitted and retained with the session and Change Review history. This exception does not permit secrets, credentials, or data you are not authorized to share.
- "Source Data" means complete supported project files, file metadata, versioned snapshot references, and parsed structural information submitted or generated through the optional, separately consented source-content channel.
- "Prohibited Data" means, outside that dedicated code-change submission and the separately consented source-content channel, source code bodies, snippets, comments, source-code diffs, patches, raw repository file contents, command output, logs, stack traces, environment values, secrets, credentials, tokens, keys, cookies, connection strings, provider credentials, deliberately submitted personal or machine identifiers, regulated data, export-controlled data, malware, and any data you are not authorized to share.
- Secrets, credentials, tokens, private keys, provider credentials, regulated or export-controlled data, and data you lack permission to share remain prohibited in either source submission channel. Exclusion controls reduce risk but do not guarantee detection.
- "Confidential Information" means non-public source code, infrastructure and security details, private project data, and other non-public information identified as confidential or that a reasonable person would understand to be confidential. Publicly available features, documentation, and your honest opinions about the Service are not Confidential Information.
- "Feedback" means suggestions, bug reports, corrections, ratings, and other comments you provide about the Service.

A ‘Business Customer’ is a customer acting wholly or mainly for purposes of its trade, business, craft or profession, subject to the classification required by applicable law. All other customers retain their applicable consumer status. An account selection does not conclusively determine that status. Provisions identified as applying only to Business Customers do not apply to consumers. Where mandatory law protects a small business or other customer against an exclusion or unfair term, that protection also takes precedence. Earlier expressly accepted agreements and accrued rights remain protected. No clause removes a right, remedy, liability or procedural protection that cannot lawfully be excluded or restricted.

Do not submit credentials, secrets or deliberately collected personal identifiers through project metadata. This restriction does not prohibit the account information needed to provide the Service or authorized file-path metadata described in the Privacy Notice. Paths can themselves contain personal information; minimize it before submission. Permission to submit a file or path does not establish that every person named in it has consented or that every legal requirement has been met.

## 2. Eligibility and authority

- You must be at least 18 years old and able to enter a binding contract.
- If you accept on behalf of a company or other organization, you represent that you are authorized to bind it, and "you" includes that organization.
- You may only connect projects and repositories that you own or that you are authorized to analyze and to share the specific metadata, code changes, and, if enabled, complete file contents you submit. If a repository belongs to your employer or a client, you are responsible for having their permission.
- Access is personal. Do not share your login, session, or connector credentials, and do not let anyone else use your account.

## 3. Accounts, scope and registration

Registration and new acceptance follow the dates and any expressly authorized extensions shown on the existing /terms page. That registration window is distinct from the duration of an accepted contract. This version establishes no new activation date or extension. Closing registration does not delete accounts, eliminate accrued rights, remove data-access or deletion controls, or end privacy duties.

Access is personal, non-transferable and limited to the requested Service under the applicable agreement. We may pause admissions or introduce waiting lists when capacity is reached. Changes to access and service limits remain subject to section 15, existing obligations and mandatory rights. You may stop using the Service and request account closure at any time.

## 4. What the Service does and does not do

- Hosted connector access. The hosted MCP connector reads and, where its authorization profile permits, changes account-scoped Project Intelligence. This includes supported project, graph, assessment, context, report, finding, activity, queue, and Change Review records. A connector grant is not a grant of access to your computer's filesystem, shell, repository-provider account, or cloud-provider account. Hosted action records can request local work; recording a request does not itself execute that work.
- Local access and execution. Your Agent and enabled Local Tools can read source files, inspect a repository and Git changes, write local Brain Scanner state, open files in an editor, and run supported local actions, including selected tests. An Agent may also edit files, run other commands, or perform repository and deployment operations when you separately authorize those capabilities. These actions run under the permissions, sandbox, configuration, and approvals of the Agent, local process, operating system, and relevant accounts. Hosted connector scopes do not limit permissions that an Agent or local process already has independently.
- Credentials and process access. Local actions can start programs in your environment. Those programs, including repository test code, may have access to files, environment variables, credential helpers, or credentials available to the process. The supported local-action list is not a guarantee that executed code is isolated from those resources. Do not submit repository or cloud-provider credentials as Project Intelligence. Brain Scanner account passwords, session credentials, and connector authorization data are handled separately as described in the Privacy Notice.
- Optional source ingestion. The dedicated source-content channel is disabled by default and requires operator enablement, a dedicated encryption key, and your explicit project- and scope-bound source-content consent before file contents are transmitted. The local scanner previews the approved root, exclusions, file count and approximate size. It reads supported files in that root, uploads incremental changes, and lets authorized agents retrieve exact stored files, retained snapshots and derived models. Source collection must not be inferred from sign-in or an ordinary connector grant. A repository-provider integration also requires the relevant repository authorization. Do not authorize upload solely because you can access an employer, client, or third-party repository locally.
- Automatic change history. Successful supported project writes create retained Change Review entries without a separate logging request. These entries include a summary, recorded time, identifiers, versions, and selected prior and new field values. Report and finding text may be included. Long values are explicitly marked as previews; retry storage may retain more of a committed record. Earlier entries remain when an individual item is edited or deleted, and compact publication records remain beyond detailed graph snapshot retention. Existing-state backfills are labeled. The Privacy Notice describes retention, project deletion, and recovery copies.
- What records establish. An activity, validation, or mapping record is an assertion supplied by its author or execution environment. A hosted record alone is not proof that Brain Scanner's hosted server read source, executed a command, or independently verified the result.
- File links and browser settings. Mapped file paths can be stored in Project Intelligence and used to open files through a locally configured editor or handler. A stored path is not, by itself, filesystem access. Editor choice, checkout-folder overrides, and repository-link preferences entered as browser-local convenience settings stay in that browser; this is separate from paths submitted in a project map.

## 5. Your responsibilities and acceptable use

You agree that you will:

- submit only permitted Project Intelligence, authorized code changes, and separately consented Source Data, and never Prohibited Data, and configure your Agent so that it respects the Service's privacy filters;
- use only Agents and Local Tools you are authorized to operate, on projects you are authorized to analyze, and review their local filesystem, command-execution, repository, and credential permissions;
- keep your account and connector credentials secret and tell us promptly and privately if you suspect they were compromised;
- keep your own backups of repositories and important records. Change Review is a history of selected Brain Scanner project data and publication receipts; it is not a full repository mirror or a complete historical source-file backup. Optional source snapshots include only supported, included files and have bounded history; they do not replace your repository backups;
- review and validate any output before you act on it.

You agree that you will not:

- access, probe, or attempt to access another user's account, project, or data;
- circumvent authentication, authorization, rate limits, quotas, capacity limits, or privacy filters;
- disrupt, overload, scan, or stress-test the Service, or introduce malware;
- misuse the Service's nonpublic implementation or confidential materials;
- disclose another person's private data or non-public Confidential Information without authorization;
- use the Service for anything unlawful, or to process personal data of other people beyond what the privacy filters allow;
- resell, sublicense, or provide the Service to third parties.

Restrictions do not prohibit conduct that applicable law or an applicable open-source license permits, independent development without misuse of our materials, or truthful reviews, comparisons, lawful disclosures and complaints.

## 6. Confidentiality

- Your obligations in this section apply to our Confidential Information and third-party confidential material received from us, not to your own repositories, source or private project data merely because they meet the definition. You will keep that received Confidential Information private, use it only to use the Service, and protect it at least as carefully as your own confidential information.
- You may share Confidential Information only with people in your organization who need it to use the Service and who are bound by obligations at least as protective as this section.
- Confidential Information does not include information that is or becomes public through no fault of yours, that you already lawfully had, or that you independently developed without using it.
- You may disclose Confidential Information if the law requires it, provided you give us reasonable advance notice where legally permitted.

We use your confidential Project Intelligence and Source Data only to provide, support and secure the Service you request, and to meet a specific applicable legal obligation. We do not use those contents for optional product analytics, advertising or model training. Disclosures remain subject to the Privacy Notice and applicable law.

The recipient's ordinary confidentiality duties continue for three years after access ends. Trade secrets remain protected for as long as they qualify for protection under applicable law. This clause does not make publicly available information confidential, restrict your own data, prohibit protected disclosures or expand our permitted uses of personal information.

## 7. Ownership and licenses

- You retain ownership of your source code, repositories, Project Intelligence, Source Data, and Confidential Information, subject to any existing third-party rights. Nothing in this agreement transfers intellectual-property ownership to us. You must obtain the rights necessary to submit third-party code; we acquire no greater rights than you can authorize.
- You grant us a limited, non-exclusive, worldwide license to receive, host, process, reproduce as technically necessary, display to you and your authorized agents, and back up your Project Intelligence and Source Data solely to provide and secure the requested Service for you and for the retention periods in the Privacy Notice.
- Source ingestion uses deterministic parsing, not model-provider requests. Source you explicitly retrieve through an AI Agent may be processed by that Agent's provider under your separate settings and terms. Brain Scanner does not use project contents to train its models or authorize third-party training. Product consent is not training consent; any training use would require separate explicit agreement and controls.
Except for the limited rights expressly granted, the operator and its licensors reserve all rights in the Service, software, interfaces, documentation, branding and improvements. You receive no ownership interest by using the Service. Separately licensed open-source components remain governed by their applicable licenses. We grant you a limited, non-exclusive, non-transferable license to use the Service in accordance with these Terms, subject to section 15.
Feedback is voluntary. For suggestions you deliberately provide about the Service, you grant us a nonexclusive, perpetual, irrevocable, worldwide, sublicensable, royalty-free license to use, reproduce, adapt and incorporate those suggestions without compensation or attribution. This license excludes your repositories, project contents, personal information and Confidential Information; it does not assign ownership of your review or prevent your own use or publication.

## 8. Service limitations and reliance

Unless expressly agreed otherwise, we do not undertake to provide a particular uptime, response or resolution time, roadmap feature, compatibility with a third-party product, or uninterrupted availability. Support is provided as resources permit. Public roadmaps, demonstrations, estimates and feedback discussions do not create an obligation to deliver a feature or result. These statements do not exclude a statutory obligation to exercise reasonable care and skill, supply conforming services or digital content, or provide a mandatory remedy.

Brain Scanner assists project understanding and coordination. It does not make your business, engineering, security, legal or financial decisions. You are responsible for reviewing outputs and deciding whether to authorize an action. An agent's permissions, tests and reported results are not an independent verification or approval by Brain Scanner. Maintain independent repository and important-record backups; the Service is not a complete backup or disaster-recovery service.

Maps, assessments, findings, change reviews and other outputs derive from submitted records, optional source and automated parsing or heuristics. They may be incomplete or wrong. Parsing failures do not make a derived model authoritative; retained bytes establish only what was stored. Data may be lost or corrupted. Keep independent copies of important records.

For Business Customers only, except for express obligations in an applicable agreement and non-excludable duties, the Service is provided AS IS and AS AVAILABLE. To the extent lawful, we disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement. This business-only provision does not exclude the consumer protections in section 9.

## 9. Liability and allocation of risk

### Business Customers

This paragraph applies only to Business Customers and only where the stated restriction is lawful and enforceable. We are not liable for indirect, special, incidental, consequential or exemplary loss, or for loss of profits, revenue, business opportunity, anticipated savings or goodwill. Subject to the exceptions below, our aggregate liability arising out of or relating to the Service or these Terms, across all related claims and legal theories, will not exceed the greater of USD 100 and any higher limit required by an earlier applicable agreement. Multiple claims do not increase that aggregate limit.

The exclusions and cap do not apply to our fraud, fraudulent misrepresentation, willful misconduct or gross negligence; death or personal injury caused by negligence where exclusion is prohibited; or any other liability that applicable law does not permit us to exclude or limit. They do not reduce any mandatory remedy or accrued right. An expressly accepted separate agreement may state a different limit.

### Consumers

If you are a consumer, the Business Customer exclusions, aggregate cap and indemnity do not apply to you. We remain responsible for loss for which applicable law makes us responsible, subject only to the separate United States contract cap below where enforceable. We do not accept responsibility for losses that applicable law allows us to exclude, including losses not reasonably foreseeable when the contract was made or losses caused by your own unlawful acts or failure to take reasonable steps to avoid or reduce loss. This does not exclude liability for our fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or any other non-excludable liability. Your applicable consumer and privacy remedies remain available.

United States consumers only: for ordinary breach-of-contract claims seeking economic damages arising from the affected Service, our aggregate liability will not exceed the greater of USD 100 and any higher limit required by an earlier applicable agreement. This cap does not apply to fraud, fraudulent misrepresentation, willful misconduct, gross negligence, death or personal injury, deliberate refusal to fulfill an accepted obligation, mandatory remedies, statutory consumer-protection or privacy claims and remedies, or any claim or liability that governing federal or state law prohibits us from limiting. If the law applicable to you makes this cap invalid or unenforceable, the cap does not apply; the applicable legal remedies govern. This United States cap does not apply to consumers outside the United States and does not displace mandatory protections or remedies otherwise applicable to them.

## 10. Business Customer indemnity

A Business Customer will defend and indemnify the operator and personnel acting for the operator against third-party claims and reasonable, documented damages, settlements and defense costs to the extent caused by the Business Customer's unlawful submission or use of data, infringement of another person's rights by material it submits, use of a repository or credentials without authority, or material breach of the acceptable-use or confidentiality provisions. This obligation does not cover a claim to the extent caused by our breach of these Terms, negligence, willful misconduct or unauthorized modification/use of the customer's material.

We will provide reasonably prompt notice; a delay reduces the obligation only to the extent it materially prejudices the defense. The Business Customer may control the defense with competent counsel reasonably acceptable to us. We may participate at our expense. A settlement must not admit fault on our behalf, impose nonmonetary obligations on us, or omit a full release of us without our prior written consent. We will provide reasonable cooperation at the customer's reasonable expense. This section does not apply to consumers or override mandatory protections for small-business contracts.

## 11. Privacy and data

- Our collection and use of personal data and Project Intelligence is described in the Privacy Notice presented with this agreement. The Privacy Notice is part of this agreement.
- Reading, writing, exporting, and destructively deleting Project Intelligence and Source Data are separate permissions in the Service and require your explicit authorization through the connector consent flow.

Closing a project or account starts the supported deletion process described in the Privacy Notice. Deleting an individual item may leave its earlier Change Review entry until the project is deleted or an applicable erasure request is fulfilled. We consider relevant recovery copies as part of a valid erasure request; you do not need to identify a storage system or submit a second request. We explain any specific lawful retention exception and any removal that remains pending. Ending a login or disconnecting an agent is not the same action as deleting a project or account.

Optional analytics, account-linked insights and satisfaction responses follow their separate choices and notices. Acceptance of these Terms does not enable them or authorize advertising, model training or significant automated account decisions.

Disconnecting the source scanner stops future uploads and revokes its upload authorization. It does not itself delete the files you previously asked us to store or remove existing authorized retrieval access. You can delete stored source separately, delete the project, or ask us to erase personal information under applicable law. We do not treat disconnection as consent to a new purpose, or change the legal basis merely to avoid a valid withdrawal or erasure request. Any information that must remain is limited to an identified applicable obligation and restricted purpose.

You can request access to, export of, correction of, or deletion of your information as described in the Privacy Notice.

## 12. Security and vulnerability reporting

- We apply the security measures described in the Privacy Notice. Online software carries security risks, and no system is perfectly secure. This does not waive our security obligations, responsibility for our own unlawful conduct, or your mandatory remedies.
- If you find a vulnerability, report it privately to support@brainscanner.dev. We ask you to allow a reasonable opportunity for coordinated remediation. Do not access data that is not yours or go beyond the minimum needed to demonstrate the issue. These requests do not restrict legally protected disclosures, reports to regulators or authorities, or rights that cannot be limited by contract. Good-faith research that follows these rules will not be treated as a breach of this agreement, and we will not pursue legal action for it.

## 13. Publicity

- Neither party may imply the other's endorsement or use the other's name, logo, private repository, or testimonial in advertising without written permission. This does not restrict honest reviews or other uses protected by law.
- Nothing in this agreement prohibits or penalizes an honest review, lawful assessment or comparison of the Service, or a report to a regulator or other authority. You do not need our permission to exercise those rights, including where an earlier version of our terms suggested otherwise. We will not enforce an earlier restriction on those rights. This does not authorize disclosure of another person's private data or trade secrets.
- We may say publicly that the Service exists and describe aggregate, anonymized usage that does not identify you or your projects.

## 14. Current free access

Brain Scanner currently provides free access, subject to the account, project, capacity and acceptable-use limits described in the Service. Current usage does not deduct the displayed free-credit allocation.

Free access does not promise uninterrupted availability, permanent access or unchanged features. Any change remains subject to sections 15 and 18 and your mandatory rights. Earlier accepted agreements and accrued rights remain effective to the extent applicable; this version does not remove them.

## 15. Term, suspension and termination

The applicable agreement starts upon lawful acceptance and continues until ended under its terms. This preview alone creates no acceptance.

We may impose proportionate limits, suspend affected functionality or terminate access when reasonably necessary to address a material breach, unauthorized access, security threat, unlawful use, or a legal requirement. We may act immediately where advance notice would increase the risk or is prohibited. Otherwise we will provide notice and a reasonable opportunity to address a remediable breach where appropriate.

We may discontinue free features or the free Service. For planned material changes or closure we will provide reasonable advance notice where practicable and preserve applicable export, deletion and privacy-request routes. The displayed 30-day registration window does not promise indefinite operation and does not expire an accepted contract, eliminate an accrued right. Changes or closure do not erase an existing obligation or accrued right.

On termination the license ends, subject to any surviving access, export or other obligation. We remove active project data under the Privacy Notice and address recovery copies as described there. Ownership, confidentiality, accrued obligations and remedies, lawful risk allocation, privacy duties and dispute provisions survive only to the extent appropriate to their purpose and applicable law.

## 16. Compliance and export

You must not use or receive the Service where doing so would violate applicable export-control or sanctions law, including prohibited dealings with restricted persons. We may restrict access or transactions where required by those laws. An exemption, license or authorization must actually apply before either party relies on it. You must not use the Service for an end use prohibited by applicable export-control law. These Terms do not themselves authorize an otherwise prohibited transaction.

## 17. Governing law and disputes

Florida law governs, except that a consumer retains mandatory protections of the law applicable to the consumer and any nonwaivable right to use a competent local court. Business Customers submit to the competent state or federal courts in Hillsborough County, Florida, subject to mandatory jurisdiction rules. Either party may seek urgent relief in a competent court. We invite written notice to support@brainscanner.dev to attempt an informal resolution; this does not prevent proceedings, regulator complaints, urgent relief, or action needed to meet a limitation period.

## 18. Prospective changes and consent records

We may propose revised Terms for future use. Revised text is identified by version and digest. We will provide notice and obtain acceptance where required before applying a change; publishing a revision does not rewrite prior consent, accrued rights or existing obligations. We may end or decline future service in accordance with the termination provisions instead of promising perpetual support for obsolete terms. Consent records are evidence of the version presented and accepted, subject to correction and any rights to challenge their accuracy.

## 19. General

If a provision is invalid, the remaining provisions continue only to the extent the agreement can lawfully operate without it. No severability provision authorizes us to apply an unlawful term or deprive you of mandatory rights.

These Terms, the relevant Privacy Notice and any expressly accepted separate agreement constitute the agreement for their subject matter. Neither party's delay in enforcing a right waives it. You may not assign your rights without our consent except where applicable law permits; we may transfer the Service to a successor subject to applicable notice, consumer and privacy protections. No partnership, agency or employment relationship is created. Notices may be sent to your account email; notices and complaints to us may be sent to support@brainscanner.dev.

Events beyond reasonable control may excuse a delay only to the extent the applicable law permits and the event actually prevents performance. This does not excuse mandatory remedies, legal duties or failure to take reasonable mitigation steps.

## 20. Mandatory consumer protections

The consumer protections in section 9 apply separately from the Business Customer cap, excluded losses and indemnity. Mandatory rights under the law applicable to you take priority, including any protections that apply to standard-form small-business contracts. Describing the Service as free does not eliminate rights that apply to it. A consumer may stop using the free Service and use account and privacy controls, or contact support. Statutory remedies remain subject to their applicable legal conditions. You may complain to a regulator or exercise a protected right without first obtaining permission or completing informal discussions.

## 21. Contact

Provider: Brain Scanner, operated by Kevin Lozada Santos, Florida, United States. Contact support@brainscanner.dev for legal, privacy, support and security matters. No private address or phone is published by these Terms.