Brain Scanner · legal

Privacy Notice

Version free-release-3

Registration and new terms acceptance: Open. Starts: 2026-10-15 21:27:00 UTC. Original cutoff: 2026-11-14 21:27:00 UTC. Current cutoff: 2026-11-14 21:27:00 UTC (exclusive). The terms remain in effect; no routine renewal is required. No uninterrupted availability or continuation is guaranteed. Existing privacy rights continue.

Brain Scanner Privacy Notice

Version free-release-3. Prepared 2026-10-17. This version applies only when selected for service and accepted where required.

This consolidated notice describes the existing service and separately identifies proposed retention and payment changes. Selecting this version does not rewrite prior accepted notices or obtain optional consent. The first-party cloud customer-insights system keeps its separate cdp-1-cloud choices. Optional Google Analytics, when configured, requires its own fresh google-public-1 choice in addition to first-party analytics permission. Neither accepting this notice nor an earlier analytics choice enables Google Analytics. Live paid purchases remain disabled.

This notice explains what personal data and project data Brain Scanner, operated by Kevin Lozada Santos ("Brain Scanner", "we", "us") collects when you use the hosted Brain Scanner Service at brainscanner.dev and its connector (the "Service"), why we collect it, how long we keep it, who can see it, and what choices you have. Read it with the applicable Terms of Service. This Notice explains our actual processing and does not itself obtain consent for an optional use. Where a legal basis is required, we use contractual necessity for processing objectively necessary to provide requested services; legitimate interests for proportionate security, abuse prevention, support and protection of legal rights where those interests are not overridden; applicable legal obligations where that basis is available; and consent for optional activities for which consent is required. We do not rely on the mere insertion of a purpose in the Terms to make that purpose necessary to a contract.

The local test-command comparison reads supplied package JSON and commands only in the browser, does not execute or upload them, and discards its in-memory inputs when closed.

1. Who is responsible

Kevin Lozada Santos determines the purposes and means of processing account, security, support and optional customer-insights information described here. Where we process personal information in customer project records solely on that customer's documented instructions, our role may instead be processor under applicable law. This Notice does not replace a processing agreement where one is required. Neither role is determined solely by the plan name or by describing information as metadata. Contact support@brainscanner.dev for privacy requests and questions.

2. The short version

• The hosted MCP service receives privacy-filtered Project Intelligence. When an agent changes code, its session completion submission also includes the actual code diffs, which are stored in the session and Change Review history. Graph mappings remain metadata-only. A separate, optional source-content channel can read, transmit, process, and persist complete supported project files after project-specific consent. It is disabled by default until the operator enables it with a dedicated encryption key. Secrets, raw logs, and repository credentials must not be submitted. Your Agent and local Brain Scanner tools may read source, inspect repositories, and execute supported local actions in your environment. Their access depends on the permissions of the Agent and local processes; the hosted connector grant neither grants nor removes that access.
• Reports and findings contain text you or your agent choose to submit. Successful project writes also generate retained Change Review entries with summaries and selected before-and-after values. Deleting an individual item does not erase its earlier history or recovery copies; see section 10.
• We collect the minimum account data needed to run the Service: your email address, a salted password hash if you establish a local password, an external identity binding if you choose a provider, your account status, and a record of the terms you accepted.
• We keep necessary security and operational records. The former account research measurement and accuracy prompts are retired; earlier preferences cannot enable new collection. Detailed schedules and recovery limits appear in section 10.
• Your data is hosted on Google Cloud in the United States.
• You can ask us to access, export, correct, or delete your data at any time.
• Optional first-party analytics and account-linked insights require separate current choices. Optional Google Analytics measures only selected public pages after a separate unchecked browser choice. Structured satisfaction responses are voluntary. Old research preferences enable none of these.

3. What we collect

Account and access data:

• Your email address, whether you have confirmed it, and a salted PBKDF2 hash if you establish a local password. Provider-created accounts can be passwordless. We never store the password itself. Self-service password setup or reset emails contain expiring, single-use links; consuming a link changes the password and invalidates previous sessions. The owner account is excluded from public reset. To confirm the address we email you a single-use link; if someone tries to sign up with an address that already has an account, we email that address a notice instead of telling the requester.
• Your account status, including any suspension or closure decision.
• Consent records: which version and content digest of the terms and this notice you accepted, and when.
• Session cookies and anti-forgery tokens needed to keep you logged in securely.
• If you choose Google, GitHub or ChatGPT sign-in: the provider name, issuer, registered client identifier, stable subject identifier and provider-confirmed email. These bind a provider identity to your Brain Scanner account for authentication. We do not retain provider ID, access or refresh tokens. An email match alone does not link an existing account: linking requires proof of its current password. GitHub sign-in uses identity-only permissions (read:user and user:email), its stable numeric account identifier, and a verified primary email; it requests no repository access. Provider sign-in grants no AI subscription or plan access.
• Connector authorization records: which agent clients you authorized, their scopes, when they were granted, and when they were revoked.

Security and operational data:

• The IP address and browser or client identification sent with each request, used for rate limiting, abuse prevention, and security audit.
• Sanitized audit metadata for each operation: the acting account, the project, the operation name, the time, the result, and opaque correlation identifiers. Audit records never contain request bodies or project content. Change Review is separate project-history storage and can contain the selected project fields described below.

Optional source-content ingestion:

• Local file discovery and preview happen inside the project root you approve. The preview shows the scope, exclusions, supported-file count and approximate byte size before transmission. Discovery, metadata collection, source upload, server-side parsing, and persistent storage are distinct steps. Signing in, accepting these terms, or connecting an Agent does not enable source upload.
• Before the first upload, you must explicitly accept the source-content notice for that project and scope. We record the source-content-v1 notice version, scope binding, and consent status. Approve only repositories whose contents you have permission to transmit and store, including permission from an employer, client, or other rights holder where needed.
• For included files, we receive the relative path, filename, language or file type, byte size, modification metadata where available, a deterministic SHA-256 content hash, and complete source bytes. Incremental sync transmits newly needed content and changes to file references; unchanged content is reused within the project. Snapshot references preserve supported historical states. File hashes and project identifiers are not public download credentials.
• The local scanner applies generated-folder, dependency-cache, binary, size, and secret exclusions, plus project ignore rules. Its default file-content limit is 1 MiB, configurable up to 5 MiB. Unsupported binaries and oversized files can be represented by metadata without their contents. Secret-like material can also occur in otherwise ordinary code; filtering is not a guarantee. Review the preview and exclusions, and do not upload credentials or regulated data.
• Server-side deterministic parsing derives symbols, classes, functions, imports, references and relationships where supported. Parsing can be incomplete; retained original bytes remain the source of truth. Ingestion does not generate embeddings or a model-context cache, and does not make requests to AI/model providers.
• Authenticated, authorized Agents may retrieve selected exact files, snapshots and derived models through the source channel. Retrieved code becomes tool output in the Agent's own environment and may be processed by its AI/model provider under that account's settings and terms. Request only relevant files; do not send unrelated repository contents to models. Brain Scanner does not train models with project contents or authorize third-party model training with them. Product use and source-ingestion consent are not model-training consent; any such use would require separate explicit agreement and supporting controls.
• You retain ownership of source code and project data. Brain Scanner receives only the limited rights needed to provide the requested service, as described in the agreement.
• Source payloads are encrypted with authenticated AES-GCM before persistent backend storage, using an operator-configured dedicated key; hosted transmission uses HTTPS. Project ownership is checked for uploads, file retrieval, snapshots, and derived data. Source is not placed in ordinary logs, analytics, crash reports, session replay, or Change Review history by this feature. Sanitized operation counts, identifiers, hashes, sizes and status metadata can be recorded instead. Secret-like source must not be copied into support messages or diagnostic output.

Disconnecting the source scanner stops future uploads and revokes its upload authorization. It does not itself delete the files you previously asked us to store or remove existing authorized retrieval access. You can delete stored source separately, delete the project, or ask us to erase personal information under applicable law. We do not treat disconnection as consent to a new purpose, or change the legal basis merely to avoid a valid withdrawal or erasure request. Any information that must remain is limited to an identified applicable obligation and restricted purpose.

Project data submitted by you or your agent, and generated history:

• Opaque project, node, edge, finding, session, and event identifiers.
• Graph structure: node and edge types, relationships, status values, counts, timestamps, digests, confidence, and provenance.
• Bounded labels and summaries, limited in length and character set and treated as untrusted assertions.
• Repository-relative file paths and, for every file-backed node, the absolute path of that file on the machine that mapped it. These paths are stored so that your browser can open the file locally; they may reveal a folder name or a username on your machine, so map projects from a location you are comfortable recording.
• Roadmap assessments, readiness calculations, change reviews, findings, queued tasks, chat handoffs, instructions, and activity assertions your agent records.
• The Git revision identifier your agent reports as the mapped revision.
• Authored reports and bug records: titles, summaries, report bodies, finding notes, severity, status, linked project items, and resolution evidence. A report body can contain up to 20,000 characters; a finding note can contain up to 2,000. These are project content, even though they are filtered and bounded. Do not include raw source, logs, credentials, or other prohibited data in them.
• Automatic Change Review history for successful writes to your registered projects: operation names, recorded times, project and record identifiers, agent session or execution references, versions, status, summaries, and selected prior and new field values. This includes report and finding text, task and session outcomes, and compact graph publication records with versions, digests, counts, and submitted change narratives.
• History previews shorten long text fields to 1,000 characters and long string lists to 100 items; shortened values include their original length and a digest. The full current report and some retry records can hold more than the preview. This limit is not a promise that only 1,000 characters are stored anywhere in the Service.
• Pending history writes and retry records can retain selected prior values or committed result copies to prevent duplicate writes and preserve the original change. An explicit existing-state backfill can add currently stored records and retained graph publications to history; it is labeled and does not reconstruct missing earlier versions.

Optional GitHub repository tracking:

• If you explicitly connect a selected personal GitHub App installation to an owned project, we store the installation and repository identifiers, repository name, selected branch, observed commit SHA and time, and up to 20 recently updated pull-request numbers, states, update times and generated GitHub links. We associate this with your Brain Scanner account and project. Organization installations are not supported by this version.
• GitHub requires read-only Contents permission to deliver push notifications. The permission can technically read source, but this tracking implementation calls metadata endpoints only: it does not download files, blobs or archives, clone repositories, or write to GitHub. It discards commit messages, pull-request titles and bodies, file paths, author details and the raw webhook body. Identity-only GitHub sign-in remains a separate permission.
• Signed events request a trusted metadata refresh; an unavailable provider leaves the connection pending or stale. A changed commit does not mean your map was rebuilt. Choosing Queue map refresh creates project-scoped work for your authorized local agent, subject to the existing local-access, mapping and credit controls.
• Active tracking history is bounded to the latest 50 entries within 90 days, filtered when read and pruned on later writes. Delivery identifiers and authenticated-body digests support replay prevention for seven days. Disconnect removes the current binding metadata and history; account and project deletion also remove them from active storage. A minimal generation/erasure control prevents late writes from recreating removed bindings. Historical storage copies remain subject to the recovery arrangements in section 10; disconnect is not a claim of immediate removal from every recovery copy.

Historical optional research is retired; retained records and prior obligations are addressed in section 10.

Open diagnostic tier:

• The public diagnostic workflow uses an opaque, short-lived guest identity and does not require an account. It receives only a closed, sanitized diagnostic projection. The workspace owner reviews the rendered report before the guest can see it.

Communications:

• Support requests and bug reports you send through the dashboard or by email, including the text you provide and the account associated with the request. Keep source code, credentials, and other sensitive material out of these messages.
• Optional email preferences, owner-maintained account cohort labels and follow-up notes, feedback status, and outbound message drafts, recipient addresses, sent message text, and delivery-attempt history. These records support product operation and responses to your requests.

Data excluded from project-mapping and diagnostic submissions:

• The dedicated `finish_agent_session.codeChanges` field accepts code diffs for work performed by your agent. These diffs follow session and Change Review retention; deleting a session alone does not erase its earlier Change Review entry. Complete supported files may also be submitted through the separately consented source-content channel described above. Outside those two dedicated channels, do not submit source code bodies, snippets, comments, diffs, patches, file contents, command output, logs, stack traces, environment values, secrets, credentials, tokens, keys, cookies, connection strings, or cloud-provider credentials through project mappings, reports, findings, other project records, or diagnostic payloads. This restriction does not describe the account and connector authentication data listed above. The connector schema rejects unknown fields and known prohibited data classes, and we exclude bounded text from general logs and analytics. Filtering reduces risk but cannot guarantee that free text you or your agent write is free of sensitive material, so please keep it out.
• We do not receive card details, PayPal passwords or passkeys. The released service remains free; the separate proposed payment processing below does not authorize live purchases or silently change previous notices.

Local processing and permissions:

• Local Brain Scanner tools and your Agent can read source files and Git changes, write local application state, open an editor, and run supported local programs such as selected tests. Your Agent may have broader capabilities that you separately authorize. Local processing is distinct from submitting information to the hosted service.
• A local process or the test code it runs may access files, environment values, credential helpers, and credentials available under its operating-system and Agent permissions. The hosted metadata restrictions are not a local sandbox and do not make those resources inaccessible. Configure local permissions for the work you intend to authorize.
• Your Agent or model provider may process information under its own settings and privacy terms. This notice describes Brain Scanner's hosted collection; it does not establish what another provider receives.
• Ordinary hosted MCP authorization does not enable source-content ingestion. The optional local scanner requires the separate project- and scope-bound source consent described above. Repository-provider integrations additionally require the relevant repository authorization; local file access is not evidence of permission to share third-party intellectual property.

Proposed payments and customer requests

This subsection describes the inactive paid-service proposal; it does not add a payment provider to existing users' accepted notices or authorize live purchases. If a reviewed paid agreement is activated and you choose to purchase, PayPal receives the chosen product, price, currency and opaque checkout identifier, plus information you provide directly to it for payment, fraud prevention and its other responsibilities. PayPal acts under its own privacy notice at https://www.paypal.com/us/legalhub/paypal/privacy-full. Its role and applicable transfer/disclosure requirements must be assessed for the relevant processing; not every activity is solely as our processor. We do not send project contents, source, optional measurement or advertising data to PayPal.

The proposed account wallet records an opaque account key; country, subdivision and consumer/business declaration; limited corroboration references and reviewer/timestamp information; product, accepted net/tax/total amount and currency; accepted documents and quote versions/digests/time; checkout, subscription, transaction, adjustment and webhook identifiers; paid periods, grants, consumption, balances and accounting timestamps. Buyer-evidence controls record bounded references rather than raw tax-ID documents, IP addresses or identity documents. Do not put sensitive documents or credentials into free-text request fields.

Withdrawal, refund, correction, deletion and other customer cases retain the selected request type, notice text, submission time, confirmation record, delivery status and reviewed decision or verified reconciliation references. A submitted notice is distinct from an approved or paid refund. These records support requested services, dispute handling and financial obligations where an applicable legal basis permits them. No new marketing, profiling or training purpose is introduced.

Optional customer insights and satisfaction

With your optional permission, we collect limited first-party information about how you use Brain Scanner: an enumerated page or feature, action and result, coarse timing category and general acquisition source. We use it to understand onboarding, feature use, returning use and website performance and improve the service. We do not collect project or source contents, typed text, screen recordings, full referring URLs, search queries or device fingerprints for this purpose. The information is pseudonymous, not anonymous while it can be linked to a browser or account.

A structured satisfaction rating is voluntary and has its own point-of-submit notice indicating whether it is linked. Sending it enables neither background analytics nor marketing. Unlinked rating receipts allow deletion of that specific response. Activity trends, descriptive recommendations and baseline forecasts support human review; they do not determine prices, access, eligibility or other significant outcomes automatically. Editable profitability scenarios express owner assumptions, not observed or validated predictions.

Password recovery uses a user-requested transactional email to a previously verified account address. Reset grants expire after 15 minutes, are stored only as keyed digests and are single-use; changing a password invalidates earlier sessions and account connections. A notification email confirms the change without including the password. Recovery email is separate from optional product messages.

Optional Google Analytics public-site measurement:

• When configured and separately permitted, Google Analytics helps us understand visits to the homepage, pricing, connector documentation and selected public guides, and clicks from these pages toward signup or from a guide toward the dashboard. These are public-site events, not evidence that an account signed up, an agent connected, a project was mapped or a user returned to useful work.
• We supply only allowlisted page categories, fixed public page addresses and titles, and enumerated click events. We exclude query strings, fragments, referring-page addresses, emails, account identifiers, project and repository identifiers or names, source content, typed text and authentication tokens. We do not send account-linking data or a Google Analytics user ID.
• Google receives browser and network information through the request, including the IP address, and can derive device and coarse location information under its documented Analytics processing. Analytics cookies contain pseudonymous browser identifiers; these are not anonymous data and do not prove a unique person. See Google's description of its processing at https://policies.google.com/technologies/partner-sites and its privacy policy at https://policies.google.com/privacy.
• We do not load the Google tag on signup, login, verification, recovery, authentication callbacks, account, dashboard, project or owner pages. Advertising storage, advertising user data and personalization are denied. Google Signals and enhanced measurement are not enabled for this integration. We do not use automatic form capture, identity stitching or advertising links.

4. Where the data comes from

• From you, when you sign up, log in, accept terms, adjust settings, or send us messages.
• From your dashboard submissions and automatically from successful project changes, to maintain the history described above.
• From the agent you run on your own machine, when it maps or updates a project through the connector. Your agent obtains its access to your repository from your own machine and accounts, not from us.
• Automatically from your browser and client, in the form of cookies, request headers, and IP addresses.
• Google Search Console supplies aggregate first-party page/date search metrics through the authorized read-only connection. We do not import search queries or visitor identities, and page and property dimensions remain separate.

5. Why we use it and our legal bases

• To provide the Service you requested, including authentication, storing and displaying your project maps and authored reports, ingesting and retrieving source and derived models when separately enabled and consented, coordinating queued tasks, maintaining change history, and safely replaying interrupted writes. Legal basis where required: performance of the agreement.
• To keep the Service secure, prevent abuse, enforce capacity limits, and investigate incidents. Legal basis: our legitimate interest in protecting the Service and its participants.
• Optional customer insights and Google Analytics use consent for their separately described analytics purposes; account linking remains a distinct first-party choice. Necessary account and financial reporting does not authorize optional browsing history collection.
• To handle support and bug reports you deliberately send, and record basic account onboarding milestones so we can support your account. Legal basis: our legitimate interest in resolving reported problems and operating the Service. These operational records are separate from optional product measurement; you may object to processing based on legitimate interests. Optional follow-up email still requires the separate email preference.
• To communicate with you about your access, security issues, and changes to the Service. Legal basis: performance of the agreement and legitimate interest.
• To send optional product announcements and follow-up emails only when you opt in. Legal basis where required: your consent. You can withdraw through Account email preferences or the unsubscribe link in each optional email. Verification, recovery, security, and account-onboarding messages are separate.
• To comply with applicable legal obligations (legal obligation where recognised under the applicable data-protection law), and to establish, exercise, or defend legal claims (our legitimate interest in protecting legal rights).
• We do not use third-party advertising or behavioral advertising profiles, sell your data, share it with data brokers, or use it to train machine-learning models. Optional emails may describe and promote Brain Scanner features, subject to your choice above.
• We do not make decisions about you by solely automated means that have legal or similarly significant effects. Signup is subject to email verification, capacity, abuse-prevention checks, and the current admission settings; suspensions and closures are decided by a person.

Account-linked insights are a separate optional choice. If enabled, future permitted product events may be associated with your signed-in account and relevant account or transaction status to understand adoption, retention and service performance. We do not identify an anonymous visitor using email, IP address or fingerprint, and do not backfill events collected before this choice. Refusal does not restrict normal use. Marketing emails remain separate. Necessary account, service, support and payment records support operational and financial reporting under their applicable original purposes; optional browsing histories are not relabelled necessary records.

6. Cookies and data stored in your browser

• Necessary first-party authentication cookies keep you signed in (bs_beta_session, up to 12 hours), protect forms (bs_beta_csrf, up to 1 hour), and complete provider sign-in you request (bs_website_signin, up to 10 minutes, cleared on completion or error). They are host-only and apply to path /. They are HttpOnly and Secure in production. The session and form cookies use SameSite=Strict; the temporary provider cookie uses SameSite=Lax so an external top-level callback can return. They are not used for advertising or product measurement. An optional diagnostic guest cookie (bs_diagnostic_guest, up to 72 hours) supports a diagnostic workflow you request.
• Choosing a provider redirects you to that provider, whose own cookies and privacy policy apply. We do not load provider scripts or contact it from your browser before you choose it. Provider sign-in tokens are not stored in local or session storage. Short-lived provider transaction state is stored server-side, expires after 10 minutes and is pruned on subsequent authentication writes.
• The dashboard keeps bounded project payload caches in page memory after current authorization/version checks. It clears the known old Brain Scanner IndexedDB payload store when loaded. Browser-local layout, accessibility, editor, checkout-folder and repository-link preferences remain; the guided helper keeps account-scoped progress locally. These preferences are separate from source files and server-stored maps.
• The retired journey and product-measurement scripts clear their own old temporary browser identifiers and markers when loaded. A cached client or saved preference cannot restart collection: the corresponding server ingestion is closed. Necessary authentication cookies and ordinary product caches are separate.
• Signing out ends the browser login, but does not reliably remove every stored cache or convenience setting in every sign-out flow. On a shared device, clear site data through your browser settings to remove local copies.
• You can clear all of this through your browser settings.

First-party analytics and account linking start only after a fresh cdp-1-cloud choice. We record the version, purpose choices and time. A random optional browser cookie is created only after analytics permission; a minimal nonunique off value can remember refusal. Separate temporary security tokens protect requests and do not provide analytic identity. Settings contains the Privacy controls, where you can decline, withdraw, export or delete first-party optional records. This feature honors Global Privacy Control by disabling both choices. Account switching does not transfer permission or access to another account's data.

The separate Google Analytics checkbox in signup and Settings is unchecked by default. Saving it records the google-public-1 choice, permission and time in this browser's local storage for up to 180 days; it does not create account-linked permission. Older first-party choices cannot enable it. Google requests start only on the listed public pages after both current permissions and no Global Privacy Control signal are confirmed. Unknown, expired, denied or unavailable choices leave Google collection off; earlier visits are not replayed. Google Analytics cookies used by this integration have the bsga_ prefix and a configured lifetime of up to 180 days without automatic expiry renewal. This cookie lifetime is separate from Google's retention of received records.

You can withdraw the Google choice through the same controls. Withdrawal stops new collection by this integration and removes its analytics cookies in this browser. Declining analytics or withdrawing optional data also disables the Google choice. Browser choice and cookie removal do not automatically erase historical Google-held records or change choices on other browsers; see sections 10 and 12. GPC disables Google collection here as well as first-party optional analytics. Losing browser storage requires a new choice.

7. Who can see your data

• The owner and operators of the Service, who need access to run it, respond to requests, and investigate security issues. Access is restricted to the operator and authorized operators who need it for those purposes.
• Service providers that host or support the Service, listed in section 8, under the terms applicable to their role. Hosting and email services process relevant data for us; independent identity providers and proposed payment providers also have responsibilities under their own notices. We may use competent service providers for disclosed functions and replace them subject to applicable notice, authorization and transfer obligations. A provider change does not authorize a new incompatible purpose or override an existing promise. We disclose only information needed for the relevant function or a legally justified request.
• Authorities, where disclosure is required by law or otherwise legally justified to protect rights, safety or the integrity of the Service. We provide notice when legally required and may notify you where appropriate without compromising a lawful investigation or security.
• A successor, if the Service or the business is transferred. This notice will continue to apply to your data until you are told otherwise.
• Your account and agents you authorize can access project data within their granted permissions. Change Review uses the same project ownership boundary; its retained entries do not make a project public. Projects are not shared between participants, and there is no public directory of participants.

8. Service providers and hosting

• Google Cloud Platform (Google LLC, United States): application hosting on Cloud Run, encrypted object storage for project intelligence, optionally ingested source and derived models, account records and separately controlled optional customer insights, scheduled expiry tasks, container image storage, and platform logging. Service data is stored in the configured us-central1 region (Iowa, United States); provider support and subprocessors may process data elsewhere under applicable contractual safeguards.
• Google Analytics (Google): only after the separate optional choice described above. Google receives public-site measurement and browser/network information, separately from the Google Cloud storage used for first-party customer insights. Processing may occur outside your country under the applicable provider terms and safeguards; the Iowa storage description for our CDP is not a location promise for Google Analytics.
• Spacemail, provided by Spaceship, Inc., handles account and support email. Its published terms describe security scanning, which may use an external AI moderation provider, and server recovery backups retained for up to four weeks. Avoid sending source content, credentials, or unnecessary sensitive information by email. Our messages do not use open-tracking pixels or advertising-tracking links.
• Google sign-in (Google), GitHub sign-in (GitHub, Inc.) and ChatGPT sign-in (OpenAI), only if configured and you choose that provider: exchange the authorization request, client identifier, callback and proof needed to authenticate; the provider supplies identity claims as described in section 3. The provider operates its own account and cookies under its own privacy policy. These identity flows do not request AI plan or repository access.
• GitHub (GitHub, Inc., United States): only if you choose to connect the optional GitHub App integration. The integration is read-only, limited to repositories you select, and can be removed from your GitHub account at any time.
• The AI agents you connect (for example Codex or Claude) are operated by you under your own accounts with those providers. When you authorize source retrieval, exact selected file contents are returned to those agents and may reach their providers. Their handling of your data is governed by their own terms and privacy notices, not by this notice. Ingestion itself makes no AI-provider requests.
• The current list is also maintained in the repository file SUBPROCESSORS.md. We must update this notice before adding a provider that processes personal data and obtain any authorization required for the change.

Customer-insights records are stored separately in Google Cloud Storage in Iowa, United States (us-central1). The selected CDP data configuration disables object versioning and soft-delete recovery and does not permit a retention policy or object hold that would prevent removal. The application does not create a separate historical backup of the optional data. These controls apply to this CDP store; they do not change the separately described recovery arrangements for project history, accounts or financial records. An operator-created external copy is not authorized by this retention arrangement and must not be introduced without a compatible deletion and recovery procedure.

9. International transfers

• The Service is hosted in the United States. If you use it from another country, your data is transferred to and processed in the United States.
• Acceptance of this notice does not waive mandatory privacy rights or independently authorize a transfer that requires separate legal safeguards.

10. How long we keep it

We may retain the minimum information reasonably necessary to establish, exercise or defend legal claims and comply with applicable recordkeeping obligations. Records subject to a documented hold are restricted to the relevant purpose and reviewed; a dispute does not justify retaining unrelated project content. We will explain any applicable refusal, restriction or extension of a rights request. Our actual technical retention and recovery-storage limitations are stated below.

• Active account, approval, consent, and account-linked owner follow-up and email records are retained during your participation and removed on account deletion. A deletion receipt retains its time, counts, accepted document versions and digests, and a digest derived from your email, rather than the email itself. This is pseudonymous, not anonymous. The current store keeps at most 500 receipts and has no automatic age-based purge. Recovery copies have the separate limits below.
• Project graph snapshots: the current version plus up to 10 previous versions, and never longer than 14 days for previous versions. Deleting a project or your account removes the active objects.
• Reports, findings, sessions, activity, tasks, assessments, validation assertions, and Change Review history: retained with the project unless removed through a supported deletion operation or privacy request. The current implementation does not automatically expire these records after 30 days.
• Change Review keeps earlier entries after an individual item is edited or deleted. Compact graph publication records remain after detailed graph snapshots expire. The journal currently accepts up to 10,000 entries per project and stops accepting additional entries at capacity instead of silently discarding old history. Deleting the whole project removes its active journal and project records; account deletion removes active project data. Recovery copies are subject to the separate limits below.
• Queue history: follows the project records it summarizes. Purging a terminal task removes that task from the queue history, but does not erase an earlier Change Review entry, linked finding, or recovery copy.
• Optional source-content channel: the current snapshot, its referenced blobs, and current derived model remain until you delete the source data or project. Up to 10 previous snapshots are available for no more than 14 days; expired history is not returned, and physical pruning of expired references and unreferenced blobs occurs on the next source operation or maintenance pass. A blob referenced by the current snapshot remains even if it was first uploaded more than 14 days ago. Files deleted from the current snapshot can remain in unexpired historical snapshots.
• Staged or failed source uploads never become current merely because a blob upload succeeded. Unreferenced staged blobs expire after 24 hours and are cleaned up on source access or maintenance. This is distinct from any existing temporary repository-source quarantine, which has its own 24-hour expiry; the opt-in source channel intentionally retains committed contents under the schedule above.
• Source deletion markers and status receipts have no automatic expiry. They retain opaque storage identifiers and deletion status to prevent delayed writes from recreating deleted data; they contain no source bodies, file paths, content hashes or parsed models. The opaque identifiers can remain linkable to a project or account and are not described as anonymous.
• Source deletion removes active encrypted blobs, snapshot references and parsed models. Whole-project deletion includes this source data alongside other project records. Disconnect alone preserves stored data. No embeddings or model-context cache are generated by this feature. Copies already delivered to your Agent are governed by that Agent's separate settings. Storage-provider object generations and backups remain subject to the recovery-storage limits below; logical expiry is not a promise of immediate permanent deletion from recovery storage.
• Operational application logs: configured retention is 30 days; source bodies are excluded. Security audit metadata has the separate period below.
• Generated exports: up to 24 hours.
• Open diagnostic jobs: 24 hours without a report; a report awaiting owner approval, 30 minutes; an approved report, 48 hours.
• Retired optional research records remain restricted to their original purposes and earlier cohort-specific deletion obligations. A later policy does not restart an already due deletion period. Unknown original dates require restricted operator assessment, not a fresh retention allowance.
• Prior-policy transition: the prior-policy transition cleanup was performed for the frozen existing-tester cohort before the public release on 15 October 2026. It removed the cohort’s pre-transition measurement records from active storage and replaced affected recovery generations with sanitized copies. Original generations entered the provider’s seven-day soft-delete period; that is not a claim of immediate permanent erasure. New users and excluded later records were not included. This version does not restart any prior deletion obligation.
• Security audit metadata: 90 days.
• General metadata replay records use a seven-day expiry and may contain committed result fields. Report and browser-finding retry records can contain complete committed report or finding values, including earlier versions; these records and pending history snapshots have no automatic time-based expiry in the current implementation and remain with the project. Removing an individual item does not remove these retry copies.

The existing project and account recovery store retains previous object generations. Those copies do not presently have an automatic age-based deletion rule, and deleting an active record does not by itself remove every older generation. We assess and remove recovery copies within the scope of erasure requests, restrict copies that must temporarily remain, and apply current deletion and consent decisions before restored data can be used. The optional customer-insights store is separate and follows its bounded recovery controls. A locally prepared retention change is not a claim that older production copies have already been deleted.

• Prohibited project data is not intentionally retained. Schema checks and filtering reject known prohibited inputs, but bounded free text may still contain sensitive material. If prohibited project data is discovered, we delete it as soon as we become aware.

• Proposed financial retention: the local implementation supports reviewed schedules for buyer, customer-case and financial records, with a specified purpose/basis, approval reference, event trigger and period. A schedule is not active merely because a category exists; records without a configured applicable schedule do not automatically expire. Financial expiry additionally requires account deletion and a reviewed treatment of later provider events. A filing or other external trigger must be recorded from verified evidence. No universal tax-retention period or indefinite retention authorization is established by this notice.
• A documented financial/case hold records its reason, responsible owner, reference and review time; an unresolved case can suspend relevant cleanup. Holds do not justify preserving unrelated projects. After confirmed account deletion, active nonfinancial quotes, project identifiers, publication bindings and detailed operation history are removed from the wallet; minimal financial, consent and reconciliation records can remain linkable through opaque identifiers until their justified schedule permits removal. Their status is pseudonymous, not anonymous. Payment-related account deletion requires subscription and pending-checkout reconciliation; unresolved confirmation must not be reported as successful deletion. Support/privacy requests and mandatory remedies remain available while that is resolved.

Optional customer-insights limits

Optional raw customer-insights events have a 30-day active-use limit. Daily derived activity and ratings have a 90-day limit, and minimal current choice and consent-evidence records have a 180-day limit. Expired records are excluded whenever data is read, and storage is pruned when it is read or changed and by daily scheduled maintenance. The scheduled cleanup can occur after a record's active-use deadline; these limits are not a claim of deletion at an exact second. A failed cleanup remains pending for retry and resolution, not reported as completed deletion. Capacity limits may stop collection, and coverage limitations are shown in the owner view.

Prospective administrative retention

These additional local rules require reviewed activation and do not assert that existing production records have already been purged. The local runners support abandoned unpaid buyer/evidence/quotes without order or open-case obligations, resolved nonfinancial privacy cases, and minimal deletion receipts after separately verified completed erasure. Other support records require their own reviewed category workflow; none of these local runners establishes that production cleanup is scheduled or complete.

We remove abandoned unpaid buyer details and quotes after 30 days from the last relevant unpaid activity or quote expiry, unless a specific unresolved request or obligation requires a restricted record. We retain minimal completed privacy-case request evidence and account-deletion receipts for 180 days after resolution or completed erasure to demonstrate and honor the action taken. These records are pseudonymous where linkable, not anonymous. An unresolved case or specific legal hold records its purpose, owner and next review, normally within 30 days; it does not justify retaining unrelated project contents. These periods are our operating limits, not a claim that every law prescribes those periods.

The proposed normal recovery-version window is 30 days after a generation becomes noncurrent, followed by any applicable provider soft-delete period and cleanup scheduling delay. This is an operating proposal, not a statutory period or a claim of a fixed maximum production retention time. Exact erasure inventories may require earlier removal. Required accepted account/consent/financial evidence must survive in appropriately restricted records; old shared snapshots are not a substitute for that recordkeeping. Active requested projects, financial records and minimal anti-resurrection controls are not subject to a blanket generation purge. Each unresolved hold or control has a responsible owner and a 30-day necessity-review target. Deletion fences must remain until their delayed-write and recovery horizon is safely bounded.

Google Analytics has a separate provider-side schedule. The selected property currently retains event-level data for two months and user-level data for fourteen months. Reset on new user activity is enabled for user-level retention, so new activity can extend that period. Those settings do not govern most standard reports based on aggregated data. They are not the 30-day raw-event or 90-day derived-record schedule for Brain Scanner's first-party CDP, and withdrawing browser consent does not automatically delete previously received Google records. We do not promise a fixed deletion date for aggregate reports. Cookie expiry is a browser limit, not a provider-record deletion deadline.

11. How we protect it

• Hosted connections use authenticated TLS. Stored project intelligence and account records are encrypted at rest. Optional source payloads are additionally encrypted before backend storage with a dedicated key; the source feature stays disabled without that configuration.
• Protected account and project operations are authorized from the authenticated account and server-side ownership records. Identifiers supplied in a request never grant access on their own.
• Read, write, export, and destructive-delete are separate permissions, and destructive operations require explicit consent through the connector.
• The connector accepts only known fields, rejects prohibited data classes, and applies size and rate limits.
• Passwords are stored as salted PBKDF2 hashes. Sessions expire and can be revoked.
• Audit logs contain metadata only, never project content.
• We test changes and maintain a deployment rollback path.
• No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you and any required authority without undue delay and within the timeframes the law requires.

12. Your rights and choices

Your statutory rights depend on the applicable law and processing context. We also provide the self-service controls described here. We may request proportionate information needed to establish identity or authority and may apply only legally permitted exceptions, extensions or charges, explaining the reason where required. A request need not use legal terminology. Optional consent can be withdrawn without withdrawing access to unrelated necessary services.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• receive your data in a portable format;
• restrict or object to certain processing, including processing based on legitimate interest;
• withdraw consent where processing is based on consent, without affecting processing that happened before;
• not be discriminated against for exercising your rights;
• complain to a supervisory authority, for example your national data protection authority in the EEA, the Information Commissioner's Office in the United Kingdom, or your state attorney general in the United States.

You can make an ordinary-language request through support or the available account/privacy controls. You need not cite a law, identify a backup system, or settle an unrelated payment dispute before we accept your request or stop optional processing. We respond without undue delay within the period applicable to your request, normally one calendar month where EU or UK GDPR applies. Any permitted extension, identity check or clarification adjustment is assessed under that law; we explain it as required and do not use it to delay unrelated action such as stopping optional collection. We explain any lawful refusal or restricted retention and applicable complaint rights. Writing from your account address helps verification but is not the only valid way to request help.

For the first-party customer-insights system, withdrawal stops future optional collection and account linking and removes the active optional records associated with the withdrawn choice. If durable deletion cannot finish, the request remains pending and is retried rather than described as complete. Required account and payment records have separate purposes and retention rules. Current consent and revocation controls are kept in a separate bucket excluded from optional-data recovery. Recovered optional data stays unavailable until current choice, deletion and expiry checks have been applied. Recovered data cannot override a newer refusal or deletion in the current controls. If trustworthy current control records are unavailable, optional collection and use remain off; fresh permission is required after a controlled recovery reset. Administrators must not roll back both the controls and optional data together.

The first-party export and deletion controls do not export or erase Google Analytics records. For requests concerning previously received Google Analytics data, contact support@brainscanner.dev so we can assess available identifiers, applicable rights and the provider's supported procedures. We do not imply that an account email identifies an unlinked Analytics browser or that all aggregate reports can be associated with a particular person. Withdrawal and future collection do not wait for resolution of a historical-record request.

We do not sell or share personal information as those terms are defined in California law, and we do not use or disclose sensitive personal information for purposes beyond those permitted by applicable law. Where California privacy law covers the relevant processing and grants you rights, those rights may include knowing, deleting or correcting personal information and limiting the use of sensitive personal information, subject to the conditions and exceptions in that law.

For UK data-protection complaints, contact support@brainscanner.dev so we can investigate, or contact the [Information Commissioner’s Office](https://ico.org.uk/make-a-complaint/). You can complain to the ICO without first obtaining our permission. You can object at any time to direct marketing; withdrawing optional email consent stops those messages. Withdrawal does not make earlier lawful processing unlawful.

You must provide an email address, account credentials and required verification information to create a hosted account. Project metadata is needed for a requested hosted map. Support messages and optional email consent are voluntary. Former research prompts are retired; current optional insights and satisfaction choices are separate. Declining optional processing does not change access eligibility.

13. Children

The Service is intended for adults aged 18 or older. If we learn that an under-18 account has been created, we close access and remove its information under the applicable law and retention procedure, keeping only records that have a specific justified restricted purpose. This eligibility rule is not a claim that we have verified every user's age.

14. Changes to this notice

We may update this Notice to reflect changes in the Service, law or processing. Material changes will be communicated as required. A changed Notice does not retroactively authorize use inconsistent with the notice under which data was collected. Before a new use requires consent or another legal safeguard, we will establish that requirement before the use begins. Accepting Terms or acknowledging a Notice is not consent to optional measurement, marketing or model training.

We preserve digest-addressed accepted versions. Publishing this version does not rewrite a previous record or establish acceptance. Retired research and current customer insights remain distinct. Previous processing and historical cleanup obligations are not reset by this version.

15. Contact

Privacy requests, questions and security reports: support@brainscanner.dev. Brain Scanner is operated by Kevin Lozada Santos, Florida, United States. Any geographic and other merchant disclosures required for an enabled paid offer must be supplied before that offer is accepted.

Canonical document (SHA-256 78d1a7c129d3…)