Privacy Policy — Brain Bank

1. What Brain Bank does

Brain Bank is a personal memory vault. You store information about yourself — facts, preferences, work context, projects — and Brain Bank delivers it, when you ask, to the AI assistants you choose.

2. What data we store

Data you create: the content of the memories you save (title, text, folders, tags) and the skills you define.

Account data: your email address and login identifier, provided by the authentication provider you use to sign in.

Access logs: date, time and origin of every access to your account and your vault, including access made by connected AI assistants. These records are visible to you in the Activity tab.

API keys: the keys you generate to connect external assistants. The full key value is shown to you only once, at creation time. We do not store the key itself — only a cryptographic hash of it and a short prefix so you can identify it in the list.

3. What we do NOT do

• We do not read the content of your memories. Not for support, not for metrics, not out of curiosity.
• We do not use your memories to train artificial intelligence models.
• We do not sell or rent your data. We do not share it with third parties for advertising or any commercial purpose — only with the providers that operate the service on our behalf, described in Section 6.
• We do not show ads and we do not let advertisers access your content.

4. Who can access your memories

You. Through your authenticated account.

AI assistants you connect — and only within the limits described below.

Nobody else — except the technology providers that operate the service on our behalf, described in Section 6, and always under confidentiality. Each user reaches only their own data, and this is enforced at the database level, not just in the interface.

5. How AI assistant access works

When you connect an AI assistant (for example, via an API key or a connector), these rules apply:

Reading is restricted per folder. An external assistant must specify which folder it wants to read. Reading the whole vault at once is blocked. This applies to every form of external connection.

Writing always requires your approval. Anything an assistant tries to save goes into an approval queue. Nothing is written to your vault without your approval.

Password-protected folders are never exposed to external access.

Everything is logged. Every read and every write attempt is recorded in your Activity tab.

Revoke at any time. You can revoke an API key whenever you want, ending that assistant's access immediately.

6. Who we share data with to run the service

To work, Brain Bank relies on a few technology providers that process data on our behalf, solely to operate the service and under a confidentiality obligation. They are not allowed to use your data for any purpose of their own. They are:

• Infrastructure and database: Supabase — stores your memories and account data, with per-user isolation and encryption.
• Authentication: Google sign-in, brokered by Supabase Auth — manages your access to the account. You never hand us a password directly.
• Artificial intelligence providers: OpenAI and Google, accessed through Lovable's AI gateway — process text only when you use an AI feature (see Section 7). We do not share your data with any third party beyond these operational providers, and never for advertising or commercial purposes.

7. AI features and content transmission

Some Brain Bank features — such as the internal chat and automatic memory extraction from text — need to send the relevant content to a third-party language model provider in order to process your request at that moment. When that happens:

• The content is sent only to fulfill your request (for example, extracting memories from text you pasted, or replying in the chat).
• The transmission happens under those providers' API terms, which prohibit using your content to train their models.
• We do not send your memories for AI training, nor do we share them for any commercial purpose.
• Features that do not use AI (storing, editing, organizing and exporting memories) send nothing to those providers. If you never use the AI features, the content of your memories does not leave Brain Bank's infrastructure, except when you yourself hand it to an assistant you connected.

8. International data transfers

Some of the providers above may process data on servers located outside Brazil. In those cases, the transfer takes place with the safeguards required by the Brazilian General Data Protection Law (LGPD), and the provider remains obliged to protect your data to the same standard described in this policy.

9. Where the data lives

Your data is stored in a PostgreSQL database managed by the infrastructure hosting Brain Bank, encrypted at rest and in transit. Access is isolated per user at the database level. Automatic backups are kept for up to 7 days to allow recovery in case of failure. Those copies follow the same access protections.

10. Your rights

Export. You can export your memories at any time, in an open format, and take them wherever you want.

Correct. You can edit or delete any memory individually.

Delete everything. You can request deletion of your account and all of your data. After deletion, the data is removed and is not recoverable — not even by us.

Know. You can review every access to your vault in the Activity tab.

If you are in Brazil, these rights are set out in the General Data Protection Law (LGPD). To exercise them, get in touch at the address below.

11. Security

Among other measures, we apply: per-user data isolation at the database level; storing API keys only as hashes; authentication through an external provider (you never hand us a password); audit logging of access; and rate limits to prevent abuse.

No system is immune to failure. If a security incident affects your data, we will notify you and the competent authorities as required by law.

12. Minors

Brain Bank is not intended for people under 18, and we do not knowingly collect data from children or teenagers.

13. Changes to this policy

If this policy changes in a material way, we will let you know before the change takes effect. The date at the top shows the last update.

14. Contact

Questions, deletion requests or exercising your rights: jorge13en@gmail.com

Data controller: Jorge Moura