Privacy Policy

1. Introduction

We process personal data in accordance with applicable data-protection laws, including the Jordanian Personal Data Protection Law, the EU/UK General Data Protection Regulation (GDPR), the Brazilian General Data Protection Law (LGPD), and the California Consumer Privacy Act (CCPA/CPRA), where applicable.

2. Data Controller and Contact

You can reach us regarding privacy matters as follows:

• Controller: BRIGHT SOLUTIONS for Artificial Intelligence Establishment.
• Privacy contact: reach our privacy team via our Support page.
• EU/UK representative: where required under GDPR Article 27, we will appoint an EU/UK representative and publish their contact details here.

3. Information We Collect

We collect the following categories of personal data:

• Account & profile data: name, email address, phone number, password (stored in hashed form), language preference, and subscription plan.
• Payment data: billing information processed by Apple, Google, or HyperPay. We do not store full card numbers; payment processors handle this data under their own terms.
• User Content: the content you submit or generate through the Service, including chat messages, AI prompts, uploaded documents, generated images, voice recordings, meeting recordings and transcripts, and AI phone-call data.
• Usage & device data: device model, operating system, app version, unique identifiers, IP address, log data, feature usage, quota consumption, and crash diagnostics.
• Approximate location: derived from your IP address for security, fraud prevention, and regional compliance. We do not collect precise GPS location unless you explicitly enable it.
• Communications: messages you send to our support team and related correspondence.
• Third-party sign-in data: if you register using a third-party provider, we receive basic profile information permitted by that provider and your settings.

4. How We Use Your Information

We use personal data to:

• provide, operate, maintain, and secure the Service and its features;
• process transactions, manage subscriptions, and enforce the Fair Usage Policy;
• generate AI Outputs in response to your inputs;
• provide customer support and respond to your requests;
• detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms;
• comply with legal obligations and enforce our agreements;
• improve and develop the Service, subject to Section 6 (AI Processing); and
• send you service-related and, where permitted, marketing communications (you may opt out of marketing at any time).

5. Legal Bases for Processing (GDPR / LGPD)

Where applicable law requires a legal basis, we rely on:

• Performance of a contract: to provide the Service you request.
• Consent: for optional features, certain AI-improvement processing, marketing, and any sensitive data; you may withdraw consent at any time.
• Legitimate interests: to secure, improve, and protect the Service, balanced against your rights.
• Legal obligation: to comply with laws, regulations, and lawful requests.

6. AI Processing and Model Improvement

The following applies to how Brain processes your data through AI:

• How AI works: your inputs are processed by AI models (our own and/or third-party providers such as OpenAI/Gemini) to generate Outputs. Outputs are probabilistic and may be inaccurate.
• Training & improvement: we do not use your private User Content to train third-party foundation models without your consent. We may use de-identified and aggregated data to improve the Service; where required, we obtain your consent and offer an opt-out in the app's settings.
• Human review: a limited number of authorized personnel, or automated systems, may review content strictly for safety, abuse prevention, legal compliance, troubleshooting, and quality assurance, under confidentiality obligations.
• Automated decision-making: we do not use your personal data for automated decisions that produce legal or similarly significant effects on you without a lawful basis and, where required, human oversight.

7. Voice, Recordings, Transcription, and AI Calls

The following applies when you use Brain's voice, recording, transcription, and AI calling features:

• Voice & recordings: voice assistant audio, meeting recordings, and transcripts are processed to deliver the requested feature and are retained per Section 10 (Data Retention).
• Consent responsibility: you are responsible for obtaining the consent of all participants before recording or transcribing meetings, and for complying with call-recording and automated-calling laws when using AI phone calls.
• Telephony processing: AI phone calls are facilitated through providers such as Twilio and WebRTC, which process call metadata and audio to route and deliver calls.

8. How We Share Your Information

We do not sell your personal data. We share it only as described below:

• Service providers (sub-processors): we share data with vendors that help us operate the Service, including cloud hosting, AI model providers (e.g., OpenAI/Gemini), telephony (e.g., Twilio, WebRTC), analytics, and payment processors (Apple, Google, HyperPay). A current list is available on request via our Support page.
• App stores: Apple and Google process purchases and certain account interactions under their own privacy policies.
• Legal & safety: we may disclose data to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and security of users and the public.
• Business transfers: in a merger, acquisition, or asset sale, data may be transferred subject to this Policy.
• With your consent: for any other sharing you specifically authorize.

9. International Data Transfers

Because we and our providers operate globally, your personal data may be transferred to and processed in countries other than your own, which may have different data-protection laws. Where required, we implement appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms, to protect your data during such transfers.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Account data: retained while your account is active and for a reasonable period thereafter.
• User Content: retained according to your in-app settings and plan; you can delete eligible content within the app.
• Legal & security records: retained as required to meet legal, tax, accounting, or security obligations.
• Deletion: upon valid deletion request or account closure, we delete or anonymize your personal data, subject to legal retention requirements and routine backup cycles.

11. Data Security

We implement reasonable technical and organizational measures to protect personal data, including encryption in transit and at rest where appropriate, access controls, and monitoring. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

12. Your Rights and Choices

Subject to applicable law, you may have the following rights:

• Access & portability: obtain a copy of your personal data in a portable format.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction & objection: restrict or object to certain processing, including direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
• California (CCPA/CPRA) rights: know, delete, correct, and opt out of "sale" or "sharing" of personal information (we do not sell your data), and non-discrimination for exercising these rights.
• How to exercise: contact us via our Support page. We will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

13. Children's Privacy

The Service is strictly intended for individuals aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we discover that an account belongs to a minor, we will revoke access and permanently delete the associated data. If you believe a minor has provided us data, contact us via our Support page.

14. Cookies and Similar Technologies

On the Web App and within the mobile apps, we and our providers may use cookies, SDKs, and similar technologies for authentication, security, preferences, and analytics. You can manage certain preferences through your device or browser settings. Where required, we obtain consent for non-essential technologies.

15. Third-Party Services

The Service integrates with and links to third-party services (e.g., Google, Microsoft, WebRTC, Twilio, OpenAI/Gemini, HyperPay, Apple, Google Play). Their handling of your data is governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review those policies.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you through the app or by email and update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

17. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or our data practices, please reach out through our Support page and we will get back to you.