Privacy Policy

1. Data Controller & Overview

This Privacy Policy explains how BusinessBrain ("we", "us", or "our") collects, processes, stores, and protects personal data when you interact with our website, application platform, and services.

For personal data processed when managing user accounts and billing relationships, BusinessBrain acts as the Data Controller. For Customer Data stored within individual organization workspaces (such as internal company documents, meeting summaries, and team task graphs), your organization acts as the Data Controller, and BusinessBrain acts as the Data Processor under a Data Processing Agreement (DPA).

2. Categories of Data Collected

• Account & Identity Data: Full name, business email address, avatar URL, authentication provider metadata (Supabase Auth / GitHub OAuth).
• Billing & Invoicing Data: Payment transaction identifiers, billing addresses, country, and VAT/tax ID. Credit card numbers are handled directly by certified Level 1 PCI-DSS payment gateways (Stripe) and are never stored on our servers.
• Organizational & Workspace Data: Workspace configuration, role memberships, uploaded documentation, integration metadata, and team activity logs.
• Technical & Telemetry Data: IP addresses, browser user-agent, session tokens, audit logs, and diagnostic performance metrics.

3. Legal Bases for Processing (GDPR Art. 6)

• Contract Performance (Art. 6(1)(b)): Providing core workspace functionality, authentication, team collaboration, and subscription management.
• Legal Obligation (Art. 6(1)(c)): Preserving statutory accounting records, invoices, and transaction audit trails pursuant to Portuguese and European fiscal directives (CIVA / Art. 123.º CIRC) and international tax regulations.
• Legitimate Interests (Art. 6(1)(f)): Platform security, preventing brute-force attacks, multi-tenant isolation enforcement, and infrastructure abuse detection.
• Explicit Consent (Art. 6(1)(a)): Optional marketing communications and analytical cookies, revocable at any time. Marketing consent is never pre-selected.

4. Subprocessors & International Transfers

We partner with trusted enterprise infrastructure providers to host and secure the Service:

5. Data Subject Rights (GDPR & Global Privacy)

Under the General Data Protection Regulation and global privacy frameworks (including CCPA/CPRA, LGPD), you have the right to:

• Access & Portability (Art. 15, 20): Export your personal data and full workspace data at any time via Workspace Settings in JSON format.
• Rectification (Art. 16): Correct inaccurate personal profile information directly in your profile settings.
• Erasure / Right to be Forgotten (Art. 17): Request deletion of your personal account. Personal identity attributes will be expunged, subject to statutory statutory retention mandates for fiscal/audit records.
• Restriction & Objection (Art. 18, 21): Object to processing based on legitimate interests or revoke marketing consent with 1 click.

6. Security Measures

BusinessBrain maintains defense-in-depth technical and organizational measures (TOMs), including PostgreSQL Row-Level Security, TLS 1.3 in-transit encryption, AES-256 at-rest encryption for sensitive secrets, rate limiting, and automated security scanning.