Privacy Policy

Effective date: 29 May 2026 Last updated: 29 May 2026

1. About this policy

This Privacy Policy explains how Dimitris Goudis Consulting Ltd (trading as 3Nuggets) collects, uses, shares, and protects personal data when you use Brain Graph (the "Service"), available at https://itsbraingraph.ai. It also explains your rights and how to exercise them.

In this policy, "we", "us", and "our" mean Dimitris Goudis Consulting Ltd. "You" and "your" mean the individual using the Service.

For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the personal data described in this policy.

This policy should be read together with our Cookie Policy and our Terms of Service.

2. Quick summary

• We collect what we need to run the Service: account information, billing data (handled by Stripe), and the documents, voice recordings, web pages and YouTube videos, and conversations you create inside Brain Graph.
• We do not run analytics, advertising, or behavioural-tracking scripts. We do not sell or share your personal data for advertising.
• We use third-party AI providers to power Brain Graph's features — including speech-to-text for voice notes and a metadata/transcript fetcher for YouTube URLs. We do not currently have no-training agreements with all of the AI providers. Section 7 explains exactly what is sent and where.
• We capture a small amount of non-PII operational telemetry (e.g. server-side logging of authentication failures, with caller IP and user-agent) for ~24 hours to keep the Service running. Section 3.4 explains what we do and do not log.
• You can delete your account and all of your data from inside the Service. The deletion is immediate.
• You have rights under the GDPR. We respond within 30 days. You can email us at support@itsbraingraph.ai.

3. Personal data we collect

3.1 Account data

When you create an account we collect:

• Email address
• Name
• Password (stored only as a bcrypt hash — see Section 12; we never store or log your plaintext password)
• Optional profile fields you choose to add: company, role, and short descriptions about your work and goals

3.2 Billing data

When you upgrade to a paid plan, payment is processed by Stripe. We do not see, store, or log your card details. Stripe shares with us a customer ID, your subscription status, and high-level billing metadata. Read Stripe's policy at https://stripe.com/privacy.

3.3 Content you upload and create

When you use Brain Graph you can upload, record, or link a wide range of content and have conversations about it. We store:

• The documents and transcripts you upload (plain text, Markdown, Word, PDF, PowerPoint slides, spreadsheets, plain-text emails, HTML);
• Voice recordings and audio files — either uploaded directly, recorded in-browser, or referenced by a public URL through our MCP connector (see Section 7.6 for the speech-to-text path);
• YouTube videos you submit by URL — we store the canonical URL, the metadata returned by the fetcher (title, channel, description, thumbnail, chapters), the auto-caption transcript, and the speaker proposals our resolver generates from it (see Section 7.7);
• Web pages you submit by URL — we store the canonical (post-redirect) URL, the extracted readable text, and a per-domain "publication" node so you can query everything from a given site;
• The knowledge graph that Brain Graph builds from all of the above (entities, relationships, summaries);
• Your conversation history with the Service;
• API keys you generate inside the Service.

Multiple brains. You can organise your content into separate brains (for example "Personal", "Work", "Learning"). Each brain is a logical namespace inside your own per-user graph; your brains are not co-mingled with anyone else's, and within your account a sub-brain only sees facts that belong to it unless you query across brains.

This content frequently contains personal data about other people (for example, names of meeting attendees, their roles, things they said, problems they raised, the voices captured on a recording). Section 8 explains how that interacts with your responsibilities and ours.

3.4 Operational telemetry

Brain Graph does not run analytics, advertising, behavioural-tracking, or session-replay scripts in your browser, and we do not store full HTTP request logs.

The application emits short operational messages to stdout containing the affected user ID and the outcome of the action (e.g. "account deletion succeeded"). These are kept in our hosting provider's rolling log buffer for approximately 24 hours and then discarded.

One narrow exception — client-failure telemetry. A small public endpoint (/api/client-events) is used to surface failures that happen in your browser (for example, an authentication token that expired while a phone tab was suspended) so we can fix them. When your browser calls this endpoint, the server records:

• a short, hard-coded event name (e.g. auth_recovered_on_401, auth_expired_logout);
• the path of the page you were on, an HTTP status code, and two booleans (whether a token was present, whether a refresh was attempted);
• your IP address and user-agent string, attached server-side.

The endpoint is rate-limited per IP (30 events/min), accepts no authentication header, and is restricted by code to the fields above. No request bodies, document content, prompts, tokens, or email addresses are sent or recorded. These events live in the same 24-hour rolling log buffer and are then discarded; we do not aggregate them into a long-term analytics store.

Our subprocessors (Supabase, Railway, Stripe, OpenRouter, AssemblyAI, ScrapeCreators, Resend, etc.) maintain their own operational logs for security, billing, and abuse-prevention purposes under their respective privacy policies.

3.5 Cookies and similar technologies

See the Cookie Policy for a full breakdown. In summary: no analytics, no advertising pixels, no behavioural tracking. Stripe sets fraud-prevention cookies on payment pages, and Supabase stores your authentication session in your browser's localStorage.

4. How we use your personal data

We use the personal data described above for the following purposes, on the following legal bases under Article 6 GDPR.

We do not use your content to train any of our own models. We run only health checks on the knowledge graphs we generate.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

5. How we share your personal data

We share personal data only with the subprocessors below, each of whom acts under contract and only to the extent necessary to provide the Service.

5.1 Infrastructure

5.2 Content-processing services

These services receive content you ask Brain Graph to process — an audio file you uploaded, or a URL you submitted. They are described separately from the infrastructure list because what they receive is your content (not metadata about your account).

5.3 AI providers

See Section 7 for a detailed disclosure of how AI processing works and what is sent to each provider.

5.4 Other recipients

We may also disclose personal data:

• To professional advisors (lawyers, accountants) under duties of confidentiality, where strictly necessary;
• To public authorities, courts, or regulators where we are legally required to do so;
• In connection with a sale, merger, or reorganisation of our business — in which case we will notify you in advance and your rights will be preserved.

We do not sell your personal data. We do not share it for cross-context behavioural advertising.

6. Marketing

We do not run a general newsletter and we do not send marketing emails to people simply because they signed up for Brain Graph. The only marketing we send is about our mastermind events, and only to people who explicitly opt in on the mastermind sign-up page. You can unsubscribe at any time using the link in any such email or by emailing support@itsbraingraph.ai.

7. AI processing — how Brain Graph uses third-party AI providers

This section is deliberately detailed because Brain Graph relies on AI providers to deliver its core features. Please read it carefully.

7.1 The pipeline

Your prompts and the document content needed to answer them are sent from Brain Graph through OpenRouter, Inc. (the routing gateway), which forwards them to one of the underlying model providers below depending on the task:

OpenRouter itself is a US company.

7.2 What is sent

For each AI request, Brain Graph sends:

• Your account identifier (your Supabase user UUID), included as the user field on every request — used by providers for abuse and rate-limit attribution.
• The system instructions Brain Graph uses to operate the model.
• The prompt content, which includes the parts of your documents and conversation needed to answer your request. Because that content is sent verbatim, it may include any personal data about you or about other people that you have placed into Brain Graph (for example, names, roles, and statements from a meeting transcript).

We do not send your email address or our internal document/transcript IDs to AI providers.

7.3 No-training agreements

We do not currently have a no-training or zero-data-retention agreement in place with the model providers reached through OpenRouter. This means that, by default, your prompts and the content sent with them may be retained, reviewed for safety, or used to improve those providers' services according to each provider's standard terms.

We are working to put no-training arrangements in place. Until we do, please do not upload to Brain Graph any content you would not be willing to share with the AI providers listed above — and do not upload personal data about other people unless you have a lawful basis to do so (see Section 8).

7.4 Prompt caching

To keep costs down and responses fast, Brain Graph uses ephemeral prompt caching on the static system instructions it sends to AI providers. The cache lives on the provider's edge for approximately five minutes and contains only Brain Graph's own instruction prompt — it does not cache your document content or your prompts.

7.5 No file persistence on the LLM pipeline

For the LLM pipeline described in Sections 7.1–7.4, Brain Graph does not upload your documents to any provider's persistent file storage (for example, OpenAI Files or Anthropic Files). Each LLM request is made with inline content; what each provider does with that content on their side is governed by their own terms (see Section 7.3).

The audio-transcription path is different by necessity — AssemblyAI's transcription worker must fetch the audio from a URL it can reach, so we either upload the bytes to AssemblyAI's /v2/upload endpoint or hand it a public URL you provided. Section 7.6 documents that flow in full.

7.6 Audio transcription (voice notes and recordings)

Brain Graph supports two audio-ingestion paths:

• Upload or in-browser recording. You drop a file or record a clip in the browser. The audio bytes are sent to our server, stored in our Supabase Storage bucket so the file can be replayed or re-transcribed, then forwarded to AssemblyAI for transcription.
• Public audio URL via our MCP connector (the upload_audio_url tool). You give us a URL pointing at a publicly-reachable audio file. The audio bytes do not pass through our server in this path — AssemblyAI fetches the URL directly. We still store the resulting transcript text against your account so it lands in your graph.

In both paths we use AssemblyAI, Inc. (United States) for speech-to-text transcription with speaker diarization turned on. Diarization splits a recording into per-speaker turns labelled internally as "Speaker A", "Speaker B"… which we then re-number as "Speaker 1", "Speaker 2"… before storing. Diarization separates speakers; it does not match them to a real-world identity, and we do not use AssemblyAI's voiceprint or speaker-identification features.

AssemblyAI is a separate processor with its own privacy terms — see https://www.assemblyai.com/legal/privacy-policy. The only things we send AssemblyAI are (a) the audio bytes or the audio URL you provided, (b) the model selection (universal-3-pro with universal-2 as fallback), (c) the language_detection and speaker_labels flags. We do not send your email address, account UUID, document IDs, or any free-form metadata about you.

Once AssemblyAI returns the diarized transcript, we feed it into the same downstream pipeline a pasted transcript uses (Sections 7.1–7.5).

Because audio recordings typically capture other people's voices, see Section 8 for your responsibilities under GDPR before uploading recordings of meetings, calls, or interviews.

7.7 YouTube videos

When you submit a YouTube URL to Brain Graph:

1. We send the URL to ScrapeCreators (United States), which returns the video's public metadata (title, channel, description, thumbnail, chapters) and any available auto-caption transcript.
2. If the auto-caption transcript lacks turn markers, we run a short LLM call through OpenRouter (Sections 7.1–7.3) to insert generic Speaker 1 / Speaker 2 / … labels — the model echoes the transcript back verbatim with labels; it does not identify or name the speakers.
3. The metadata, raw transcript, and our normalized transcript are stored against your account so the video does not need to be re-fetched on later visits.

We send ScrapeCreators only the YouTube URL and the language hint, with no information about you. The content the call returns is public material that YouTube already publishes; the personal-data risk lives in what those public videos themselves say about identifiable people. Section 8 applies.

8. Content you upload about other people

When you upload meeting transcripts, audio recordings, YouTube videos, web pages, or other documents to Brain Graph that contain personal data about people other than you, you are the data controller for that personal data, and we act as your data processor. You are responsible for:

• Having a valid lawful basis under the GDPR (or equivalent law) to upload and process that personal data through the Service;
• Telling those people about that processing where required (for example, in your meeting privacy notice);
• Honouring requests they make to you about their data.

Audio recordings — special care. Voice recordings of meetings, calls or interviews typically capture the voices of people other than you. The voice itself can constitute personal data, and in some jurisdictions recording a conversation without the consent of all participants is unlawful. Before uploading or recording audio that includes other people:

• Make sure you have a lawful basis to record them and to send their voice to a US speech-to-text provider (see Section 7.6);
• Comply with any local "all-party consent" laws that apply to you and to the people in the recording;
• We do not use the audio to train or build voiceprint / speaker-identification models; AssemblyAI's own use of the audio is governed by its policy.

YouTube videos. YouTube content is publicly available, but it can still contain personal data about identifiable speakers. Submitting a video to Brain Graph means we will store its metadata and transcript against your account and feed it through the AI pipeline in Section 7. Don't ingest a video just because it is public if doing so would breach a confidentiality obligation or a person's reasonable expectations.

We will help you respond to requests from third parties where it is reasonable to do so.

If you are using Brain Graph in a business context and need a Data Processing Addendum (DPA), we will sign one on request — email support@itsbraingraph.ai.

9. International transfers

Brain Graph is established in the European Union (Cyprus). When we use subprocessors located outside the European Economic Area, we put appropriate safeguards in place under Chapter V of the GDPR.

You can ask us for a copy of the relevant transfer mechanism by emailing support@itsbraingraph.ai.

10. How long we keep your personal data

10.1 Account and content

We keep your account information and the content you upload for as long as your account is active.

10.2 Deleting a single document

When you delete an individual document, transcript, voice recording, web page, or YouTube video inside Brain Graph, we immediately and permanently delete the corresponding rows from our Postgres database (including, where applicable, the YouTube metadata row, the canonical source URL, and the audio file stored in our object storage). There is no soft-delete and no recovery period.

The knowledge-graph entries that were derived from that document remain in the graph database until you trigger Clear Brain or delete your account. This is because the graph stores derived facts that are not tied one-to-one to individual source documents.

Subprocessor-side copies. Once we have sent content to a subprocessor (for example, audio bytes sent to AssemblyAI for transcription, or a YouTube URL sent to ScrapeCreators for fetching), the subprocessor's own copy is governed by its retention policy — not ours. Deleting the source from Brain Graph stops any further processing by us, but does not, on its own, trigger deletion on the subprocessor's side. See each subprocessor's privacy policy (linked in Section 5) for what they keep and for how long, and contact them directly if you need them to delete their copy.

10.3 Deleting your account

You can delete your account at any time from Settings → Danger Zone inside the Service. When you do, we hard-delete in the same request:

• Your knowledge graph (all of your brains);
• All uploaded documents, transcripts, voice recordings, YouTube source rows, and ingested web pages;
• Your conversations and analyses;
• Your profile, API keys, and any other account-scoped data;
• Your files in our object storage (including audio recordings);
• Your active Stripe subscription and customer record;
• Your identity in our authentication provider (Supabase Auth), so the email is no longer associated with the Service.

There is no grace period. There is no recovery.

10.4 Backups

For disaster-recovery purposes, our hosting and database providers retain encrypted backups for a limited period (currently up to seven days under our Supabase plan tier). Residual copies of deleted data may exist in those backups until the backup window rolls past, after which they are overwritten.

10.5 Operational logs

Application stdout messages are retained in our hosting provider's rolling buffer for approximately 24 hours and then discarded. We do not maintain our own access logs (see Section 3.4).

10.6 Records we are required to keep

We retain a minimal set of billing and tax records for as long as required by Cypriot tax and accounting law, even after you delete your account.

11. Your rights

If you are in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:

• Access — to know what personal data we hold about you and to receive a copy.
• Rectification — to correct inaccurate or incomplete personal data.
• Erasure — to have your personal data deleted ("the right to be forgotten"). For most data, you can do this yourself by deleting your account (Section 10.3).
• Restriction — to limit how we process your personal data in certain circumstances.
• Portability — to receive a machine-readable copy of personal data you have provided to us.
• Objection — to object to processing based on our legitimate interests.
• Withdraw consent — where we rely on your consent (for example, for mastermind marketing emails), you can withdraw it at any time.
• Lodge a complaint with a supervisory authority. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (https://www.dataprotection.gov.cy). You can also complain to the supervisory authority of the EU country where you live or work.

To exercise any right that is not already self-serve in the Service, email support@itsbraingraph.ai. We will respond within 30 days. We may need to verify your identity first.

12. Security

We protect personal data with the following measures:

• Encryption in transit. All connections between you and the Service are protected with TLS, and HSTS is enabled. Connections between our application and Railway's internal infrastructure are end-to-end encrypted with WireGuard.
• Encryption at rest. All customer data stored by Supabase and Railway is encrypted at rest with AES-256. Supabase additionally encrypts sensitive tokens and keys at the application level before they reach the database.
• Password handling. User passwords are hashed with bcrypt (cost factor 10) by our authentication provider, Supabase Auth. Plaintext passwords are never stored or logged. We do not see your password.
• Stateless authentication. The Service uses stateless JSON Web Tokens issued by Supabase Auth; we do not maintain server-side session storage.
• API authentication. Calls to our public API are authenticated with bearer tokens in the Authorization header, not cookies, removing CSRF as an attack vector.
• Per-user data isolation. Each user's knowledge graph lives in its own physical FalkorDB graph keyed on the user's UUID; any sub-brains a user creates are further namespaced inside that graph.
• Minimal logging. Brain Graph does not log full HTTP request metadata for normal traffic. The narrow exception is the client-failure telemetry endpoint described in Section 3.4, which records IP, user-agent, and a short fixed-shape event payload for approximately 24 hours.

We do not currently hold a formal security certification (such as SOC 2 or ISO 27001).

Breach notification. In the event of a personal data breach, we will notify the competent supervisory authority and, where required, affected individuals without undue delay, and within 72 hours where the breach is likely to result in a risk to your rights and freedoms, in line with Articles 33 and 34 of the GDPR.

13. Children

The Service is intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. We do not currently verify users' age. If you become aware that a person under 18 has provided us personal data, please contact support@itsbraingraph.ai and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make a material change, we will (a) update the "Last updated" date at the top, (b) update the published version on itsbraingraph.ai/privacy-policy, and (c) notify registered users by email so you have time to review the change before it takes effect.

15. Contact

For privacy questions, requests, and complaints:

• Email: support@itsbraingraph.ai (or support@3nuggets.io)
• Postal address: Dimitris Goudis Consulting Ltd, Chrysanthou Mylona 11, Agioi Omologites, 1085 Nicosia, Cyprus

You also have the right to contact your local data protection authority. For Cyprus residents, that is the Office of the Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy).