Brain
Sign in

Privacy Policy

Effective October 12, 2026

1. Scope and operator

This Privacy Policy describes how Ehaye ("Ehaye," "we," "us," or "our") collects, uses, stores, discloses, and protects information when you use Brain, including its website, applications, connected data sources, and related services (collectively, the "Service").

Brain is a workplace knowledge service that separates each user's private brain from shared organization brains. The organization that provides your account may separately control information it places in its organization brain.

2. Information we collect

Information you provide

  • Identity and account information, including name, email address, profile image, sign-in provider identifiers, and account preferences.
  • Organization information, including memberships, roles, invitations, permissions, and active organization settings.
  • Content you add, including people, companies, projects, ideas, tasks, events, deals, notes, files, transcripts, prompts, and related metadata.
  • Credentials you add for services you connect, such as API keys for AI or recording services. These are encrypted at rest.
  • Communications and support requests you send to us.

Information from services you connect

  • Conversations, summaries, transcripts, and related metadata from a voice-recording or transcription service that you or your organization connects.

Information collected automatically

  • Device, browser, IP address, request, diagnostic, security, and feature-activity information needed to operate and protect the Service.
  • Session cookies and similar technologies needed to keep you signed in, remember settings, prevent abuse, and maintain service reliability.

3. Google user data

Google sign-in and Google Workspace connections are separate. Signing in gives Brain basic account identity information such as your name, email address, profile image, and Google account identifier. Brain does not receive Gmail or Calendar access merely because you sign in.

If you affirmatively choose to connect Google Workspace, Brain requests read-only access to Gmail, Google Calendar events, and Google Meet conference artifacts. Depending on the features you enable, Brain may access Gmail message content and metadata, including subject lines, participants, timestamps, labels, snippets, message bodies, and attachment metadata. It may also access Calendar event content and metadata, including titles, descriptions, participants, times, locations, conferencing details, and recurrence information. For completed Google Meet conferences, Brain may access participant names, meeting times, and available transcript entries. Brain also receives OAuth account identifiers, granted scopes, access tokens, and refresh tokens required to maintain the connection.

Brain uses this data only to provide user-facing productivity features you request. The Today page displays a live view of recent email context, recent completed meetings, available Meet transcripts, and upcoming meetings without saving that preview in Brain. Google's Meet API makes transcript entries available for a limited period after a conference, currently 30 days. If you later enable organization, summary, digest, or ingestion features, Brain may process and store the selected information needed to provide them. Google connections are optional and read-only; Brain does not send, modify, or delete your Gmail messages, Calendar events, or Meet artifacts.

4. How we use information

  • Authenticate users and maintain accounts, organizations, permissions, and sessions.
  • Provide capture, organization, search, retrieval, review, summarization, and digest features.
  • Process connected data at the user's direction and show the resulting features inside Brain.
  • Maintain, secure, troubleshoot, and improve the reliability and usability of the Service.
  • Respond to support requests and communicate material service or policy changes.
  • Comply with legal obligations and protect users, the Service, and others from fraud, abuse, or security threats.

We do not sell personal information or Google user data. We do not use it for advertising, retargeting, credit-worthiness, lending, or data-broker purposes.

5. Automated and AI processing

Brain uses automated systems, search indexes, embeddings, and language models to classify, summarize, organize, and retrieve information for the user who requested those features. Where enabled, relevant content may be sent to contracted infrastructure or AI service providers solely to perform that user-facing processing.

Google user data is not used to create, train, or improve generalized or publicly available AI or machine-learning models. Brain does not train a model on a user's Google data. API-based model processing is limited to producing results for the requesting user and authorized organization context.

6. Google Limited Use compliance

Brain's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We limit Google user data to providing or improving prominent user-facing Brain features. We do not permit employees, contractors, or other humans to read Google user data unless the user has given explicit consent to view specific data, access is necessary for security or abuse investigation, access is required by law, or the data has been aggregated and anonymized for permitted internal operations.

7. Storage and retention

OAuth refresh tokens are encrypted at rest. When synchronization is enabled, Brain may store imported Google content, selected metadata, generated summaries, extracted records, and provenance needed to provide searchable history and user-requested features. Access is limited by Brain's private and organization authorization rules.

We retain account information while the account is active and retain user content while needed to provide the Service or until it is deleted, subject to legal, security, backup, dispute-resolution, and contractual needs. We do not retain Google user data longer than needed for the disclosed user-facing features. Backup copies may remain for a limited period before being overwritten.

8. Sharing and service providers

We disclose information only as needed for the following purposes:

  • At your direction. Content is shared with members of an organization only when its visibility and your permissions allow it. If you connect an AI assistant or other app to Brain, Brain sends that app the content it requests on your behalf, and that app's own terms and privacy policy apply.
  • Service providers. Hosting, database, security, monitoring, communications, and AI-processing providers process data under our instructions to operate requested Brain features. They may not use it for their independent advertising or generalized model training unless the provider account Brain uses for that feature, which may be yours or your organization's, allows it. This exception never applies to Google user data.
  • Security and legal obligations. We may disclose information when reasonably necessary to investigate abuse, protect rights or safety, or comply with law.
  • Business transfer. Information may be transferred in a merger, acquisition, financing, reorganization, or asset sale only as permitted by applicable law. Google user data will be transferred in such a transaction only after obtaining any explicit prior consent required by Google's Limited Use requirements.

9. Data security

We use administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, alteration, or disclosure. These include HTTPS in transit, encryption of OAuth credentials at rest, access controls, tenant-aware authorization, logging, and restricted production access. No storage or transmission method is completely secure.

10. Your controls and deletion requests

  • You can disconnect a Google account in Brain under Settings > Connections to stop future access.
  • You can also revoke Brain's Google access from your Google Account's third-party connections page.
  • You may delete individual Brain content through available product controls.
  • You may request access, correction, export, or deletion of your account and associated data through the contact link below.

Disconnecting a source stops future collection but does not automatically remove Brain records that were created from that source. Ask us to delete those records or your account when that is your intent. We may retain limited information where required for security, fraud prevention, legal obligations, or an organization's authorized business records.

11. Privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing of, or obtain a copy of personal information. You may also have the right to appeal a privacy-request decision or withdraw consent where consent is the basis for processing. We do not discriminate against users for exercising applicable privacy rights.

12. International processing

Brain is operated using infrastructure in the United States. Information may be processed in the United States or other jurisdictions whose data-protection laws differ from those where you live.

13. Children's privacy

Brain is a workplace service and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

14. Changes to this policy

We may update this policy as Brain, our data practices, or applicable requirements change. We will revise the effective date and provide additional notice when required by law.

15. Contact

Questions, privacy requests, and data-deletion requests may be sent to hello [at] ehaye [dot] ai.