Privacy Policy

Last updated: July 25, 2026

1. Introduction

CorpusBrain is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. It is designed to meet the requirements of the GDPR, UK GDPR, CCPA/CPRA, and other major privacy laws around the world.

By using CorpusBrain, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the service.

2. What we collect

We collect only what is necessary to provide, secure, and improve the service:

  • Account information: email address, name, and avatar provided through Clerk when you sign up or sign in.
  • Content you upload: documents, notes, files, and other materials you add to your knowledge base.
  • Chat data: messages you send, generated answers, and conversation history.
  • Usage and billing data: plan tier, feature usage, subscription status, and payment information processed by Stripe.
  • Analytics data: product usage events collected via PostHog to help us understand and improve the service.
  • Technical data: IP address, browser type, device information, and cookies or similar identifiers where applicable.

3. Legal basis for processing

Under the GDPR and similar laws, we process personal data on the following legal bases:

  • Contractual necessity: to provide the service, authenticate you, and fulfill our agreement with you.
  • Legitimate interests: to improve the product, prevent fraud, and secure the platform.
  • Consent: for optional analytics and marketing communications, where required by law. You can withdraw consent at any time.
  • Legal obligation: to comply with tax, accounting, and other applicable laws.

4. How we use your data

  • To authenticate you and keep your knowledge base isolated from other users.
  • To parse, chunk, embed, and retrieve your documents when you ask questions.
  • To enforce plan limits, process payments, and manage subscriptions.
  • To detect and prevent abuse, fraud, and security incidents.
  • To analyze product usage and fix bugs.
  • To communicate with you about service updates, security alerts, and support requests.

We do not use your documents or chat history to train AI models. Your content is processed only to deliver the service to you.

5. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the product is used. Analytics cookies are only set where permitted by law. You can manage your preferences through your browser or any consent banner we display.

6. Who we share data with

We do not sell your personal data. We share data only with trusted service providers (subprocessors) who help us operate CorpusBrain:

  • Clerk — authentication and user identity management.
  • Supabase — database hosting for chunks, embeddings, and application data.
  • Cloudflare — CDN, security, and file storage (R2).
  • OpenAI — generation of answers based on your retrieved documents.
  • Stripe — payment processing and subscription management.
  • PostHog — product analytics and event tracking.

Each provider is contractually bound to process data only on our behalf and in compliance with applicable data protection laws, including GDPR Standard Contractual Clauses where required.

7. International data transfers

CorpusBrain operates globally. Your data may be transferred to and processed in countries other than your own, including the United States. Where data is transferred outside the European Economic Area, the United Kingdom, or other jurisdictions requiring similar protections, we rely on appropriate safeguards such as Standard Contractual Clauses and adequacy decisions.

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

For users in the EU, UK, and similar jurisdictions

  • The right to access the personal data we hold about you.
  • The right to correct inaccurate or incomplete data.
  • The right to erase your data (“right to be forgotten”).
  • The right to restrict or object to certain processing.
  • The right to data portability.
  • The right to withdraw consent at any time.
  • The right to lodge a complaint with a supervisory authority.

For California residents

  • The right to know what personal information we collect and how we use it.
  • The right to delete personal information, subject to certain exceptions.
  • The right to opt out of the sale or sharing of personal information. We do not sell personal information.
  • The right to non-discrimination for exercising your privacy rights.

For users in other regions

If you are located in Singapore, Brazil, Canada, Australia, Japan, South Korea, India, or another jurisdiction with privacy laws, you may have similar rights. Contact us and we will respond in accordance with your local law.

You can delete your account and all associated data at any time from the Settings page. This removes your profile, documents, chunks, conversations, messages, and subscription record from our database and deletes your Clerk authentication record.

9. Data retention

We keep your personal data for as long as your account is active or as needed to provide the service. When you delete your account, your content and personal data are removed from our live systems promptly. Stripe retains billing records for tax and accounting purposes as required by law.

10. Data security

We use industry-standard security measures, including encryption in transit (TLS), encrypted storage, row-level security in Supabase, and access controls. No system is completely secure, and we cannot guarantee absolute security.

11. Children's privacy

CorpusBrain is not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it.

12. Data breaches

In the event of a personal data breach, we will notify affected users and relevant authorities as required by applicable law, including within the 72-hour window required by the GDPR where it applies.

13. Changes to this policy

We may update this policy as the product or legal requirements change. Significant changes will be announced in the app or via email. Continued use of CorpusBrain after changes constitutes acceptance of the updated policy.

14. Contact us

For privacy questions, data requests, or to exercise your rights, contact us at privacy@corpusbrain.com.

You can also submit a request through our data request page.