Privacy Policy

1. About this policy

This policy explains how HUMAN READY AI (PTY) LTD (“we”, “us”), a private company registered in South Africa (registration number [REVIEW: company registration number], address [REVIEW: registered address]), handles personal information in SecBrain: the web app at app.secbrain.app, the desktop apps, the iOS app, the Chrome extension and this website. We are the responsible party under South Africa’s Protection of Personal Information Act, 2013 (POPIA) and the controller under the EU and UK General Data Protection Regulation (GDPR).

For a plain-language walk-through, with a map of where each kind of data lives, read Privacy, in detail. If the two ever differ, this policy applies, and we will fix the difference.

2. Information Officer and contact

Our Information Officer (POPIA) and data protection contact is [REVIEW: name of the Information Officer, and confirmation of registration with the Information Regulator], reachable at privacy@secbrain.app. [REVIEW: whether an EU and/or UK representative under GDPR Article 27 is required]

3. What we collect

3.1 Account information

Your email address, your display name, your plan and your subscription state. If you sign in with Google or Apple, also the profile details that provider shares with us at sign-in.

3.2 Your library

• Memos and metadata. Stored first on your device (IndexedDB on web and desktop, GRDB on iOS) and synced to a Postgres database we operate, which keeps your devices in step.
• Attachments. Files you attach are stored in our cloud storage (Cloudflare R2), within your plan’s storage limit.
• Forwarded emails. Mail you send to your personal capture address arrives through Cloudflare Email Routing and is saved as a memo, with its attachments in our cloud storage. Our server summarises it with a cloud AI provider when it arrives.
• Shared memo links. If you share a memo from the web or desktop app, anyone with the link can read that memo’s title, text and source link. The link does not expire; it stops working when you delete the memo.
• Embeddings. Vector representations of your memos, stored on your device (IndexedDB on web and desktop, GRDB on iOS). Cloud embeddings are generated by Google’s gemini-embedding-001 model through our server; we do not store embeddings server-side.
• Search index. A full-text index on your device, and a server-side full-text index over memo titles and bodies in Postgres, which the Chrome extension’s chat searches. Every query is scoped to your account.

3.3 Connected services

• OAuth tokens (Google Drive and YouTube, Notion), if you connect them. Encrypted by our server with AES-GCM and a server-held key and stored in Postgres. The Notion token is decrypted and handed to your browser, which calls Notion directly. Our server uses the Google token to import from Drive and YouTube.

3.4 AI requests

When a cloud AI feature runs, including the automatic summaries, tags and titles for captured items and image descriptions, the prompt and the relevant content (memo text, captured page text or images) go from your device to our server (a Supabase Edge Function), which calls the provider on SecBrain’s own account and returns the response. For forwarded-email summaries and recap-email digests, our server reads the content from your synced memos instead. You cannot add your own API key. Our usage log records the provider, the operation and the token count, not the text.

3.5 Usage and error data

• Web app: PostHog product analytics.
• Desktop app: PostHog product analytics.
• iOS app: PostHog analytics and crash reports.
• This website: Google Analytics 4 through Cloudflare Zaraz, only if you accept analytics cookies (section 11).
• The Chrome extension: none.

We use this to see how the product behaves and to catch errors. We run no advertising trackers. Each app has an opt-out: Settings → Privacy on web and desktop, Settings → Data & Advanced on iOS. On this website, “Cookie settings” in the footer changes your choice.

3.6 Billing

Paddle, our merchant of record, collects your payment details, billing address and tax information under its own privacy notice. We never receive your card details. Paddle tells us what we need to link a purchase to your account: your Paddle customer and subscription IDs, the plan, its billing period and its status. On iOS, Apple handles payment and sends us the same subscription details [REVIEW: confirm the fields once the Paddle webhook contract (F1) is built].

3.7 Support

If you email us, we keep the email and our reply to help you and to improve the Service.

3.8 This website

secbrain.app shows a consent banner on your first visit and sets only the cookies listed in section 11; analytics and the attribution cookie run only if you accept them there. Our host, Cloudflare, processes technical request data such as IP addresses to deliver the site and protect it from abuse [REVIEW: confirm Cloudflare log settings and retention]. When you open checkout on the Pricing page, Paddle’s checkout loads from Paddle and is governed by Paddle’s privacy notice [REVIEW: confirm whether Paddle.js sets cookies once checkout is live (T003)].

4. Why we use it, and our lawful basis

• To provide the Service you signed up for: storing, syncing, searching and processing your library, running AI features, and managing your plan. Basis: performance of our contract with you.
• To keep the Service secure and working: error reporting, abuse prevention and usage limits. Basis: our legitimate interest in a reliable, secure service.
• To understand how the product is used: product analytics. Basis: our legitimate interest in improving the product; you can opt out in each app’s settings. [REVIEW: whether analytics needs consent rather than legitimate interest for EU/UK users (ePrivacy)]
• To see which campaigns and links bring people to this website: website analytics and the attribution cookie, described in section 11. Basis: your consent, given in the cookie banner and changeable at any time.
• To meet legal obligations, such as tax and accounting records, and lawful requests from authorities. Basis: legal obligation.
• To talk to you about your account, changes to these terms and support requests. Basis: contract and legitimate interest. We send no marketing email without your consent.

We do not sell your personal information, we do not use your library to train AI models, and we do not run third-party advertising in the product.

5. Cloud AI providers

AI features run in the cloud: your content goes through our server to Anthropic, Google or OpenAI, on SecBrain’s own accounts with those providers and within your plan’s limits. The provider processes the request under its API terms. [REVIEW: confirm each provider’s API terms exclude training on API data, and the data retention each applies]

6. Who we share it with

We share personal information only with service providers (operators under POPIA, processors under the GDPR) that help us run SecBrain, under contracts that limit their use of it:

• Supabase (EU): database, sign-in and server functions [REVIEW: Supabase project region];
• Cloudflare: hosting of this website and the web app, the cookie banner and analytics relay on this website (Zaraz), attachment storage (R2), the Workers that fetch captured links and YouTube transcripts and serve your files, and email routing for forwarded emails;
• Anthropic, Google and OpenAI: cloud AI and embeddings;
• Google LLC: website analytics (Google Analytics 4), only if you accept analytics cookies, under its API terms;
• Amazon Web Services (SES): recap emails;
• Supadata: YouTube transcripts;
• PostHog (EU): product analytics;
• Paddle: payments, tax and refunds, as merchant of record (Paddle acts as an independent controller for payment data);
• Apple: iOS purchases and Sign in with Apple;
• Google: sign-in, if you use it;
• Google and Notion: only if you connect Google Drive, YouTube or Notion;
• our email provider, for support mail [REVIEW: name the email provider].

We may also disclose information where the law requires it, to protect rights and safety, or to a buyer of our business, who would be bound by this policy.

7. International transfers

Our service providers process data outside South Africa, including in the United States and the European Union. Where we transfer personal information across borders we rely on safeguards that POPIA section 72 and GDPR Chapter V accept, such as the provider’s data processing agreement and standard contractual clauses. [REVIEW: confirm the transfer mechanism for each provider]

8. Security

Data travels over TLS. Postgres is encrypted at rest by the database provider. OAuth tokens are encrypted at rest with a server-held key. The apps’ queries are scoped to your account by row-level security. SecBrain staff and server jobs can access account data with privileged access, for support, security, legal requests and running the service. Your memos are not end-to-end encrypted in the cloud copy today; the explainer’s “Not yet” section says what we are considering. If a breach affects your personal information we will notify you and the regulators as the law requires.

9. How long we keep it

• Your account and library: while your account exists. When you delete your account (Settings → Delete account on web and desktop, Settings → Account on iOS), we delete your account and everything synced to it, including memos, OAuth tokens and share links, and wipe the device you delete from. Stored attachments are purged at the same time on a best-effort basis. Embeddings live only on your devices. Deletion runs when you confirm; there is no grace period. Deleting your account cancels a plan bought on our website or web app immediately. The rest of the period isn’t refunded automatically; the 30-day guarantee in our Refund Policy still applies. A plan bought in the iOS app is billed by Apple until you cancel it in your Apple subscription settings. [REVIEW: database backup retention after deletion]
• Data on your devices: stays until you remove the app or clear its storage.
• AI usage log (provider, operation, token count): [REVIEW: retention period].
• Analytics data: [REVIEW: PostHog retention period].
• Website analytics and cookies: the cookie lifetimes in section 11; [REVIEW: Google Analytics 4 data retention setting].
• Billing records: Paddle keeps them for the period tax law requires (typically 7 years); we cannot shorten that.
• Support email: [REVIEW: retention period].

10. Your rights

Depending on where you live, you have the right to:

• access the personal information we hold about you, and get a copy;
• correct or update it;
• delete it, including by deleting your account in the app;
• take it with you: export your library any time from Settings → Data Management (JSON and Markdown) on web and desktop, or Settings → Data & Advanced → Import & Export (Markdown) on iOS, with no subscription required;
• object to or restrict processing based on our legitimate interests, including analytics;
• withdraw consent where we rely on it;
• complain to a regulator: in South Africa, the Information Regulator; in the EU or UK, your local data protection authority.

To make a request, email privacy@secbrain.app. We respond within 30 days and do not charge a fee. We may need to confirm your identity first.

11. Cookies, consent and local storage

This website shows a consent banner on your first visit. Until you choose, it sets only the cookie that remembers your choice. You can change your choice at any time with “Cookie settings” in the footer of every page. The cookies this website sets:

• cf_consent. Strictly necessary. Stores your cookie choice. Lasts 1 year.
• sb_attr. Only if you accept cookies in the banner. Records which campaign or link brought you here, so we can see what works. We send it to no one; app.secbrain.app reads it when you sign up. Lasts 90 days.
• cfz_google-analytics_v4 and cfzs_google-analytics_v4. Analytics purpose, only if you accept it. Google Analytics 4 runs through Cloudflare Zaraz on our behalf; Zaraz keeps the visitor and session ids in these cookies instead of Google's usual _ga cookies, and Google never sets a cookie itself. If you decline, Google receives only cookieless consent-mode pings. [REVIEW: confirm the lifetimes of the two Zaraz GA4 cookies, and the consent-mode description]
• cf_zaraz_client and cfz_zaraz-analytics. Strictly necessary. Set by Cloudflare Zaraz to run and monitor the tag manager itself; they hold no Google data. [REVIEW: confirm these two are acceptable as strictly necessary]

The SecBrain apps store your library, settings and sign-in session on your device (for example in IndexedDB) so they work offline and keep you signed in. Product analytics in the apps may store an identifier on your device [REVIEW: confirm the PostHog persistence setting (cookie or local storage) in the web app].

12. Children

SecBrain is not intended for children. We do not knowingly collect personal information from anyone under 18 [REVIEW: age threshold]; if you think a child has given us information, contact us and we will delete it.

13. Changes to this policy

We will update this page when our practices change. If a change loosens any of our privacy commitments, we will email every account at least 30 days before it takes effect. The date at the top shows the latest version.

14. Contact

Privacy questions and requests: privacy@secbrain.app. Security disclosures: security@secbrain.app. Everything else: support@secbrain.app.