Legal center
Subprocessors
brainplane runs on your Mac. Your topics, files, prompts and agent sessions are stored on your Mac. If you pair a phone, a second Mac or a server, sealed copies pass through our relay, which cannot read them. This list covers the data we do hold: waitlist emails, account and licence data, purchase data, support emails, and website visit counts from visitors who accept Google Analytics. Details in the Privacy Policy.
We tell customers by email at least 30 days before we add or replace a subprocessor. You can object by writing to hello@brainplane.app. If we cannot meet the objection, you can end your plan and get back the unused part of the price.
Processors (they act on our instructions)
| Company | What they do for us | Data | Where the data is processed |
|---|---|---|---|
| Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States | Website hosting, the account and licence service, waitlist storage, the relay for paired devices | Visitor IP addresses and requests, waitlist emails, account and licence data in transit, sealed relay messages until delivery and their routing data | Functions and storage in the Paris region (France). Vercel staff and support may access from the United States |
| Neon, through the Vercel Marketplace | Database for accounts, licences and Macs, and storage of the relay for paired devices | Email addresses, encrypted licence keys, plans, device hashes, Mac names, sign-in code and session hashes; for the relay, device ids and keys, push subscriptions and encrypted messages until delivery | Frankfurt region (Germany) |
| Resend, Inc., United States | Sends sign-in codes, licence keys, trial reminders and receipts | Email address, message content | United States |
| Gandi SAS, France | Domain names, DNS, forwarding of email sent to @brainplane.app | Email addresses and content of messages sent to us | France |
| Google LLC, United States | Mailbox where email sent to hello@brainplane.app arrives | Support emails | United States |
| Google Ireland Limited, Ireland, and Google LLC, United States | Google Analytics 4 audience measurement, only for visitors who accept it in the cookie banner | Pages viewed, referring site, Download clicks, scrolls, outbound links and form interactions, device and browser data, approximate location, a random cookie identifier | European Union and United States. For transfers from the EEA to Google LLC, which is certified, we rely on the EU-US Data Privacy Framework; for transfers from the United Kingdom, on its UK Extension |
Payment provider
| Company | Role | Data |
|---|---|---|
| Stripe | Processes card payments, subscriptions, invoices and refunds for us. For fraud prevention and its own legal duties, Stripe acts as an independent controller (https://stripe.com/privacy) | Email, country, billing and payment data |
Your own vendors (outside this list)
These companies may receive data when you use brainplane, under your own accounts and contracts with them. They are not our processors, and they do not send that data to us.
| Company | When |
|---|---|
| Anthropic (Claude Code), OpenAI (Codex), xAI (Grok) and other agent vendors | When your agents run, on your own plans |
| OpenAI (speech to text) | Only if you turn on the built-in OpenAI voice engine and enter your own API key |
| Dictation apps you choose, such as superwhisper | When you use them |
| Agent installer hosts and public skill repositories, such as GitHub | When you press Install, Update or Check for updates |
| Apple | Checks brainplane's notarization when you open it, as for any Mac app |
| The push service of your phone's browser (Apple, Google, Mozilla or Microsoft) | When an agent needs you on a paired phone: it delivers a generic alert, encrypted, with no card text |