Driftless AI Inc (“Brein”, “we”, “us”) provides a workspace where humans and AI agents work from shared context anchored to your code. This policy explains what we collect, why, who we share it with, and the rights you have. It covers trybrein.com and driftless.icu, the Brein dashboard and API, the CLI, and the MCP connector.
Data we collect
- Account & identity. Your name, email address and a user identifier, provided through our authentication provider when you sign up or are invited to a workspace.
- Workspace content. The topics you and your agents create — summaries, decisions, gotchas, invariants, the code globs they’re anchored to, and any code excerpts or notes you choose to store. This content is provided by you; do not paste secrets into it (see Security below).
- Usage & events. Product analytics and an activity history of actions taken in a workspace (topic created, updated, approved, and similar), including timestamps.
- Commercial evidence and contact data. When those features are enabled, Brein may process public procurement or organization evidence and professional contact details returned by an approved enrichment provider. Source, observation time, rights and suppression status travel with the result. A verified work email is not permission to contact its recipient.
- Weekly alert subscriptions. If you subscribe to the weekly alert on trybrein.com, we store your email, what you told us you sell, the page you subscribed from and, only if you give it, your WhatsApp number. We use them to send the alert you confirmed and, if you left a number, to message you about Brein. Your email is processed by our email provider, Resend, to send the alert. Every alert email lets you unsubscribe, and you can ask us to delete this data at any time.
- Email connection data. If you connect Gmail or Outlook for the beta campaign-sending feature, Nylas receives the authorization and the minimum recipient and campaign data needed to send an approved campaign. Brein does not read your inbox, search messages or manage replies inside the product. Replies remain in Gmail or Outlook.
- Credentials. API keys and OAuth tokens are stored only as hashes; provider keys you supply for optional agent features are encrypted at rest. We never store these values in plaintext.
How we use it
- To provide the service — store, retrieve and govern your team’s context.
- To detect drift, review pull requests, and surface relevant context to agents.
- To organize bounded commercial evidence and, when enabled, enrich selected contacts.
- To send an explicitly authorized campaign through the connected Nylas sender.
- To secure accounts, authenticate requests, and prevent abuse.
- To understand product usage and improve Brein (analytics).
- To communicate with you about your account, invitations, and service changes.
We do not sell your data, and we do not use your workspace content or private mailbox content to train general models. Enrichment and sending remain gated by their stated purpose, authorization and suppression controls.
Google user data
If you connect Gmail as a campaign sender, Brein requests only the “send email” permission (gmail.send) plus your basic Google account identity (email address and profile) — nothing more. We never request a scope that can read, search, label or list your inbox, contacts or calendar, and we do not use this access for anything beyond sending the campaign messages you explicitly review and authorize inside the product.
- What we store. An opaque connection identifier (a Nylas “grant id”), your sender address, and consent and audit metadata. We never see, store or log your Google password or OAuth access/refresh tokens; Nylas, our outbound-email sending provider, holds and manages those credentials on our behalf and is the only third party that receives the authorization.
- What we don’t do. We do not read, search or store your inbox or its messages. We do not sell or transfer Google user data, and we do not use it to serve ads (including retargeting or interest-based advertising), to determine creditworthiness or for lending purposes, or to train general-purpose AI models.
Brein’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Advertising measurement (Meta)
We advertise Brein on Facebook and Instagram and use Meta Platforms to measure whether those ads work. This is limited to two things:
- On trybrein.com. The Meta Pixel records page visits to our public website. It does not read what you type into forms.
- When you sign up or start a trial. Our server tells Meta that a sign-up or a Solo trial happened, together with your email address and your user identifier, both transformed with SHA-256 before they leave our servers. Meta uses them only to match the event to an ad. We send nothing else: no name, phone, IP address, workspace content, CRM data or contacts.
You can object to this at any time by writing to [email protected]; we will stop sending your events. You can also manage how Meta uses this data in your Facebook or Instagram ad preferences.
Legal bases (GDPR)
Where the GDPR applies, we process personal data to perform our contract with you (providing the service), on the basis of our legitimate interests (security, analytics, product improvement), to comply with legal obligations, and — where required — with your consent, which you may withdraw at any time.
Sharing & subprocessors
We share data only with the infrastructure providers needed to run Brein, each processing only what its function requires. The current list — with purpose and region — is on our Trust & Security page. We may also disclose data where required by law.
Data retention
We keep active data until you delete it; deleted data enters a 30-day recovery window before permanent removal; and the database is backed up automatically by our provider. Full retention periods are listed on the Trust & Security page.
Your rights
Subject to applicable law (including the GDPR and CCPA), you can access, correct, export and delete your personal data, and object to or restrict certain processing. You can delete a workspace you own from the dashboard; to export your data or delete your account, use the in-product controls where available or email [email protected] and we will action your request. We will not discriminate against you for exercising these rights.
Derechos ARCO y exclusión de contactos
Si estás en México, puedes solicitar acceso, rectificación, cancelación u oposición respecto de tus datos personales, así como retirar un consentimiento cuando aplique. También puedes pedir que una dirección o dominio quede excluido de futuras acciones de enriquecimiento o envío, u oponerte a que avisemos a Meta de tu registro para medir nuestros anuncios. Escribe a [email protected] indicando tu nombre, la solicitud y un medio para responder. Podemos pedir información razonable para verificar la identidad y te informaremos el resultado o la razón de cualquier límite legal o técnico.
Security
Credentials are hashed, provider keys are encrypted with AES-256-GCM, traffic is TLS, and every request is isolated to its workspace. Details are on the Trust & Security page. No system is perfectly secure — please don’t store secrets (API keys, passwords) inside topic content.
International transfers
Our infrastructure is primarily in the United States. Where we transfer personal data out of your region, we rely on appropriate safeguards such as Standard Contractual Clauses.
Children
Brein is a tool for software teams and is not directed to anyone under 16.
Changes
We’ll update this page when our practices change and revise the “last updated” date above; material changes will be communicated to account holders.
Contact
Questions or requests: [email protected]. Security reports: [email protected].