Brain Club
Sign inLV

Legal

Privacy notice

What personal data we process, on what basis, who else receives it and how long we keep it.

Version 2026-09-29. This is the first edition — when a next one arrives, the previous stays available.

Controller

SIA "Brain Club" · reg. No. 50203729831 · Friča Brīvzemnieka iela 7, Liepāja, LV-3401
Questions about data: privacy@brainclub.com — we answer within one month.
We have no separate data protection officer — only some organisations must appoint one, and we are not among them. A person on the team answers your letter.

What we process, and why

When you visit the site — an anonymous count of visits with no cookie and no device identifier. Basis: our legitimate interest in knowing how many people visit and whether the site helps them. How the pages are used (clicks, scrolling, errors) is recorded only with your consent. You can change or turn it off on /cookies.
When you have a conversation — the conversation itself and what you type into it. Basis: performance of the contract. Without it there is nothing to answer.
When you open an account — your email address and a phone number for the second factor. Basis: performance of the contract.
When you pay — the fact of the payment, the amount and the invoice details. The card is seen by the payment provider, not by us. Basis: performance of the contract, and our accounting obligation.
When you write to us — the letter and what is in it. Basis: our legitimate interest in answering.
Server logs — the IP address, the time and the address requested, so we can see attacks and errors. Basis: legitimate interest. Kept for 30 days.

Who else receives it

This is the full list, by name rather than by category. Which model line answers is decided by our own router, and the list moves with it.

In the European Union

  • Text2ReachSMS for the second factor Latvia
  • Hetznerservers in Germany and Finland EU
  • Hostingerservers in the European Union EU

United States — Data Privacy Framework or Standard Contractual Clauses

  • Anthropiclanguage model United States
  • Merge.devgateway serving Z.AI GLM models United States
  • OpenAIlanguage model United States
  • xAIlanguage model United States
  • OpenRouterrouter, and the model hosts behind it (including NVIDIA-hosted lines) United States
  • Meta (Muse)research against public sources only — customer conversations never reach it United States
  • Stripepayments; we never see the card details United States and Ireland
  • Google Fonts (fonts.gstatic.com)fonts; sets no cookie, but sees your IP address United States

Outside the EU under Standard Contractual Clauses

  • Z.AIlanguage model (direct) China
  • Tencent Hunyuanlanguage model (in preview) China
  • Moonshot (Kimi)language model China
You can choose which model answers — the picker is in the conversation itself. If you do not choose, the default lane answers, and that lane may route to a free-tier line.
We contractually require providers not to train on your content where the provider offers that setting; the current provider list is above.
Public registers, laws and the cadastre are read from our own servers — nothing about you is sent there.
We hand data to a public authority only when the law requires it, and only as much as it requires.

Transfers outside the European Union

Some recipients are outside the European Union. For providers in the United States the transfer rests on the EU-US Data Privacy Framework where that provider is certified, and on the European Commission’s Standard Contractual Clauses where it is not. For providers in China the basis is Standard Contractual Clauses.
Data is stored in the European Union (Hetzner — Germany and Finland; Hostinger). Conversations and accounts are stored on our own servers in Europe.

How long we keep it

Conversations — while you have an account, and for 30 days after it closes so you have time to download them.
Accounting records — for as long as the Accounting Law requires.
Server logs — 30 days. Visit statistics are stored with no device identifier, so they cannot be tied back to you.

Your rights

You have the right to access your data, to correct it, to erase it, to restrict processing, to receive it in a portable format, to object to processing based on our legitimate interest, and to withdraw a consent you have given.
All of that is one letter to privacy@brainclub.com. Analytics consent you can withdraw right now on /cookies.
If our answer does not satisfy you, you can complain to the Data State Inspectorate.

Two things we do not do

We take no automated decision about you with legal effect, and we build no profile in order to take one. The agent drafts; a person decides.
The service is not directed at children under 16, and we do not offer it to them.

This edition: 2026-09-29. When we change it materially we write to everyone with an account and say what changed.

What we store on your device

Every key, what it is for, and how to switch it off — in one place.

Cookies and storage →