Brainchat
Privacy Policy
In short
- Brainchat runs AI voice agents that phone customers and answer web calls for businesses. Those businesses (our customers) decide whom to call and what the agent says.
- We store what is needed to run that: accounts, campaigns, call recordings, transcripts and the details callers give.
- We use a small set of service providers to do it — Cloudflare (hosting), Google Gemini (the AI voice), Voximplant (phone lines) and Telegram (alerts).
- We don't sell data, we don't show ads, and we don't use your data to train AI models.
- If you connect Brainchat to an AI assistant such as Claude or ChatGPT, the assistant only gets what you ask it to fetch, from the workspaces you own or administer, and you can disconnect it at any time.
- Who we are and our role
- What we collect
- How we use it
- Who we share it with
- AI assistants (Claude, ChatGPT, …)
- How long we keep it
- How we protect it
- Cookies and local storage
- Your choices and rights
- If Brainchat called you
- International transfers
- Children
- Changes
- Contact
1. Who we are and our role
“Brainchat”, “we” and “us” mean the operator of the Brainchat platform. Businesses sign up for a workspace, upload the people they want to call, and set up an AI agent. Partners (agencies) may offer Brainchat under their own brand and domain.
For your Brainchat account (your name, email, sign-in) we decide how data is used. For the people your workspace calls or who call your workspace — their numbers, recordings, transcripts and details — the workspace’s business decides why that data is collected, and we process it on its behalf. Questions about that data are best sent to the business first; we will help them answer.
2. What we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a salted PBKDF2 hash), workspace memberships and role, profile picture you add, account status. | You, at sign-up or by invitation. |
| Sign-in and activity | Session tokens, sign-in and last-active times, sign-in count, failed sign-in counts, the IP address of requests (for rate limits and lock-outs). | Your use of the portal. |
| Telegram | Telegram chat ID and username when you link Telegram; the Telegram user ID used to verify a sign-up. | You, when you link or verify through the Brainchat bot. |
| Workspace content | Campaign lists (phone numbers and names), knowledge documents, the agent’s settings and script, CRM stages and notes, custom tool and MCP server settings — including API keys or tokens you enter for them. | Your workspace’s users. |
| Calls | Phone number, call times and duration, the result, a recording, a transcript, an AI summary, and the details the caller shares (e.g. name, needs, preferred visit time). For web calls also the caller’s IP address (for abuse limits) and, if measured, how noisy the line was. | The call itself. |
| Billing | Call credit balance and a ledger of credit added and used. We don’t store card numbers. | Usage and top-ups. |
| AI assistant connections | The assistant’s registration (its name and return address), which workspace you connected and who connected it, when it was last used, and hashes of its access tokens. | You, when you connect an assistant. |
3. How we use it
- To run the service: place and answer calls, let the AI agent talk, save results to the inbox and CRM, run campaigns at the times you set, and show reports.
- To connect a caller to a person when they ask for one, by alerting your team in Telegram.
- To keep accounts secure: sign-in, verification, approval of new accounts, rate limits and abuse prevention.
- To bill call credit by the minute.
- To support you and to fix problems.
We don’t use your data for advertising, we don’t sell it, and we don’t use it to train AI models.
4. Who we share it with
We share data only with the service providers that make the platform work, each for its own part of the job:
| Provider | What for | What it receives |
|---|---|---|
| Cloudflare | Hosting, database, file storage (web call recordings), protection against attacks | All data stored in Brainchat |
| Google (Gemini API) | The AI voice that speaks and listens on calls; voice samples; turning a CRM search question into filters | Call audio and the agent’s instructions and knowledge during a call; for CRM search only the question and the field names, never customer records |
| Voximplant | Phone lines: dialling, connecting, recording phone calls, live transfers | Phone numbers, call audio, call recordings |
| Telegram | Sign-up verification, campaign updates, live-transfer alerts, the Brainchat mini app | Your Telegram ID, and the alert content (e.g. a caller’s name, number and reason when they ask for a person) |
Your workspace can also send data to services it chooses: custom tools the agent calls during calls, MCP servers it connects, and a Google Sheet it links. Those receive what the tool is set up to send, under that service’s own terms.
A partner that manages your workspace can see that workspace’s data. We may also disclose data if the law requires it, to protect people from harm, or as part of a sale or merger (the buyer would remain bound by this policy).
5. AI assistants (Claude, ChatGPT, …)
Workspace owners and admins can connect Brainchat to an AI assistant through the Model Context Protocol (MCP) at https://portal.brainchat.cloud/mcp. See the connector documentation.
- Your workspaces, your role. You sign in on a Brainchat page and allow the connection; the assistant can reach the workspaces you own or administer, each only while you remain its owner or admin. An admin can disconnect it from a workspace in Settings → AI assistants.
- The assistant gets what you ask for. When you ask about calls, campaigns or customers, Brainchat sends those results to the assistant so it can answer you. That data is then handled by the assistant’s provider (for example Anthropic or OpenAI) under its own privacy policy.
- We receive only the tool request. Brainchat receives the request the assistant makes (for example “list campaigns”) and its inputs. We don’t receive or store your conversation with the assistant.
- Secrets stay hidden. API keys and tokens saved in Brainchat are never sent back to the assistant. Keys you type into a chat are visible to that assistant.
- Tokens: we store only hashes of access tokens (valid 1 hour) and refresh tokens (valid 60 days, replaced on every use).
- Disconnect any time in Brainchat → Settings → AI assistants, or from the assistant’s own settings.
6. How long we keep it
- Web call recordings: 90 days, then deleted automatically.
- Phone call recordings are stored by Voximplant under its retention settings; Brainchat keeps a link to them.
- Calls, transcripts, summaries, campaigns and CRM data: as long as the workspace exists, unless the workspace deletes them. When a workspace is deleted, its data is deleted with it.
- Sessions: 12 hours, or 30 days with “Remember me”.
- Sign-up verification codes and links: minutes; unfinished sign-ups are removed.
- AI assistant connections: until disconnected, or 60 days after last use.
- Account data: while your account is active, and for a short period after deletion where needed for security, billing records or legal obligations.
7. How we protect it
- Everything travels over HTTPS; the portal can’t be framed by other sites.
- Passwords and tokens are stored as hashes, never in plain text.
- Each workspace’s data is kept apart; every request is checked against your role in that workspace.
- Sign-in, calls and other sensitive actions are rate-limited, and repeated wrong passwords lock the account temporarily.
- Recordings are only played through Brainchat to members of their workspace.
- Saved API keys are shown masked, and tools can’t call private networks or Brainchat itself.
No system is perfectly secure. If we learn of a breach that affects you, we will tell you without undue delay.
8. Cookies and local storage
We don’t use advertising or tracking cookies. The portal keeps your session and preferences (theme, layout) in your browser’s local storage, and the installable app caches its own files so it can open offline. You can clear these at any time in your browser.
9. Your choices and rights
- Update your name and password in the portal (My profile).
- Unlink Telegram and disconnect AI assistants at any time.
- Ask us for a copy of your data, to correct it, or to delete your account — contact us.
- Depending on where you live (for example the EU, UK or California) you may have further rights, such as objecting to processing or complaining to a data protection authority. We won’t treat you differently for using them.
10. If Brainchat called you
Calls are made on behalf of the business named on the call, and your number came from that business. To stop calls, tell the agent during the call that you don’t want to be called again — the call is recorded as “do not call” so the business can see it and stop — or contact the business directly. You can also contact us and we will pass your request on and help them act on it.
11. International transfers
Our providers run data centres in several countries, so data may be processed outside your country. Where the law requires it, we rely on appropriate safeguards such as the providers’ standard contractual clauses.
12. Children
Brainchat is a business service and is not meant for anyone under 18. We don’t knowingly collect data from children.
13. Changes
If we change this policy we will update the date at the top, and for important changes we will tell workspace owners in the portal or by email before the change takes effect.
14. Contact
Questions, requests or complaints about privacy: ariyantheguy@gmail.com. We aim to reply within 30 days.