Brin Solutions

Legal

Privacy Policy

Last updated: August 17, 2026 Effective: August 17, 2026 Status: Revised August 17, 2026 to describe Brin's hosted service. The revised sections are under counsel review. Your rights (Sections 8, 9, and 10) and the Lead Center disclosures (Section 3.4) are unchanged from the counsel-reviewed text.

Plain-language summary

Brin is a hosted service. When you use a Brin workspace, your content is stored on infrastructure we operate on your behalf, in the United States, rather than on your own computer. In practice that means:

  1. Your workspace content — tasks, notes, leads, drafts, and history — is stored in a database we operate.
  2. When you use an AI feature, Brin sends the relevant text to an AI provider on your behalf and returns the result to your workspace.
  3. Email you send through Brin, and replies to it, pass through our email provider so they can be attached to the right record.

We do not sell your data. We do not run ad networks, analytics trackers, or cross-site tracking inside the application. We do not use your content to train AI models.

You can ask us to export or delete your workspace data at any time. See Sections 6, 8, and 9.

The providers we rely on to run the service are listed at /sub-processors.

This document explains the above in more detail and describes your rights under U.S. state privacy laws and the Philippines Data Privacy Act.

1. Who we are

"Brin," "we," "us," or "our" refers to Brin Solutions, a company located in and operating from the United States.

Controller contact:

Data Protection Officer (for Philippines Data Privacy Act purposes):

If you have any question about this policy, your data, or your rights, email the addresses above and we will respond within 30 days.

2. Who this policy applies to

This policy applies to:

  • Individuals and businesses that use a Brin workspace
  • People whose personal information a customer stores in their workspace (for example, the sales leads described in Section 3.4). If a business has entered your information into its Brin workspace, that business decides how it is used and we process it on their behalf. You can still contact us at the addresses in Section 1 and we will help, or route your request to that business.
  • Visitors to the Brin marketing site or its legal pages
  • Individuals who sign up for the waitlist or contact us

Brin is built for adults operating in a professional capacity (solo founders, consultants, executives, and other working professionals). It is not directed at children under 18, and we do not knowingly collect personal information from children under 18.

3. What information we handle

3.1 Information you provide directly

When you set up Brin, you enter information through the onboarding wizard and ongoing use of the product. This includes:

  • Account information: your name, email address, and a hash of your password. We never store your password itself.
  • Profile and goals: information you tell John about your business, priorities, projects, and working style.
  • Tasks, projects, notes, knowledge base entries, and ideas: everything you create inside Brin.
  • Voice transcripts: if you use voice mode, the audio is sent to the voice provider, which returns a text transcript. The transcript is stored in your workspace.
  • Credentials for services you connect: for example, the sending identity for your own email domain, or an OAuth token if you connect a mailbox. These are encrypted before they are stored and are used only to perform the actions you ask for.

This information is stored in your workspace on infrastructure we operate, described in Section 7.

3.2 Information processed by AI providers on your behalf

When you use a feature that calls an AI model (John, voice mode, knowledge base extraction, planning, drafting, and similar), Brin sends the relevant text to an AI provider on your behalf. Brin provides this AI access as part of the service; you do not need to supply your own provider account. What is sent includes:

  • The prompt Brin constructs (which may include relevant parts of your context, memory, and recent messages)
  • Any content you explicitly ask Brin to act on (such as a URL you paste for knowledge base extraction)

Because Brin provides the access, these requests are sent from our systems rather than directly from your device. The AI provider processes the prompt and returns a response, which Brin stores in your workspace as part of your history.

We do not use your content to train AI models. The AI providers we use are listed at /sub-processors, and their own terms govern how they handle data we send them on your behalf.

3.3 Information we handle on our marketing site and waitlist

If you visit the Brin marketing site or join a waitlist, we may process:

  • Your email address (to contact you about availability)
  • Basic server logs (IP address, user agent, request path) retained for up to 30 days for security

We do not use third-party advertising trackers, session replay, or cross-site tracking on the marketing site.

3.4 Lead data and email sending (Lead Center)

If your workspace includes the Lead Center, additional categories apply:

  • Lead and contact data you enter: names, email addresses, phone numbers, company details, and notes about your sales leads. These records describe third parties (your prospects and customers). You are the owner of this data; Brin processes it only to provide the Lead Center to you. We do not use your lead data to contact your leads ourselves, and we never sell it.
  • Prospect discovery: when you run a Discover search, your search terms (a service category, an area, an optional keyword) are sent to our sourcing provider (Apify), which returns publicly listed business information (name, category, website, public contact details, ratings). Your stored lead data is not sent to the sourcing provider.
  • AI drafting: when you draft an email with Brin, the relevant lead's details and your instructions are sent to the AI provider to generate the draft, as described in section 3.2.
  • Sending email from your Gmail account: if you connect Gmail, Brin requests a send-only permission (gmail.send). Brin can send the emails you review and approve, from your address. Brin cannot read, search, or list your mailbox. You can revoke this permission at any time in your Google account settings, or disconnect in Settings. We store the OAuth tokens needed to send on your behalf and the content of emails you send through Brin (so your lead timeline is complete); we never store your inbox.
  • Reply tracking. Outreach you send through the Lead Center uses a Brin-managed reply-to address so that replies from your leads are routed back to Brin and attached to that lead's timeline. To do this, your leads' replies (sender, subject, body) pass through our email provider (Resend) and are processed by the AI provider to classify the reply (for example, "interested" or "wants a quote") so Brin can suggest a next step. We process these replies only to provide the Lead Center to you; we do not use them for any other purpose and never sell them.

Brin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

We process the information described above only for these purposes:

  1. To operate your workspace. To store the content you create, make it available when you sign in, and run the features you use.
  2. To relay your prompts to AI providers. Brin sends these requests on your behalf so that AI features work without you configuring a provider account.
  3. To respond to you. If you email us, we use your email to reply.
  4. To maintain the waitlist. If you join a waitlist, we use your email to notify you about availability.
  5. To comply with law and protect the rights and safety of users and the public.

We do not:

  • Sell personal information
  • Share personal information for cross-context behavioral advertising
  • Use your data to train AI models
  • Profile you for automated decisions with legal or similarly significant effects

5. Legal bases (for users in the Philippines)

Under the Philippines Data Privacy Act of 2012 (Republic Act 10173), we rely on the following legal bases:

  • Consent (Sec. 12[a]) for processing personal information during onboarding and waitlist sign-up.
  • Contract performance (Sec. 12[b]) for operating your workspace and providing the features you sign up for.
  • Legitimate interest (Sec. 12[f]) for security logging on the marketing site.

You may withdraw consent at any time by contacting dpo@brinsolutions.com.

6. How long we retain information

  • Your workspace content: retained for as long as your workspace is active, so that it is there when you sign in. You can delete individual records at any time from within Brin.
  • After a deletion request or account closure: if you ask us to delete your workspace, we remove it from our production systems within 30 days. Copies held in encrypted backups are removed as those backups age out on their normal rotation.
  • On our side (waitlist / support email): up to 24 months, or until you ask us to delete it.
  • Server logs (marketing site): up to 30 days.

7. How information is stored and protected

  • Your workspace: stored in a managed PostgreSQL database hosted in the United States, which encrypts data at rest. Each workspace's data is scoped to that workspace, and access by our personnel is limited to those who need it to operate and support the service.
  • Credentials and tokens: any credentials you connect (such as an email sending identity or a mailbox token) are encrypted before being stored.
  • Your account: protected by your password. Choose a strong, unique one and do not reuse it elsewhere.
  • Transmission: all traffic between you, our systems, and our providers is sent over HTTPS (TLS 1.2+).
  • On our side: waitlist and support emails are stored in a hosted inbox protected by 2FA and strong passwords.

No system is perfectly secure. If we become aware of a breach that materially affects your personal information, we will notify you within 72 hours where required by applicable law (including RA 10173 Sec. 20[f]).

8. Your U.S. state privacy rights

8.1 California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we have about you and how it's used.
  • Access a copy of your personal information.
  • Delete your personal information.
  • Correct inaccurate personal information.
  • Opt out of sale or sharing of your personal information (we do not sell or share for cross-context behavioral advertising; there is nothing to opt out of).
  • Limit the use of Sensitive Personal Information (we do not use SPI for purposes that trigger the limitation right).
  • Non-discrimination for exercising these rights.
  • Designate an authorized agent to make requests on your behalf (we will verify the agent's authority).

We do not use or disclose Sensitive Personal Information for any purpose other than those permitted under Cal. Civ. Code § 1798.121(a).

To exercise a right, email privacy@brinsolutions.com. We will respond within 45 days (extendable to 90 days where permitted).

8.2 Other U.S. state privacy laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, New Jersey, Delaware, New Hampshire, Kentucky, Maryland, Minnesota, Rhode Island, Indiana, Iowa, and Tennessee have similar rights under their own state privacy statutes, including the right to:

  • Confirm whether we process your personal data and access a copy
  • Correct inaccuracies
  • Delete your personal data
  • Obtain a portable copy of your personal data
  • Opt out of targeted advertising, sale of personal data, and certain forms of profiling (we do none of these)
  • Appeal a denied request

To exercise a right, email privacy@brinsolutions.com. We will respond within the period required by your state's law (generally 45 days). If we deny your request, you may appeal in writing to the same address.

8.3 Residents of other U.S. states

Even if your state does not yet have a comprehensive privacy law, you may email privacy@brinsolutions.com with any data request and we will make reasonable efforts to honor it.

9. Your rights under the Philippines Data Privacy Act

If you are a data subject under RA 10173, you have the right under Sec. 16 to:

  1. Be informed of how your personal information is processed.
  2. Object to processing.
  3. Access your personal information.
  4. Rectify inaccurate personal information.
  5. Request erasure or blocking of your personal information.
  6. Damages for inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information.
  7. Data portability.
  8. Lodge a complaint with the National Privacy Commission (NPC) at https://www.privacy.gov.ph/ or by emailing complaints@privacy.gov.ph.

To exercise any of these rights, email dpo@brinsolutions.com. We will respond within the period required by the NPC's implementing rules (generally 15 days for the initial response).

10. Children

Brin is not intended for users under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, email privacy@brinsolutions.com and we will delete it.

11. International transfers

Brin is operated from the United States and the infrastructure that stores your workspace is located there. If you use Brin from outside the United States, your information is transferred to and processed in the United States. Our AI and email providers may also process data in the United States or other countries.

If you are a Philippines data subject, note that our hosting and AI providers are U.S.-based, so your workspace content and prompts will be processed in the U.S. By using Brin, you consent to this transfer. If you would prefer your data not be processed this way, contact dpo@brinsolutions.com before creating a workspace.

12. Third parties

Brin does not sell or rent your personal information. We rely on a small number of sub-processors to host the service, provide AI features, and send email on your behalf. A current list, with what each one does and where it processes data, is at /sub-processors. We update that list when we add or change a provider.

Some personnel or contractors who help us operate and support the service may be located outside the United States, including in the Philippines. They may access personal data only as needed to provide the service and are bound by confidentiality and data-protection obligations.

13. Changes to this policy

When we update this policy, we will:

  • Change the "Last updated" date at the top
  • Bump the LEGAL_POLICY_VERSION constant inside the application
  • Prompt you to re-accept the updated policy the next time you open Brin

For material changes, we will also email waitlist and known contact addresses where we have them.

14. Contact

Questions, requests, or complaints about this policy:

This document is provided in English only. If we publish a Filipino translation, the English version will control in the event of a conflict, except where required otherwise by Philippine law.

Change history

We keep this list so you can see what has changed and when.

  • August 17, 2026 — Material change. Updated this policy to describe Brin as a hosted service. Previous versions described Brin as local-first software that stored your data on your own computer; that no longer reflects how the product works. Your workspace content is stored on infrastructure we operate (Section 7), and Brin now provides AI access and sends AI requests on your behalf rather than you configuring your own provider keys (Section 3.2). Added retention terms for hosted data (Section 6), added people whose information a customer stores in their workspace to the scope of this policy (Section 2), and published the sub-processor list this policy references (Section 12). Your rights under Sections 8, 9, and 10 are unchanged, as are our commitments not to sell your data or train models on your content. These revisions are under counsel review.
  • July 7, 2026 — Clarified that Brin Solutions is a United States company, and disclosed that some personnel or contractors who support the service may be located outside the U.S. (including the Philippines) under confidentiality and data-protection obligations. Non-material clarification; no change to how your data is used or to your rights.
  • June 16, 2026 — Added Lead Center processing (lead data, prospect discovery, Gmail sending, and reply tracking); reviewed by counsel.