ReBrayn Privacy Policy

Version 1.1 · last updated: 26 October 2026

Provisional text, pending final legal review.

This policy explains which personal data we process when you use ReBrayn, why, for how long, with whom we share it and which rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Code on the protection of personal data (Legislative Decree 196/2003). We have written it in plain language: if anything is unclear, write to us.

1. Data controller

The controller is ADC S.r.l. (single-member company), registered office Via Giacinto Andrea Longhin 11, 35129 Padova (PD), VAT IT05353650285, tax code 05353650285, registered with the Padova Companies Register, REA no. PD-461969, share capital €10,000 fully paid, certified e-mail (PEC) alessandrodeconcinisrl@pec.it, e-mail info@rebrayn.ai.

For questions about privacy and to exercise your rights, write to info@rebrayn.ai.

2. In short

• ReBrayn is a cloud service: your files, your notes and everything you create are stored on the servers we use in Ireland (European Union), so you find them on every device.
• When you use an artificial intelligence feature, the parts of your Materials needed for that task are sent to the model provider. Some providers are in the United States (sections 6 and 7).
• We do not sell your data, we do not use it for advertising or to profile you, and we do not use it to train artificial intelligence models.
• Technical logs do not contain the content of your Materials.
• You can delete your Account from the app: we normally delete your data within minutes and backup copies expire within 35 days.

3. Which data we process

• Account: e-mail address, name, app language; the password is handled by the authentication service and stored only in protected form, which none of us can read. It comes from you, at sign-up.
• Initial questionnaire: age band, occupation, faculty or subjects of study and any free descriptions you write; you can skip it. It comes from you, at first sign-in.
• Acceptance of the Terms: which version of the Terms you accepted and which version of this Policy we showed you, the language, the date and time (server time), and your choice about news e-mails. It comes from the app.
• Materials and Outputs: the files you upload or import (documents, images, audio, links to YouTube videos and web pages), extracted text, transcripts, notes, annotations, highlights, keywords, maps, summaries, questions, flashcards and their review schedule, conversations with the Tutor, collections, tags, settings. They come from you and from the processing the service carries out.
• Search index: text excerpts of your documents and their numerical representation, which let the Tutor find the relevant passages. It comes from the processing of your documents.
• Plan usage data: monthly counters of the features used (for example artificial intelligence requests, OCR pages, transcripts), space used and the log of the individual operations counted, without content. It comes from the service.
• Subscription and payment: Plan, status and expiry of the subscription, customer and subscription identifiers at the payment provider. We do not receive the card number or the PayPal credentials. It comes from you and from the payment provider.
• Technical data: request and error codes, response times, app version, random session and device identifiers generated by the app, the IP address and technical data of every request (seen by the delivery network and the AWS firewall, which keeps a sample for a few hours), e-mail delivery outcomes with the recipient address; some logs contain the random identifier of your Account; no log contains the content of your Materials. It comes from the service and from the app.
• Communications with us: the content of the e-mails you send us and our replies. It comes from you.
• Website contact form: the name, e-mail address and message you type into the contact form on the rebrayn.ai website, plus the page language. It comes from you. The form is optional: you can instead write directly to info@rebrayn.ai. The website does not save the message in any database and does not record any submitted value in its technical logs: the message is sent as a single e-mail to ADC's info@rebrayn.ai mailbox. To block abuse, the form derives a pseudonymous counter from your IP address (a keyed hash of the address with a random value that changes every day) and limits submissions to 5 per hour and 50 per day; the form uses no cookies and no local storage.

We do not ask you for special categories of data (Article 9 GDPR) and we ask you not to upload data of this kind relating to identifiable persons (Terms of Service, section 9.4; in ReBrayn: Settings › About).

Sign-in with an existing account. If you sign in to ReBrayn with the e-mail address and password of an account you had with a service linked to ReBrayn, at your first sign-in we verify those credentials with that service and create your ReBrayn Account with the same e-mail address and the same password; we also keep the identification code of the old account, to link any subscription and the data you choose to import. The password never appears in our logs and is stored only in protected form, as for every Account.

4. Why we process it and on which legal basis

• Create and manage the Account, authenticate you, recover the password: data used: Account; legal basis: performance of the contract (Article 6(1)(b)).
• Provide the ReBrayn features: store, synchronise and process the Materials, generate Outputs, including with artificial intelligence, share when you ask: data used: Materials, Outputs, search index, Account; legal basis: performance of the contract (Article 6(1)(b)).
• Apply the Plan limits and manage subscriptions, renewals, cancellations and withdrawals: data used: usage data, subscription; legal basis: performance of the contract (Article 6(1)(b)).
• Learn the study profile of the people who use ReBrayn, to improve the service: data used: questionnaire; legal basis: [● legitimate interest (Article 6(1)(f)) or consent (Article 6(1)(a))].
• Send you service e-mails (verification and password-recovery codes; notices about the subscription and changes to the Terms): data used: e-mail; legal basis: performance of the contract (Article 6(1)(b)).
• Send you news and offers about ReBrayn by e-mail, only if you choose it with the optional box at first sign-in: data used: e-mail address and your choice; legal basis: consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time from the Account settings or by writing to info@rebrayn.ai, without affecting the lawfulness of the e-mails already sent. Refusing it never limits the service.
• Answer the requests sent through the website contact form: data used: name, e-mail and message from the form; legal basis: steps taken at your request before a contract (Article 6(1)(b)) and our legitimate interest in answering you (Article 6(1)(f)). We do not use them for marketing or profiling.
• Keep the service secure, stable and fast, find and fix errors, prevent abuse: data used: technical data; legal basis: legitimate interest in the security and proper functioning of the service (Article 6(1)(f); recital 49).
• Recognise an existing account and link its subscription (section 3): data used: e-mail, identifier of the old account; legal basis: performance of the contract (Article 6(1)(b)).
• Reply to your requests: data used: communications; legal basis: performance of the contract or pre-contractual measures (Article 6(1)(b)).
• Comply with tax and accounting obligations: data used: subscription and payment; legal basis: legal obligation (Article 6(1)(c)).
• Establish, exercise or defend a legal claim: data used: the data strictly necessary; legal basis: legitimate interest (Article 6(1)(f)).

Account data is necessary to use ReBrayn: without it, we cannot enter into the contract. The questionnaire is optional, as is the box for news and offers e-mails: if you do not choose it, the service does not change. Besides service e-mails, we send promotional e-mails only to those who have given their consent.

We do not take decisions based solely on automated processing that produce legal effects or similarly significant effects on you (Article 22 GDPR).

5. Artificial intelligence: what happens to your materials

5.1 Some processing starts by itself after upload, to prepare the Material for study: for example text extraction, OCR of scanned pages, the index, the transcription of an audio or video file and the search index. Other processing starts when you ask for it: for example a summary, questions, the explanation of a term or an image, an example, a simplification, a translation, formula recognition, a question to the Tutor, dictation.

5.2 In every case we send to the provider carrying out the task only what the feature needs: the text of the document or of the part concerned, the image, the audio to be transcribed, your request and, for the Tutor, the relevant passages and the current conversation. The provider processes this data and returns the result to us.

5.3 For YouTube videos we send to the transcription services only the public address of the video, not your data; in some cases the AI provider (Google) fetches the public video itself to transcribe it. When you import a web page, our servers download it from the address you give.

5.4 We do not use your Materials to train models. According to the API terms of use of the providers we use, they do not use this data to train their models and keep it for a limited period, for security and abuse-prevention purposes (section 8).

5.5 Artificial intelligence Outputs may contain errors: see the Terms of Service, section 6.

6. Where the data is stored

6.1 Data is stored on Amazon Web Services, in the Europe (Ireland) region. Text recognition (OCR) and the sending of e-mails take place in the same region. The web application files, that is the code the browser downloads, which contains no personal data, are distributed through the Amazon CloudFront network, which has nodes worldwide.

6.2 Part of the data is also stored in your device's browser (section 11 and the Cookie Policy; in ReBrayn: Settings › About).

6.3 Some of the providers in section 7 are based or have servers outside the European Economic Area, in particular in the United States. In these cases the transfer takes place on the basis of the European Commission's adequacy decision for companies participating in the EU-U.S. Data Privacy Framework or, failing that, the standard contractual clauses approved by the Commission (Article 46 GDPR). You can ask us for a copy of the safeguards adopted.

7. Who we share data with

We do not sell data and we do not disclose it to anyone for their own marketing purposes. We share it only with:

7.1 Providers that process it on our behalf (processors, Article 28 GDPR), bound by contract:

• Amazon Web Services: servers, storage, database, authentication, OCR, sending service e-mails and contact-form messages, logs, app delivery and firewall; receives all the service's data, the IP address and request data; Ireland (EU), with the worldwide CloudFront network for app delivery.
• OpenAI: Tutor, explanations, examples, simplifications, translations, document indexes, search index, dictation (fallback); receives the text of the parts concerned, images attached to the Tutor, the conversation, requests and the dictation audio; United States (for dictation, European Union); transfer safeguards: section 6.3.
• Google (Gemini API): summaries, questions, explanation of images and formulas, dictation, transcription and structure of lessons and videos, document indexes; receives text, images and crops, audio, transcripts and the address of YouTube videos; United States / global; transfer safeguards: section 6.3.
• Groq: transcription of uploaded audio and video; receives the audio; United States; transfer safeguards: section 6.3.
• Perplexity: explanation of a term; receives the term and the surrounding text; United States; transfer safeguards: section 6.3.
• Mathpix: formula recognition; receives the image of the formula; United States; transfer safeguards: section 6.3.
• Apify, Supadata: subtitles of YouTube videos; receive only the public address of the video; [● location of the Apify and Supadata servers].
• Stripe: payments and subscriptions; receives the e-mail, the customer and subscription identifiers and the payment data you enter on the Stripe page; [● Ireland / United States].
• Google Workspace: support mailbox; receives the e-mails you send us and the contact-form messages; [● location of the Google Workspace servers].

7.2 PayPal is an independent controller of the data of your PayPal account, if you choose to pay with PayPal.

7.3 YouTube (Google): when you open a YouTube video in ReBrayn, the video player is loaded from YouTube's servers, which receive your IP address and may use their own cookies according to their rules (Cookie Policy).

7.4 Whoever receives your sharing link: anyone who has the link and a ReBrayn Account sees what you chose to share and can import a copy of it (Terms of Service, section 10).

7.5 Advisers (for example accountants and lawyers) bound by professional secrecy, and public authorities when the law requires it.

You can ask us for the up-to-date list of processors.

8. How long we keep the data

• Account, Materials, Outputs, search index, settings, questionnaire, Plan usage data, acceptance of the Terms: as long as you have the Account; when you delete it, we normally delete them within minutes (at most within [● 30 days]).
• E-mail address and choice about news and offers e-mails: until you withdraw your consent or delete the Account.
• Files and earlier versions of files that you delete or replace during use: [● until the Account is deleted / ● days].
• Temporary copies created while processing files (OCR, conversion of Office documents, web pages, transcripts): from 7 to 49 days, depending on the type.
• Backup copies (database and search index backups): up to 35 days, then overwritten; if we had to restore one, we repeat the deletions already made.
• Technical service logs: 30 days.
• Technical events sent by the app: up to 7 days.
• Technical history and traces of processing (state machines, media-processing traces): up to 90 days; traces as set by AWS [● 30 days].
• Aggregate operating statistics, not referring to persons: up to 15 months.
• Receipt of the Account deletion (Account identification code, dates, outcome; without e-mail, name or content): 400 days, to prove that we deleted the data and to prevent a restore from bringing it back to life.
• Payment and billing data: 10 years, at the payment providers and in our accounting, by legal obligation (Article 2220 of the Italian Civil Code).
• E-mails with support and contact-form messages, in ADC's mailbox: [● 24 months] from the last message.
• Contact-form anti-abuse counter: at most 2 days, then deleted automatically within a few more days; backups of the counter last 1 day. The AWS firewall keeps a sample of request data, including the IP address, for at most 3 hours. If a message cannot be delivered, AWS's delivery notice (with the subject, which contains your name, and the reply address) is copied to ADC's operations mailbox and kept there for the period stated above for e-mails.
• Data received by the artificial intelligence providers: according to their terms: up to 30 days for OpenAI and up to 55 days for Google; [● retention periods of Groq, Perplexity and Mathpix].

9. Account deletion

You can delete the Account from the app (Settings › Account › Delete account). You lose access at once on this device and, within a few minutes, on devices already signed in; normally within minutes (at most within [● 30 days]), we delete the Account, the Materials with all their versions, the Outputs, the search index, the settings, the questionnaire, the usage data, the acceptance of the Terms and the copy kept in the browser of the device from which you delete. Only the following remain: the deletion receipt, backups until they expire, technical logs and technical queues until they expire (at most 90 days), the data that the payment providers and we must keep by law, and the data already received by the artificial intelligence providers until the expiry stated in section 8. The copies that other people have already imported from one of your sharing links are in their Accounts and are not deleted. If you have an active subscription, you can delete the Account once the period already paid has ended.

10. Security

We protect the data with technical and organisational measures appropriate to the risk, including: HTTPS connections between the app and our servers; AWS-managed encryption for the databases and the file store, which is not publicly accessible; access to data only after authentication and only to one's own Account; technical logs without the content of materials; test environments separate from the live service; [● organisational measures on staff access]. The Office documents you upload are converted to PDF on our servers with LibreOffice, with macros, active content and external links disabled, in a separate working folder for each conversion, without credentials to our systems and with a time limit after which the conversion is stopped.

11. Data stored in the browser

The app stores in your device's browser (local storage and IndexedDB) what it needs to work: the sign-in session, a copy of your data to work faster and not lose changes when the connection is missing, preferences, operations waiting to be sent. We do not use profiling cookies or third-party analytics tools. The details are in the Cookie Policy.

12. Minors

ReBrayn is reserved for people who are at least 14 years old. People under 18 may buy a paid Plan only through a parent. If you are a parent and you think that a child under 14 has created an Account, write to us and we will delete it.

13. Your rights

You have the right to:

• know whether we process data about you and receive a copy of it (access, Article 15);
• correct or complete it (rectification, Article 16);
• obtain its deletion (Article 17), also on your own by deleting the Account;
• ask for its restriction (Article 18);
• receive it in a structured, commonly used and machine-readable format and transmit it to another controller (portability, Article 20), also on your own with the app's export function (which today includes the files already downloaded to your device);
• object at any time, on grounds relating to your situation, to processing based on legitimate interest (Article 21);
• withdraw at any time a consent you have given us, without affecting the processing already carried out.

To exercise them, write to info@rebrayn.ai: we reply within one month. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the European Union country where you live or work.

14. Changes

If we change in a substantial way how we process your data, we notify you in the app or by e-mail before the changes apply. The date of the latest version is shown at the top.