BrainCalData controller
BrainCal’s publisher (see the legal notice). Data is hosted in France by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (www.ovhcloud.com).
Data processed and purposes
- Account: name, email address, encrypted password (or Google ID if you sign in with Google), time zone and preferences, email verification code. Purpose: create and secure your account. Basis: performance of the contract.
- Calendar and tasks: events, tasks, projects, documents, working hours. Purpose: display your calendar and schedule your tasks. Basis: performance of the contract.
- Subscription: chosen plan, trial and renewal dates, Stripe customer ID (never your card number). Purpose: manage the subscription and billing. Basis: performance of the contract; invoices kept as required by law.
- Connected calendars: .ics links and iCloud, Google or Outlook access (encrypted), synced events. Purpose: synchronization. Basis: performance of the contract.
- Bookings: name, email address and answers of people who book a slot through your links. Purpose: create the meeting and notify participants. Basis: performance of the contract.
- Meeting notes: audio recordings, transcripts and summaries. Purpose: produce the minutes and tasks. Basis: performance of the contract.
- AI assistant: messages exchanged with the assistant. Purpose: answer and suggest actions. Basis: performance of the contract.
- Security: IP address and short-lived technical logs, the type of device you’ve already signed in with (browser and system, as a fingerprint). Purpose: preventing abuse and emailing you when you sign in from a new device. Basis: legitimate interest.
Recipients and processors
- OVH (France): hosting and backups.
- Stripe: subscription payments, only if you subscribe. BrainCal never sees or stores your card number.
- Scaleway (France): sending emails (verification code, password reset, security alerts, subscription updates, team invitations, booking confirmations and reminders, meeting notes).
- OpenAI, via Codex: assistant answers, project plans and meeting summaries. Only the excerpts needed for each request are sent; they are not used for advertising. This provider may process data outside the European Union, under appropriate safeguards (standard contractual clauses).
- Google, Microsoft, Apple: only if you connect their calendar (or sign in with Google), to sync your events.
- Providers of your .ics links: BrainCal regularly downloads the calendars you add by link.
- Cloudflare: domain name resolution.
- Browser notification services(Google, Apple, Mozilla or Microsoft depending on your device): only if you turn on notifications, to deliver them to your device. Their content is end-to-end encrypted: these services can’t read it.
Audio recordings are transcribed on BrainCal’s server. No data is sold or used for advertising.
Retention periods
Your data is kept as long as your account exists and deleted when it is deleted (backups are overwritten within 30 days). A meeting recording is deleted with the meeting. Technical logs are kept for at most 30 days.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. You can edit your information and delete your account directly from the settings, and exercise your other rights by contacting the publisher (see the legal notice). You can also lodge a complaint with the CNIL (www.cnil.fr).
Cookies
See the cookie policy.