LESSThis Privacy Policy is incorporated into, and forms part of, the Brainsless Terms of Service. It describes how Planless Inc. ("Company," "we," "us") collects, uses, discloses, and retains data in connection with the Brainsless service (the "Service").
1. Roles
1.1 With respect to account, billing, security, and website-usage data, Company acts as the controller (or, where CCPA terminology applies, the business).
1.2 With respect to Customer Content submitted by a business customer, including code, prompts, logs, traces, and transcripts, Company acts as that customer's processor or service provider. The customer remains responsible for lawful basis, notices to its own end users, and instructions to Company regarding that data.
2. Purpose limitation
Company processes data only as necessary to provide, secure, support, and maintain the Service for the account under which the data was submitted; to operate the billing and account relationship; to comply with legal obligations; and, in narrowly aggregated or de-identified form, to diagnose defects and improve the reliability, performance, and usability of the Service. Company does not process personal data or Customer Content for any purpose beyond those stated in this Policy.
3. Data collected
3.1 Account data. Email address, display name, authentication provider, and organization, collected to authenticate and administer an account and to communicate with Customer.
3.2 Repository and application data. Repository identity, branch and commit reference, and the source code necessary to locate and characterize an AI-driven code path, including prompt text, tool schemas, tests, and dependency manifests, collected to read Customer's system, construct a World, generate test cases, and diagnose behavior.
3.3 World and execution data. The working copy underlying an active World, an inventory of referenced environment variable names, transcripts, tool invocations, case results, and diffs, collected to operate the simulation, reproduce findings, and support review. Where Customer supplies a database connection variable, the Service opens a read-only session with it once, during the raise, and copies the schema and a bounded number of rows per table into a database inside that World's sandbox; the copied content remains inside the sandbox for the operational life of the World and is not retained by Company, which receives table names and row counts only.
3.4 Production telemetry. Where Customer elects to connect an observability integration, scoped trace data in accordance with the OpenTelemetry or OpenInference conventions, including request and outcome attributes and, only if Customer separately enables content capture, redacted conversation content, collected to compare simulated and observed behavior.
3.5 Billing and usage data. Plan, job counts, model identifiers, token totals, and computed or contracted cost, collected to meter usage, invoice, and detect anomalous usage.
3.6 Security and audit data. Authentication events, consent records, access to secrets, and administrative actions, collected to prevent abuse, investigate incidents, and demonstrate that a change was authorized.
3.7 Product usage data. Where consented in accordance with the Cookie Policy, or where processed as strictly necessary for the operation and security of the website (including a visitor who has not created an account), Company collects the page or screen viewed, a named feature interaction, elapsed time and scroll engagement on a page, referring page origin, marketing campaign parameters appended to a link Customer or visitor followed, coarse device and browser category, and a pseudonymous session or device identifier. This category does not include the content of any form field, any source code, any prompt or transcript text, or any credential.
4. Sources of data
Company receives data directly from Customer and its Authorized Users; from source-code hosting and identity providers Customer connects; from telemetry endpoints Customer configures; from Company's infrastructure providers in the ordinary course of operating the Service; and, subject to Section 3.7, from a visitor's interaction with Company's website. Company does not purchase personal data from data brokers.
5. Use of data; no sale
5.1 Company uses the data described in Section 3 to provide and secure the Service, operate Worlds, generate and evaluate test cases, calculate and collect fees, provide customer support, comply with law, and improve the reliability and functionality of the Service, including by identifying and correcting defects.
5.2 No sale of personal information; no third-party advertising. Company does not sell personal information, as that term is defined under applicable law, and does not share personal information for cross-context behavioral advertising. Company does not permit any subprocessor to use Customer Content or personal information for that subprocessor's own advertising purposes.
5.3 Aggregated and de-identified information. Company may compile and use information in aggregated or de-identified form, from which no individual or specific customer's Customer Content is identifiable, to operate, secure, and improve the Service.
6. Legal bases
Where the General Data Protection Regulation or a similar law applies, Company processes personal data to perform a contract with Customer, to pursue Company's legitimate interest in providing and securing a business-to-business service, to comply with a legal obligation, or, for optional website analytics, on the basis of consent, which may be withdrawn at any time through the mechanism described in the Cookie Policy without affecting the lawfulness of processing before withdrawal.
7. Retention
7.1 Account and billing data is retained for the duration of the account relationship and thereafter as required to satisfy tax, accounting, dispute, and other legal obligations.
7.2 The working copy underlying an active World is retained only while that World's execution environment exists and is deleted upon termination of the World. Company does not currently create persistent backup snapshots of a World.
7.3 Test cases, run evidence, and other Customer Content extracted in the course of operating the Service are retained for the duration of the account relationship, unless Customer deletes specific records or an Order Form specifies a shorter period.
7.4 Product usage data collected under Section 3.7 is retained for no more than twenty-five months from collection, sufficient to compare year-over-year usage, and is then deleted or irreversibly aggregated.
7.5 Security and audit records are retained for the period required to satisfy Company's security and legal obligations.
8. Disclosure to third parties
8.1 Company discloses data to service providers that host, secure, authenticate, or otherwise operate the Service on Company's behalf (each, a "Subprocessor"); to professional advisers under a duty of confidentiality; to a successor entity in connection with a merger, acquisition, or sale of assets, subject to that successor's assumption of the commitments in this Policy; and where required by law, subpoena, or other legal process. Company will provide notice before adding a material new Subprocessor where reasonably practicable.
8.2 Current Subprocessors. Google Cloud Platform / Google Identity Platform provides application hosting, the managed database, key management, and authentication, and processes account data, Customer Content, and encrypted service data, primarily in the United States (us-central1). Cloudflare, Inc. provides DNS, TLS termination, content delivery, rate limiting and abuse mitigation, static hosting, bot verification, and the isolated sandbox runtime underlying a World, processing network and request metadata, sign-up verification data, and the working copy of Customer's application while a World is active, at Cloudflare's global edge. Fireworks AI, Inc. provides model inference used for extraction, simulation, judgment, and Sandy's proposed changes on Company's platform tier, and receives the specific code-derived context, prompt text, case context, and transcript content necessary to process the individual request submitted to it, in the United States. GitHub, Inc. provides repository authorization, content retrieval, and pull-request creation through Customer's installation of Company's application, and processes account identity, repository metadata and content, and any patch Company proposes, under GitHub's own terms. Where Customer configures a bring-your-own-key integration with a provider of Customer's choosing, that provider processes data under Customer's own agreement with it and is not a Subprocessor of Company for that traffic.
9. International transfers
Data may be processed in the United States and in other countries where Company or a Subprocessor operates. Where a transfer from the European Economic Area, the United Kingdom, or Switzerland requires a safeguard under applicable law, Company relies on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.
10. Security
10.1 Executing Customer's application requires reading and running Customer's source. Upon authorization, the Service reads the selected repository at a specified commit and provisions a tenant-scoped working copy inside an isolated sandbox to run it. That working copy is accessible only to the account that owns it, exists only for the operational life of the sandbox, and is destroyed when the sandbox is terminated; Company does not currently create or restore a persistent backup of it.
10.2 A credential Customer submits to the Service is encrypted under a key unique to Customer's account, itself protected by a hardware-backed key-management root, with each credential further wrapped by its own key bound to its specific record. Plaintext exists only inside the runtime process authorized for the declared operation at the moment of use, and never in a log. Deleting the account destroys the account-level key, rendering every credential under it permanently unrecoverable.
10.3 Every record produced by the Service is bound to the account and repository under which it was created and is not accessible from another account. A World is reached through an authenticated runner and is not exposed on a public network port. Session cookies are issued host-only, HttpOnly, and Secure, and account creation by password is accepted only after server-side bot-mitigation verification.
10.4 Company maintains administrative, technical, and organizational safeguards appropriate to the nature of the data processed, including encryption of data in transit, tenant-scoped access controls, audit logging, and a requirement of human review before any code change is deployed to a production system. No security control eliminates all risk. Report a suspected vulnerability to [email protected]; do not access another customer's data or degrade the Service in the course of testing. Additional detail on Company's monitored controls and policies is available at Company's independently hosted trust portal, trust.brainsless.com.
11. Individual rights
Subject to applicable law, an individual may have the right to request access to, correction of, deletion of, or a copy of their personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. Requests may be submitted to the address in Section 14 and will be verified before being honored. Where Company processes data as a processor on behalf of a business customer, Company will refer the request to that customer and provide reasonable assistance. Company does not discriminate against any individual for exercising a privacy right.
12. Children
The Service is not directed to, and is not knowingly made available to, individuals under eighteen years of age. A customer whose own product is directed to children remains solely responsible for obtaining any parental consent and complying with any child-directed privacy law applicable to its own end users; Company does not accept submission of a child's personal data through a self-service account.
13. Changes to this Policy
Company may revise this Policy from time to time. A material revision will be identified by a new effective date and, where required by law, by additional notice before the revision takes effect.
14. Contact
Planless Inc. — [email protected].