Privacy Policy

NewBrains HQ is run by NewBrainsAI, a US company. For the data of your account we are the controller: we decide how it is used, as this policy describes.

For anything about the people who talk to your chatbot, you are the controller and we process it for you, only to run your chatbot.

For any privacy question or request, email [email protected]. This policy covers HQ. Our website has its own policy at newbrainsai.com/privacy.

• Your account email and your settings, such as your time zone and the labels you give your systems.
• The keys you give HQ to reach your systems, and your AI key, each stored locked, with the permission you chose for each workflow.
• The status of each system and counts per hour, for example how many chats, leads, runs and faults.
• Your hosted chatbots and their versions: the greeting, the questions, the calendar link, the alert email, your website address and the address of your Google Sheet.
• The documents you upload for a chatbot, and the pieces of text made from them and from your website.
• Department and role titles from your organigram, and which one reports to which.
• Billing records: the reference numbers our payment provider gives your plans and payments, and the amounts. Never your card details.
• A record of what you accepted and when, such as the terms and the declaration for a document.
• A list of background jobs, and a delivery log that says whether something we sent arrived. The log holds no content and no recipient.
• Invitations, and the email address of anyone who joins the waitlist.
• If you connect a messaging app for alerts: the chat reference or the locked alert link it gives us.

• The text of a message, from a visitor or from a chatbot.
• Anything a visitor types into a chat window, including the contact details of a lead.
• Names. HQ has no field for a name: not yours, not your staff's, not your customers'.
• Call transcripts and call recordings.
• Organigram files.
• IP (internet protocol) addresses.

HQ also takes no health data: a document that holds health data or personal data is refused before it is stored.

A chatbot must read a message to answer it. The conversation text is read to answer and never saved: not in a history, not in a log and not in a backup. We use no error report service, because a report could carry a visitor's message.

While a conversation runs, its text lives only in the visitor's browser and in the memory of our server for the time one answer takes. To write the answer, the message and the matching pieces of your content go to an AI model provider: the one you chose, on your own key, for a live chatbot, and our own for the free test of 20 conversations.

What we keep about conversations is counts per hour, and nothing else.

When a visitor leaves contact details, the chatbot sends them straight to your own email and your own Google Sheet. Leads are not kept by us: HQ stores only a random reference and whether each delivery worked.

A lead that cannot be delivered is not stored either. The chat window tries again for a few minutes from the visitor's browser, then shows the visitor your contact address, and HQ tells you that one lead could not be delivered.

Before each upload you declare that the file holds no health data and no personal data, and HQ screens it for both. A file that is refused is never stored.

An accepted document is kept in private storage that only your account can read, and it is cut into small pieces of text that your chatbot searches. HQ also reads the public pages of the website address you give it, up to 200 pages, and keeps pieces of their text in the same way. The pieces are used for your own chatbot only.

You can download the documents you uploaded, and you can delete them. When you delete a document, the file and the pieces made from it are deleted from HQ, and the copies in our nightly backups are gone within 14 days.

If you build your office from an organigram, the file is read once, in memory, and it is never saved. HQ shows you the department and role titles it found, and stores titles only, with their reporting lines, after you confirm them. It stores no staff names, and the confirm screen asks you to remove any name that slipped into a title.

A spreadsheet is read by our own code. A PDF (portable document format) file or a picture is read once by our own AI model provider.

Every key is stored locked, which means encrypted, and is never sent back to your browser. When you remove a key we delete it from HQ at once; locked backup copies are gone within 14 days.

What we tell you when you connect n8n holds for every connected system: "Your workflows and your customers' data stay in your own n8n. HQ keeps only your access key (locked), the status of each workflow and counts. It never copies messages, names or files."

From a voice agent account HQ reads the agents and the call counts only, never a recording or a transcript.

Payments are taken on our payment provider's own page. Your card details go to the payment provider only: we never see or store your card number.

We store the reference numbers the provider gives your plans and payments, and the amounts. A payment notice from the provider is kept by its reference and its type only, never with its content.

Your password is kept by our login provider in a form that nobody can read, including us. HQ keeps your recovery codes in a form that nobody can read either.

The login provider keeps its own sign-in records. HQ does not pass it your IP address or the details of your browser, so those records show the address of our server, not yours. We do not put those records in our backups.

HQ stores no IP address, and its logs remove them. To limit abuse, a scrambled form of an address is held in the memory of our server only, and it is gone at every restart.

On the sign-up and waitlist forms, the service that checks that a form is sent by a person receives your IP address.

HQ sets one sign-in cookie, which keeps you signed in. It sets no advertising or tracking cookies.

Two steps are run by other services, which may set cookies of their own that the step needs: the check that a form is sent by a person, and the payment page.

These kinds of companies process data for us, each under its own data protection terms:

We share data with nobody else, except where the law requires it. We do not sell data.

We are a US company, and the companies that process data for us may do so in the United States and in other countries. They protect data that comes from the UK and the EU under their data protection terms, including standard contractual clauses where those apply.

Our own AI model provider runs its servers in China. What reaches it: what you type in a free test and the pieces of your content that match, a PDF or picture organigram you ask HQ to read, and the labels, status codes and counts behind an explanation or an improvement note. A live chatbot uses the AI company you chose, on your own key.

• Status history and counts: 7 days on the Free plan, 90 days with Premium.
• A removed key: deleted at once. The record of the removed connection is deleted 7 days later.
• Nightly backups: 14 days.
• Finished background jobs: 30 days.
• Your account, settings and chatbots: until you ask us to delete the account.
• Your documents: until you delete them, or until the account is deleted.
• Payment records: as long as tax law requires us to keep them.
• A waitlist email address: until you ask us to remove it.

This part is for buyers in the UK and the EU, under the UK General Data Protection Regulation and the EU General Data Protection Regulation.

Running your account, your systems and your plans is what you asked us to do under our Terms of Service. Keeping payment records is a legal obligation. Protecting HQ from abuse and keeping backups are our legitimate interests in running the service, and you can object to them.

Under data protection law you can ask us to:

• give you a copy of the personal data we hold about you
• correct it if it is wrong
• delete it
• limit how we use it, or stop using it
• send it to you in a format another service can read

Email [email protected] and we reply within 30 days. You can also complain to your data protection authority, for example the Information Commissioner's Office in the UK.

If you talked to a chatbot on the website of a business, that business decides what happens with your details, so ask it first. We hold no copy of your messages or of your details.

Everything travels over an encrypted connection. Each account can read only its own data, and the database itself enforces that. Signing in can also ask for a code from an authenticator app, which we recommend. Keys and backups are stored locked.

HQ is for businesses and is not meant for anyone under 16. We do not knowingly collect their data.

When we change this policy, the date at the top changes too. If a change affects how we use data you have already given us, we tell you by email before it applies.