Who we are
Brainmox is operated by CloudAid Inc., a company registered in Ontario, Canada. Our mailing address is C208B - 777 Bay Street, Toronto, Ontario, M5G2C8, Canada. For anything in this policy you can reach us at hello@brainmox.com.
Where your data lives
Brainmox is a managed service. Your agent — its conversations, memory, knowledge base, uploaded files, and vault — runs on infrastructure operated by CloudAid, in a data store isolated per customer. If you choose the local runtime option, your agent's hands-on tools (shell, files, browser) run on your own machine and that workspace stays on your device.
What we collect
Your account details (name and email), license and activation signals, and product telemetry (such as crash reports and high-level usage counters). To provide the service, our systems also store the content your agent works with: conversations, memory and knowledge records, uploaded files, and activity logs. If you contact us by email, we keep that correspondence. Payment details are not currently collected through the product because self-serve billing is not shipped.
The waitlist
If you join the Brainmox waitlist at app.brainmox.com/waitlist, we collect your email address, full name and profession, plus anything you choose to add: practice size, state or province, and what you would like help with. We use these details only to confirm your email, manage your place on the waitlist, decide when to invite you, and send your invitation. We do not store your IP address or browser user agent with a waitlist entry. Unconfirmed entries are deleted after their seven-day confirmation link expires. Every waitlist email includes a link that removes you from the list, and you can also ask hello@brainmox.com to delete your entry.
How we collect it
You provide account details when your account is set up on the web, and content when you chat with your assistant, upload files, record voice messages, or connect services such as Google Workspace or Dropbox. Your agent creates further records (memory, knowledge, activity logs, generated files) while it works for you. Telemetry is recorded by our servers and apps as you use them.
How we use it
We use your data only to provide and secure the service: to run your assistant and its tools, to transcribe voice messages and read replies aloud when you ask, to search and recall your saved memory and knowledge, to deliver notifications you enabled, to provide support you request, and to understand aggregate product usage. We do not sell personal information, use it for advertising, or use your content to train shared models.
How we treat your content
Your content is processed only to run the service you've asked for. We do not sell or rent personal information to anyone, and we do not use your content to train shared models. Our staff do not read your conversations except to operate the service or to help with a support request you've made. Vault secrets are stored encrypted and are injected only at the moment a tool executes — they are never sent to language-model providers.
Service providers and third-party AI
To answer you, Brainmox sends the relevant parts of your content from our servers to third-party service providers that process it on our behalf: your messages, files and photos you share, voice recordings, content your agent reads from services you connect, and recalled memory and knowledge. These include AI model providers such as OpenAI, Anthropic and Google (language models, image understanding and generation); OpenAI for voice transcription, spoken replies and search embeddings; TypeSafe for checking answers; web search and page-reading providers such as Exa, which receive the agent's search queries and page addresses; and Cloudflare for hosting and email delivery. Which provider handles a given request depends on the task and can change as we improve the service. Each provider is bound by terms that limit its use of your data to providing the service to us, prohibit using it to train their models, and require protection of user data at least equal to the protection described in this policy and required by the App Store Review Guidelines. Some providers process data outside Canada, including in the United States. Encrypted-vault values resolve only for eligible tool execution and are never included in model calls. Brainmox does not generally detect and remove sensitive text pasted into prompts or present in ordinary tool content, so credentials should be stored in the vault rather than entered into conversation.
Google user data
If you connect a Google service (Gmail, Calendar, Drive, Docs, Sheets, Contacts or Tasks), each connection is one Google account and one service at the access level you choose: Read-only, Draft (Gmail only: read and compose, never sends), Selected files (Google Drive only) or Full. We request only the permissions that service and level need.
What we access and why. Your assistant reads, and with your chosen access level creates or changes, data in the connected service only to carry out what you ask it to do — for example, finding an email, checking your availability, adding a calendar event, or editing a spreadsheet you link in chat. For Google Drive, you choose how much it can reach: with Selected files, your assistant can see only the files you pick in Google's file picker and the files it creates; with Read-only or Full, it can see your whole Drive, and Full also lets it create, change and delete files.
How it is stored. The access token Google issues is stored on our servers, linked to your agent. Content your assistant reads from Google can become part of that conversation's history and activity log, retained and deleted as described under Retention.
Who it is shared with. To answer you, the relevant content is sent to the AI model providers listed in section 08, under terms that prohibit them from using it to train their models. We never sell Google user data, never use it for advertising, and never use it to develop, improve or train generalized AI or machine-learning models. Our staff do not read it unless you ask us to for support, or it is required for security or by law.
Your control. Remove a connection at any time in Brainmox under Agent settings → Connectors; this deletes the stored token and, once no other Brainmox connection uses that Google account, withdraws Brainmox's access in your Google Account. You can also revoke Brainmox's access in your Google Account at myaccount.google.com/permissions.
Brainmox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
The Brainmox iPhone app
The iPhone app connects to an existing Brainmox account; accounts are created and managed on the web. Before anything you type, photograph, attach or record on an iPhone is sent to your assistant, the app explains what is shared and with whom and asks your permission. Granting it covers messages, photos, files, voice recordings for transcription, and replies you choose to hear aloud. You can withdraw it at any time in Settings → How your data is used; chat then stays unavailable on that iPhone until you allow it again. The app also registers a push-notification token for replies, which it removes when you sign out. Sign in with Apple, if you use it, shares only your Apple ID identifier and the email Apple provides (which may be a private relay address) and is used only to sign you in.
Analytics
Brainmox.com uses self-hosted analytics from analytics.cloudaid.net for marketing-site pageviews and conversion events. The account signup and onboarding flow at app.brainmox.com sends only four limited funnel milestones: invitation-code validation, completed signup, agent hire, and completed runtime setup. Product events contain a query-free page path and fixed step labels; they do not contain the invitation code, OAuth token, name, email, account or agent identifier, prompts, messages, files, or other account content. We do not use third-party advertising pixels or session replay. Browser or network controls may block analytics without preventing access to the site or product.
Your rights
You can contact hello@brainmox.com to request access to, correction of, or deletion of personal data associated with your account, including closing the account. We verify requests and respond according to applicable privacy law; some data may need to be retained for security, legal, accounting, or backup purposes. You can withdraw permission for the iPhone app to share your content at any time in its Settings; withdrawing consent stops future sharing from that device but does not delete data already processed. When an account is deleted, any Sign in with Apple link is revoked with Apple.
Retention
Account and service data are retained while the account is active and as needed afterward for deletion processing, backups, security, support, and legal or accounting obligations. Agent deletion removes the active agent runtime and data. We do not currently publish one fixed period for every backup, correspondence, and analytics record; contact hello@brainmox.com for an account-data or retention request.
Security
We follow the practices outlined in our Security page, including encryption in transit, encrypted vault storage, per-agent tool permissions, and hardened shell execution. No system is perfectly secure; we disclose incidents promptly.
Children
Brainmox is a professional tool and is not directed to children under 16. We do not knowingly collect information from children.
Changes
If we materially change this policy, we'll update the date above and notify account holders by email before the change takes effect.
Contact
CloudAid Inc., C208B - 777 Bay Street, Toronto, Ontario, M5G2C8, Canada · hello@brainmox.com · +1-647-578-8440