Privacy Policy

The Portal is operated by Braintu Inc., located at 251 Little Falls Drive, Wilmington, Delaware 19808, USA ("Braintu", "we", "us", or "our"). The Portal is multi-tenant: each client is an organization, each engagement a workspace within it, and people belong to organizations with a role of owner, admin, or member. The service is provided in Spanish and English.

Account Users (a client's sponsors and staff, and Braintu's consultants)

For the personal information that relates to your Portal account and your use of the Portal, Braintu is the data controller and the rights in Section 9 apply directly between you and us.

Engagement Participants (the client's own people)

An engagement may gather information from a client's employees: answers to AI-assisted interviews, their role and team, and findings drawn from the client's code and documentation. The client decides to run the engagement and what it covers, so the client is the controller of that information and Braintu is its processor. If you are an Engagement Participant, the client's own privacy notice governs, and your rights run through the client; we will help the client answer them.

From Account Users

• Account information: name, email address, and, if you use Google or Microsoft sign-in, the basic profile those providers share (name, email, avatar). We never receive your password: sign-in is by one-time code or by the provider.
• Organization information: the client organization's name and logo, the engagement workspaces, and each person's role.
• Conversations with the AI assistant: what you ask the AI assistant in the Portal and its answers, kept so you can pick them up on any device. Our support team can read them to help you, for example when you ask to talk to a person.
• Usage information: pages visited, actions taken and technical data (browser, device, IP address, approximate location derived from it) collected through cookies and similar technologies (Section 7).

On the client's behalf (Engagement Data)

• Reference documents: the commercial proposal, reports and other files the engagement runs on.
• Engagement Participant information: where an engagement includes AI-assisted interviews, the participant's name, role, team, contact channel, and the answers they give; where it includes analysis of the client's systems, the code, documentation and metadata the client grants access to, which may incidentally include names of the client's staff.
• Deliverables: the plans, findings, diagnostics and reports the engagement produces.

• To provide and operate the Portal and deliver the engagement.
• To authenticate you, secure the Portal, and prevent abuse.
• To communicate with you about the engagement and the Portal (sign-in codes, invitations, milestone and deliverable notices).
• To improve the Portal and the practice's methods, using information in aggregated or de-identified form that identifies neither a client nor an individual.
• To comply with legal obligations and enforce our terms.

We process Engagement Data only to deliver the engagement, under the client's instructions and the processor terms in our Terms & Conditions and the Engagement Agreement. Interview answers are confidential to the engagement: findings are reported to the client in aggregate and without attribution to individuals unless the Engagement Agreement provides otherwise, and we do not use a participant's answers for any purpose other than the engagement. We do not sell Engagement Data or use it for advertising.

We process Account User information to perform our contract with you and the client, to pursue our legitimate interests in operating and securing the Portal, and to comply with law. Where a client or participant is in Colombia, we apply Ley 1581 de 2012 and its regulations: Engagement Participant data is processed under the client's authorization as controller, and the rights of access, update, rectification, deletion and revocation described in Section 9 apply. Equivalent protections apply in other jurisdictions to the extent their law requires.

The Portal uses strictly necessary cookies to keep you signed in and to secure your session, and product-analytics cookies to understand how the Portal is used so we can improve it. We do not use advertising cookies. You can control cookies through your browser; disabling the necessary ones will prevent sign-in.

We rely on service providers to run the Portal: cloud hosting and database infrastructure, email delivery, sign-in providers (Google, Microsoft), product analytics, and AI model providers used during an engagement. Each acts under contracts that limit its use of personal information to providing its service to us. Our providers operate mainly in the United States; where information is transferred from another country, we rely on the provider's contractual safeguards and on the client's authorization for Engagement Data.

We keep Account User information while your account exists and for a reasonable period afterwards to meet legal obligations and resolve disputes. Engagement Data is kept for the period the Engagement Agreement provides and, at the client's request or when a workspace is archived, deleted or returned; de-identified findings may be kept to improve our methods.

Depending on where you are, you may have the right to access the personal information we hold about you, to correct or update it, to delete it, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent where processing is based on it. Account Users can exercise these rights from their account settings or by contacting us below. Engagement Participants should address requests to their organization, which controls their information; we support the client in answering them. You may also complain to your data protection authority (in Colombia, the Superintendencia de Industria y Comercio).

We protect information with encryption in transit and at rest, tenant isolation enforced at the database level, role-based access, and least-privilege access for our team. No method is perfectly secure; if we learn of a breach affecting your information we will notify you and the client as the law requires.

The Portal is for organizations and their adult staff. We do not knowingly collect personal information from anyone under 18.

We may update this policy from time to time. We will post the updated version on the Portal with a new effective date and, for material changes, notify the client's owners by email.