Privacy policy

Who we are

B.R.A.I.N.E.R. is operated by LUNACAL PRIVATE LIMITED, a company registered in India. LUNACAL PRIVATE LIMITED is the controller of the personal data described in this policy, including the data we receive from Meta, LinkedIn, and X when you connect an account.

Questions about privacy can go to support@brainer.ceo.

Information you give us

We collect what you provide in order to create and run a company workspace:

• Account details: name, email address, and password credentials.
• Billing details, handled by our payment processor — we do not store full card numbers.
• The description of the business you want to build, and everything you write, upload, or approve inside the workspace.
• Messages you send us for support.

Information we collect automatically

When you use the service we record technical and usage data: IP address, device and browser type, pages viewed, actions taken in the product, and timestamps. We use this to keep the service working, to investigate faults and abuse, and to understand which features are used.

Business and customer data you bring

Running a company through the service may involve data about other people — prospects you research, recipients you contact, and customers who buy from you. You remain responsible for having a lawful basis to process that data, and for the accuracy of any contact list you introduce.

For that data we act as a processor on your instructions. We use it to perform the actions you have asked for and do not sell it.

Connected Meta accounts

You can connect your own Meta Business portfolio so the service can run Facebook and Instagram advertising for your company. Connecting is optional and you start it yourself. Inside Meta’s own dialog you choose which business, Facebook Page, and ad account to grant access to, and we hold the access token that grant produces so we can act on that account through Meta’s APIs.

Through that connection we may receive and process:

• Identifiers for the Meta business portfolio you connect.
• The Facebook Pages available to that grant — their names, identifiers, and whether the grant allows us to publish as them.
• Ad account identifiers and metadata: name, currency, time zone, account status, minimum daily budget, and whether a funding source is attached.
• The identifier of the advertising pixel created in your business when you connect.
• The campaigns, ad sets, advertisements, and creatives we create in your ad account, together with their configuration — budget, schedule, and targeting settings such as locations and interests.
• Campaign and advertisement status, including Meta’s review decisions and the reason it gives for refusing an ad.
• Delivery and performance figures for that advertising — spend, impressions, clicks, click-through rate, cost per click, and cost per thousand impressions — by day and per advertisement.
• The access token representing the permissions you granted.

Why we process Meta data

Information reached through Meta’s APIs is used to provide the advertising functionality you asked for, and for nothing else. Specifically, to:

• Let you connect a Meta account and choose which business, Page, and ad account this company advertises from.
• Show you the businesses, Pages, and ad accounts available to that grant, and whether the ad account is in a state that can run advertising.
• Write advertising copy and creatives, and create the campaign, ad set, and advertisements inside your ad account.
• Update budgets, targeting, and configuration, and start or pause delivery, according to the settings and approvals you give.
• Retrieve campaign and advertisement status, including Meta’s review decisions, so you can see and correct what Meta refused.
• Show delivery and performance figures back to you in the product.
• Let the automated parts of the service plan and adjust that advertising within the approval boundaries you set.
• Investigate faults and support requests about the connection.

Acting inside your Meta account

We act in your ad account on your authorisation, and only within it. Which of those actions run on their own and which wait for you is set by you, in the same approval policy that governs every other outward action the service takes.

Anything created in your ad account belongs to you and stays in your account. Meta bills your advertising spend to the payment method on your ad account; it does not pass through us.

Ending a Meta connection

You can end our access at any time, in either direction:

• Disconnect the integration in the product, on the company’s advertising panel. We attempt to pause delivery first, then stop using the connection — after which the service makes no further calls to Meta for that company.
• Remove or deauthorise the app in your Meta Business settings. Meta notifies us through our deauthorize callback, and we mark the connection inactive when that notice arrives.
• Ask us to delete the data, as described on the data deletion page.

What disconnecting Meta does not do

Disconnecting Meta ends our access to that ad account. It does not close your account with us, delete the rest of your workspace, or remove the advertising already created inside your Meta ad account — that remains yours, in your account, for you to keep or delete there.

Deleting the company itself does remove what we hold for it, including the connection record, the access credential, and the advertising data we retrieved.

If you want the data we hold deleted, follow the data deletion instructions at the data deletion page.

Connected social accounts

You can connect your own social accounts — today X, LinkedIn, a Facebook Page, and an Instagram professional account — so the service can post for the company you connect them to. Connecting is optional, you start it yourself, and you authorise it on the network’s own consent screen. What we hold afterwards is the credential that authorisation produces, so we can publish on that account through the network’s APIs.

Posts go out as the account you connected. Where that is a personal profile, they appear under your own name; where it is a LinkedIn Page or a Facebook Page, they appear as that Page; on Instagram, they appear as the Instagram account you connected.

One publishing account is created for your B.R.A.I.N.E.R. account and shared by every company you run inside it. Each company connects at most one account per network, and we record which account belongs to which company so a post is only ever sent to the account for the company it was written for.

LinkedIn data we receive

Connecting LinkedIn gives us access through LinkedIn’s APIs, within the permissions you grant. Depending on whether you connect a personal profile or a LinkedIn Page, we may receive and process:

• Your LinkedIn member identity: the identifier LinkedIn issues for you, your name, and your profile picture where the grant includes it.
• The LinkedIn Pages you administer, where you connect a Page — each Page’s identifier, name, vanity name, and logo.
• The access and refresh credentials representing the permissions you granted, and when they expire.
• The posts we publish for you, their LinkedIn identifiers, and the URL LinkedIn gives each published post.
• Engagement figures for those posts: impressions, unique impressions, clicks, likes, share counts, and the number of comments.
• Where you connect a Page, statistics for that Page: page views and follower statistics.
• Comments left on the posts we published, including the text of the comment and the identity LinkedIn returns for the person who wrote it.

Comments, and other people’s LinkedIn data

Reading engagement on a post means receiving data about LinkedIn members who are not our users and have no relationship with us — the people who comment on what your company posted. It is the only place in this service where that happens, so we treat it narrowly and say exactly how.

We use it for one thing: to show you the engagement on your own posts inside the product, and to publish a reply where you or your company has asked the service to reply. We do not build profiles of those people, do not add them to any contact, prospect, or outreach list, do not use them to target advertising, do not sell or share them, and do not use them to train models.

A LinkedIn member whose comment we hold can write to support@brainer.ceo and ask us to delete our copy of it; we handle that on the same terms as any other deletion request. Deleting our copy does not remove the comment from LinkedIn itself, which only its author or the Page can do.

Facebook and Instagram data we receive

Publishing to a Facebook Page uses Facebook Login for Business, through the Meta app named BRAINER SOCIALS. Publishing to an Instagram professional account uses Instagram Login, through the Meta app named BRAINER SOCIALS - IG. These are separate from the advertising connection described under “Connected Meta accounts” above, and you can use either without the other. Within the permissions you grant, we may receive and process:

• Your basic Facebook or Instagram identity returned at login: your user identifier, name, and profile picture. We do not request your email address, friends, birthday, gender, or any other profile permission.
• The Facebook Pages you manage, including those you manage through a Meta business portfolio, so you can choose which Page to connect — each Page’s identifier, name, and picture. Only the Page you choose is connected.
• For Instagram, the connected account’s identifier, username, name, and profile picture.
• The access credentials representing the permissions you granted, and when they expire.
• The posts we publish for you, their identifiers, and the link Facebook or Instagram gives each published post.
• A comment you wrote yourself and asked us to add to your own post, and its identifier once published.
• Insights for the connected Page or Instagram account and for the posts we published: for example impressions, reach, views, reactions or likes, clicks, saves, shares, the number of comments, post engagement, and follower counts.

We do not read the text of comments that other people leave on your Facebook Page or Instagram posts, or any other content posted by other people; on Instagram we receive only the number of comments on the posts we published. We do not use any of this data to build profiles, target or measure advertising, or train models, and we do not sell or share it.

Why we process social account data

Information reached through a connected social account is used to provide the publishing functionality you asked for, and for nothing else. Specifically, to:

• Let you connect an account and choose which company it publishes for.
• Show you which accounts are connected, and whether a connection still works.
• Write the post, generate an accompanying image, and publish both to the account you connected.
• Show you what was published, whether the network accepted it, and a link to it.
• Show you the engagement that post received, and publish a reply where you have asked for one.
• Publish a comment you wrote on your own Facebook or Instagram post, where you added one before approving the post.
• Show you insights for the connected Facebook Page or Instagram account and the posts we published to it.
• Investigate faults and support requests about the connection.

What we do not do with social account data

We do not sell it, rent it, or share it with anyone other than the processors described below who help us operate the service.

We do not use it to target advertising, and we do not use it to advertise anything other than the company you connected the account to.

We do not use it to train machine learning models, our own or anyone else’s.

We do not use one company’s connected account to publish for another, including between companies you own yourself.

Acting on your connected accounts

We publish on your authorisation and only within the permissions you granted. Which posts go out on their own and which wait for you is set by you, in the same approval policy that governs every other outward action the service takes. A post can also be sent by you pressing a button, in which case nothing waits.

Anything published belongs to you and stays on your account. Removing a post after it has gone out is done on the network itself.

Ending a social connection

You can end our access at any time, in either direction:

• Disconnect the account in the product: open Posts, go to the Accounts tab, and choose Disconnect next to the account. We remove the channel from the publisher, after which the service makes no further calls to that network for that company.
• Revoke the application in the network’s own settings — for LinkedIn, under the permitted services in your account settings; for a Facebook Page, by removing BRAINER SOCIALS under Settings and then Business integrations on Facebook; for Instagram, by removing BRAINER SOCIALS - IG under the apps and websites in your Instagram settings. That stops all further access regardless of what this product holds.
• Ask us to delete the data, as described on the data deletion page.

What disconnecting a social account does not do

Disconnecting ends our access to that account. It does not close your account with us, delete the rest of your workspace, or remove posts already published — those are on your own social account, for you to keep or delete there.

One thing is worth stating plainly rather than leaving you to discover it. Because the publishing account belongs to your B.R.A.I.N.E.R. account rather than to a single company, deleting one company removes the link between that company and the social account it used, but does not by itself revoke the access you granted on the network. If you want that access ended, disconnect the account first, or revoke the application in the network’s own settings.

The waitlist

Before launch, founders can join a waitlist at brainer.ceo/waitlist. It collects less than the product, and it is kept separately from it.

• What you give us: your email address; the code of the founder who invited you, if you joined with an invite link; and anything you choose to send, such as the idea you pitch, the domain or work email you use to verify a business, or the profile and audience numbers you send to the creator fast lane.
• What we record as you use it: when you joined and confirmed your email, the gift boxes you earn and open, the tasks you complete, your daily visits, and the campaign tags (UTM) and referring site you arrived from. Following us on X, LinkedIn, Instagram or TikTok is taken on your word; we don’t check or connect to those accounts.
• To stop abuse: a keyed hash of your IP address (never the address itself), and a Cloudflare Turnstile check when you join.
• Verifying a business: we fetch your company’s homepage or the verification file you publish, or look up your domain’s public DNS records, to find the code we gave you. For a work email, we check that the domain receives mail and send a link to that address.
• Connecting Discord: if you choose to, Discord tells us your Discord user ID and whether you’re a member of our server (the “identify” and “guilds.members.read” permissions). We don’t read your messages, see your other servers, or post as you.
• Creators: we keep the platform, handle and audience numbers you send us. For YouTube channels we read the channel’s public statistics and description through YouTube’s API to confirm the account is yours.

What other people see. A founder who invited you sees a masked version of your email (like “sa••@gmail.com”) and whether you’ve confirmed it. The top-inviters list shows masked emails only. If you share your invite link, its preview shows your first name, taken from your email address, and your place in line. An idea you pitch appears on the public idea wall only if you tick the box to share it, without your name or email; ideas containing links or contact details are held back.

Emails. We send a confirmation email, sign-in links you ask for, an email when someone joins with your invite link (with a link to stop those), and an invitation if you are let in.

Processors. The waitlist runs on Microsoft Azure (hosting and database). Email goes through Twilio SendGrid, the joining check through Cloudflare, and, only if you use them, the Discord connection through Discord and creator checks through Google’s YouTube API.

Keeping and deleting it. We keep waitlist data until it is no longer needed for the launch, and never sell it or use it to advertise. You can delete your spot at any time from the account panel on the waitlist page (tap your initial, then “Delete my spot”), which removes your entry and everything attached to it straight away. Founders you invited keep their own places. You can also email support@brainer.ceo.

How we use information

We use personal data to:

• Provide the service: plan, build, publish, and operate the company workspace you set up.
• Carry out actions you have authorised, and hold back the ones you have not.
• Keep a record of actions taken on your behalf, so they remain reviewable by you.
• Bill you, prevent fraud and abuse, and meet legal obligations.
• Improve the service, and — where required — ask your consent before using your content to train models.

AI processing

The service uses automated systems, including large language models, to produce plans, content, code, images, and outbound messages. Content you provide may be sent to model providers acting as our sub-processors in order to generate those outputs.

Advertising copy and creatives for a connected account are written from your company’s own product, brand, and site information, which is what is sent to those model providers for that purpose.

A social post is generated the same way. The company description, the founding brief you wrote, your website address, and the verified milestone being announced are sent to a model provider to write the post and to generate the image published with it. Data received from a connected social account — engagement figures, and comments left by other people — is not sent for that purpose and is not used to train models.

Automated output can be wrong. Decisions with legal or financial consequences remain subject to the approval boundaries you configure.

Sharing and processors

We share personal data only with service providers who help us run the service — hosting, model providers, email delivery, payment processing, analytics, and error monitoring — each under contract and only for those purposes. Our hosting providers are Microsoft Azure, which runs the service, its database, and its storage in the United States, and Cloudflare, which provides DNS and network delivery. These are also the only providers with access to data we receive from Meta.

Where you connect a third-party account such as Meta or LinkedIn, we use what that platform makes available to us only to provide the functionality you asked for on that account. We do not sell it, and we do not use it to advertise anything other than the company you connected it to.

Social publishing runs on a publishing platform we host ourselves, on our own infrastructure. The credentials for your connected social accounts are stored there — they are not handed to a third-party publishing service, and no such service holds them on our behalf.

We may also disclose data where legally required, to protect our rights or someone's safety, or as part of a merger or acquisition, in which case we will tell you.

Cookies

We use cookies and similar technologies to keep you signed in, remember preferences, and measure usage. You can refuse non-essential cookies without losing access to core functionality; blocking essential cookies will stop the service from working.

Retention

We keep account and workspace data for as long as your account is active, and afterwards only as long as needed for legal, accounting, or dispute-resolution purposes. Action history is retained so it stays auditable. You can ask us to delete your workspace at any time.

For a connected advertising account we keep the connection record, the advertising we created for you, and the delivery figures we retrieved for as long as the integration is connected and the workspace is active. A disconnected connection is kept in an inactive state so the product can show what happened and offer to reconnect.

For a connected social account we keep the connection, the credential, the posts we published, and the engagement we retrieved for as long as the account stays connected and the workspace is active. Comments we received on those posts are kept for as long as the post they belong to.

Deleting a company in the product removes that company and the records attached to it, including any connected advertising account, the stored access credential for it, and the advertising and performance data we held for it. For a connected social account it removes the link between that company and the account, but does not by itself revoke the access you granted on the network — see “What disconnecting a social account does not do” above. Deleting your account removes your account, every company in it, and the publishing account shared between them, on the same terms.

You can also ask us to delete your data, as described on the data deletion page. We complete deletion requests within 30 days. Two things are not edited in place: operational logs, and encrypted backups, which age out on their own cycle — so a copy may persist in them for a period after the live data is gone.

We may keep information beyond that where we are required or permitted by law to — for example for accounting, fraud prevention, or an unresolved dispute.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact support@brainer.ceo.

You also have the right to complain to your local data protection authority.

International transfers

We and our processors handle data in the United States, which may not be the country you are in. Where we transfer personal data out of its country of origin, we rely on an appropriate safeguard such as standard contractual clauses.

Security

We use encryption in transit, access controls, and audit logging to protect data. No service can promise perfect security; if a breach affects your personal data, we will notify you and any regulator as required.

Children

The service is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

If we make a material change we will update the date above and, where the change matters to you, tell you directly before it takes effect.