Privacy Policy
This Privacy Policy ("Policy") explains what information Cerebra AI collects when you use cerebra-ai.tech and our Telegram bot (together, the "Service"), why we collect it, who we share it with, how long we keep it and what rights you have. We wrote it with the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), in mind.
The short version. You upload business files. We send their text and tables, as uploaded and without anonymisation, to AI model providers in the USA (Anthropic's Claude models, reached through an API gateway provider) to write your report. Uploaded files are deleted within 12 hours (up to 72 hours for a paid order that has not been delivered yet). We do not sell your data, do not use it for advertising and do not train AI models on it. Card payments are handled by third-party payment processors; we never see your card details.
We accept your files and business description only after you tick "I have read the Privacy Policy and agree to the processing of my data" on the upload form. The time of the tick and the version of the documents are stored with your order. If you do not agree, please do not upload data.
1. Who We Are
The Service is operated by, and the controller of your personal data is:
Cerebra AI, run by an individual registered as self-employed
(professional income tax regime) in the Russian Federation
Email: info@cerebra-ai.tech
Write to this email for any privacy question or request. We answer within 30 days.
2. What Data We Collect
We try to collect only what is needed to produce and deliver your report and to keep the Service working.
2.1 Data you give us
- Uploaded files - spreadsheets, accounting exports, financial statements, Word documents, text files and PDFs with text. Photos and scans are not accepted at the moment.
- Form data - business niche, business size, chosen plan, your main problem or question and, on the Almost Free plan, the business figures you type in.
- Messages and files you send to our Telegram bot, and your Telegram account ID, which the bot needs to deliver the paid report.
- Emails you send us, including your email address and anything you write.
Please remove personal data of other people (names, phone numbers, emails, ID numbers, bank details) from your files before uploading. The analysis works on figures and business metrics and does not need it.
2.2 Data collected automatically
- IP address and browser data (user agent) - processed by our server to keep the Service secure, limit repeated unpaid orders and block abuse.
- Visitor ID - a random ID created in your browser, the date of your first visit (used for the launch discount window), the traffic source (for example the referring site or a utm tag) and a referral code if you came through a referral link.
- Usage statistics - our own first-party statistics: click positions on the page as percentages of the page size (no text you type, no form values), scroll depth, time the page was active, device type (mobile or desktop) and page path. We do not use Google Analytics, Meta Pixel or any other third-party analytics or advertising tools.
- Order data - order number, plan, order status and technical logs of the report build.
2.3 Payment data
Payments are handled by third-party payment processors (section 5). We receive a payment confirmation, the order number, the amount, the currency, the payment method type and the payment time. We do not receive or store full card numbers or CVV codes.
2.4 What we do not collect
- We do not ask for your name, phone number or email to use the Service. You give us your email only if you write to us.
- There are no user accounts or passwords.
- We do not ask for special categories of data (health, religion, political views and similar). Please do not upload them.
3. How Your Files Are Processed
- Your file is received over an encrypted HTTPS connection and stored on our server until the deadlines in section 7.
- Our software extracts text and tables. Before you pay, you see a "What we read" screen with the result.
- The extracted text and tables, your form answers and our instructions are sent to AI language models (section 5). We do not anonymise or pseudonymise your files: the content goes to the model providers as uploaded.
- The models write the report sections. Our software checks the figures against your files and builds a PDF.
No person reads your files unless you write to us and ask us to look into your order, for example to rebuild a report. We do not train AI models on your data and never publish it. Model providers process data under their own terms, and we cannot control how long a provider keeps a request (see section 5).
Automated processing. The report is produced automatically, but it does not make any decision about you that has legal or similarly significant effects. It is information for you to read; you decide what to do with it.
4. Why We Use Your Data and on What Legal Basis (GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Producing and delivering your report, handling your order and payment | Files, form data, order data, Telegram ID, payment confirmation | Performance of a contract (Art. 6(1)(b)) |
| Sending your files to AI model providers outside your country | Files, form data | Your consent given with the checkbox (Art. 6(1)(a)) and performance of a contract |
| Personal data of other people contained in your files | Whatever your files contain | Your confirmation that you are entitled to share it (section 6), our legitimate interest in providing the service you asked for (Art. 6(1)(f)) |
| Security and abuse prevention | IP address, browser data, visitor ID, visitor cookie | Legitimate interests (Art. 6(1)(f)) |
| Understanding how the site is used and where visitors come from | Usage statistics, traffic source, referral code | Legitimate interests (Art. 6(1)(f)) |
| Answering your emails and requests, handling refunds | Email address, message, order data | Performance of a contract and legitimate interests |
| Tax and accounting records of payments | Payment records | Legal obligation (Art. 6(1)(c)) |
You can withdraw your consent at any time by writing to us. This does not affect processing that already took place. Since files are deleted within hours, withdrawal in practice means we delete whatever is still stored.
5. Who Processes Your Data and Where
We do not run our own AI models. The Service relies on these providers:
| Provider | What it does | Location |
|---|---|---|
| API gateway provider | Receives our request with the text and tables from your files and routes it to the model provider | USA |
| Anthropic (Claude models) | Writes and checks the report sections. The request is served by Anthropic itself or by a cloud platform hosting its models (Amazon Web Services, Microsoft Azure, Google Cloud); the gateway chooses the platform and region | USA, EU and other regions |
| Google (Gemini models) | Image recognition for photos and scans, used only if image upload is enabled. It is currently disabled: photos and scans are not accepted and nothing is sent to Google for this purpose | USA and other regions |
| Hosting provider | Our server, where the site runs and files are stored until deletion | Frankfurt am Main, Germany |
| Payment processor (lava.top) | Accepts card payments (Visa, Mastercard, Apple Pay, Google Pay) and sends us a payment confirmation. Card details are entered on the processor's side | Depends on the processor |
| Telegram | Our bot, which delivers paid reports if you choose delivery in Telegram | Depends on Telegram's infrastructure |
| Google Fonts | Serves the fonts used on the site; your browser sends your IP address to Google when it loads them | USA and other regions |
What is sent to AI providers: text and tables from your files, your form answers and our instructions to the model. Payment data, IP addresses and Telegram data are not sent to AI providers. Under our AI providers' terms some models may store requests or use them to improve their models; we opt out of this where the provider allows it.
International transfers. Your data is transferred to the USA and other countries, which may not offer the same level of protection as your home country. The Service is also operated from the Russian Federation, so the operator accesses order data from there. Where a provider offers standard contractual clauses or similar safeguards in its terms, the transfer relies on them. Otherwise the transfer is necessary to provide the service you asked for (GDPR Art. 49(1)(b)) and is based on your explicit consent given with the checkbox (Art. 49(1)(a)). If you do not want your data transferred this way, please do not upload it.
6. Sharing Your Data
We share data only with the providers listed in section 5, and with authorities if the law or a valid court order requires it. We do not sell your personal data and do not share it for cross-context behavioural advertising (as these terms are defined in the CCPA/CPRA). We do not share it for anyone's marketing.
6a. Data about other people in your files
Business files often contain data about other people: names and salaries of employees, customers, suppliers and their contacts. By ticking the consent box you confirm that you are entitled to share this data with us for the analysis. We use it only to produce your report, never contact these people, share it only with the providers in section 5 and delete it together with your files (section 7). We recommend removing it before upload.
7. How Long We Keep Data
A cleanup job runs every 30 minutes and enforces these deadlines:
- Uploaded files: deleted once you download the report on the site or receive it in Telegram, and in any case within 12 hours of upload. Exception: for a paid order whose report has not been delivered yet, files are kept while the order is processed and for up to 72 hours, so the report can be rebuilt.
- Order record (business description, figures from the form): 12 hours; paid order: 72 hours.
- Generated reports: 72 hours after the report is ready.
- Report number-check logs and files sent to the Telegram bot for a rebuild: 72 hours.
- Intermediate report sections: deleted right after the PDF is built; if the build did not finish, they are deleted at the next scheduled restart of the Service once they are older than 24 hours.
- Visitor ID (first visit date, for the discount window): 60 days; visitor cookie: 30 days.
- Event log without file contents: events 90 days; per-order cost lines: no automatic deletion.
No automatic deletion currently applies to: IP addresses that received a free report under the former free plan, the IP list used to count visitors, the log of suspicious uploads, anonymous click data, technical error logs, Telegram bot data and payment records. We delete them on request, except payment records we must keep for income and tax accounting.
AI providers keep requests under their own terms (section 5); our deletion deadlines apply to our server.
8. Your Rights (EEA, UK and similar laws)
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy (Art. 15);
- correct inaccurate data (Art. 16);
- delete your data (Art. 17);
- restrict processing in certain cases (Art. 18);
- receive your data in a portable, machine-readable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where you think the law was broken. In the UK this is the Information Commissioner's Office (ICO).
To use any of these rights, email info@cerebra-ai.tech with your order number or the date of your upload. We may ask for details to confirm the request is yours. We answer within 30 days. Because files and reports are deleted within hours, there may be nothing left to delete by the time we receive your request.
9. California Residents (CCPA/CPRA)
- Categories collected in the last 12 months: identifiers (IP address, visitor ID, Telegram ID, email if you write to us); commercial information (orders and payment confirmations); internet activity (usage statistics described in section 2.2); professional or business information contained in your uploaded files. Sources, purposes and recipients are described in sections 2 to 6. Retention is described in section 7.
- No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing data of consumers under 16.
- Sensitive personal information: we do not ask for it and do not use it to infer characteristics about you.
- Your rights: to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (which we do not do); and not to be discriminated against for using these rights. You may use an authorised agent. Send requests to info@cerebra-ai.tech.
10. Cookies and Browser Storage
We use one cookie and some browser local storage. None of it is used for advertising, and no third-party tracking cookies are set.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
cerebra_vs | Cookie (HttpOnly, first-party) | Signed visitor ID. Set when you upload files or start a payment; used to prevent abuse | 30 days |
cerebra_vid | Local storage | Random visitor ID for the discount window and usage statistics | Until you clear it |
cerebra_price_deadline | Local storage | End time of the launch discount shown on the page | Until you clear it |
cerebra_source, cerebra_ref | Local storage | Traffic source and referral code | Until you clear it |
cerebra_rid, cerebra_card_rid | Local storage | Your last order number, so you can get your report if you come back | Until you clear it |
You can block cookies and clear local storage in your browser settings. Uploading files and paying may then not work, and you may not be able to return to an unfinished report.
11. Security
- All traffic to the site is encrypted with HTTPS/TLS.
- Files are processed on our server with restricted access and are deleted automatically (section 7).
- Only the operator has access to the production server.
No system is completely secure. If we learn of a breach that affects your data, we will act as the applicable law requires, including notifying you where required.
12. Children
The Service is for adults running or working in a business. It is not intended for anyone under 18, and we do not knowingly collect data from people under 18. If you believe a person under 18 has sent us data, write to us and we will delete it.
13. Changes to This Policy
We may update this Policy when the Service or the law changes. The current version is always on this page with its date. Orders already placed are processed under the version you accepted on the upload form.
14. Contact
Cerebra AI · info@cerebra-ai.tech