PeaBrain
PeaBrain LLC
Privacy Policy
Two kinds of data, two different roles
This policy covers two things that are easy to confuse, so they are kept separate throughout.
PeaBrain's own data. Information about site visitors and client contacts: name, email, company, what you sent through a form or booked on a call. PeaBrain decides how this is used and is responsible for it.
Client business data. The accounting and operational records PeaBrain reads on a client's behalf to answer their questions. The client owns and controls this data. PeaBrain processes it only on that client's instructions, under their signed service agreement. If you are a customer, employee, or vendor of a PeaBrain client and have a question about your information in their records, contact that business directly; they control it, not PeaBrain.
What we collect (our own data)
- You give it to us: name, email, business name, and whatever you write, when you book a call or send a message.
- Automatically: basic request logs from the website host, including IP address and browser type. The site runs no advertising trackers and no third-party analytics.
How we use it
To respond to you, run discovery and onboarding calls, deliver and support the service, send service and billing messages, and meet legal and tax obligations. We do not sell or rent it, and we do not use it for advertising.
Who we share it with
Service providers who help run the business: website hosting, email and calendar, appointment scheduling, payment processing, and a password manager. Each gets only what their function requires. We also share where the law requires it, or to protect rights and safety.
Client business data specifically
- It stays in the client's own systems. We read it on demand and do not keep a copy of a client's business records on our infrastructure.
- Some derived material exists and clients are told exactly what: conversation history inside the AI application, structural notes about the data's shape in a private repository, insight emails, and the integration provider's rolling 15-day operational logs.
- We do not use it to train AI models, and we disable model-improvement and feedback settings where the AI application provides those controls. The AI provider may still process content for trust, safety, abuse prevention, and legal compliance under its own consumer terms. We do not claim enterprise contractual protections we do not have.
- Access is read-only. Providers who process client data are named in the client's agreement, and clients get at least 15 days notice before a new one is added.
Retention
Contact and business records: as long as needed for the relationship and for legal or tax requirements. Client business data: for the term of the agreement, then deleted within 30 days of termination, with the carve-outs stated in that agreement (provider backups, rolling logs, sent email, repository history, and records we are required to keep).
Security
Credentials in an encrypted password manager. Encryption in transit. Per-client isolation with unique, independently revocable access. Stated plainly: PeaBrain is a sole operator with no SOC 2, no ISO certification, no dedicated security staff, and no third-party penetration testing.
Your choices
You can ask what we hold about you, ask for a correction or deletion, and unsubscribe from non-essential email at any time. Email hello@askpeabrain.com and we will respond within 30 days. We honor these requests regardless of whether a specific state law requires it of a business our size. For client business data, the request goes to the client who controls it.
Processing location
Data is processed in the United States as a matter of practice. Because provider regions and support-access locations are not something we can verify end to end, we state this as our practice rather than as a guarantee.
Children
The service is for businesses. We do not knowingly collect information from anyone under 13.
Changes
Material changes get posted here with a new date.