Privacy Policy
Draft, under legal reviewOur lawyers are still reviewing this text, and it may change before it takes effect. Questions? Email ops@billionbrain.ai.
Last updated: 2 November 2026
In short
- BillionBrain checks how a business, creator, professional or public figure shows up online and writes a report about it. Billie, our AI agent, does the research.
- For a free scan we ask for a name, a location and public links, plus your email so we can send you a code and your report. A mobile number is optional.
- We read public pages, listings and profiles only, and only after you confirm your email. We never ask for passwords or logins.
- We do not sell your personal information, we do not share it for advertising, and we never send your email, phone number or anything you type to our analytics.
- Our servers are in the USA. A small set of service providers help us, and they are all listed below.
- You can ask us to see, correct or delete your data at any time by emailing ops@billionbrain.ai.
- BillionBrain is not for anyone under 18.
1. Who we are
BillionBrain ("we", "us", "our") runs billionbrain.ai and the Service described below.
For the personal data described in this policy, we are the "Data Fiduciary" under India's Digital Personal Data Protection Act 2023, the "Controller" under the UAE's Federal Decree-Law No. 45 of 2021 (PDPL), and the "business" under the California Consumer Privacy Act as amended by the CPRA.
You can reach us at ops@billionbrain.ai. Our Grievance Officer for India is listed in section 12.
2. What this policy covers
This policy covers billionbrain.ai, the BillionBrain scan, the free and full reports, account and payment pages (together, "the Service"), and the emails we send you. It applies to visitors and customers in India, the UAE and the USA, and to anyone else who uses the Service.
3. What we collect
3.1 What you give us
| What | When | Why |
|---|---|---|
| The name of the business or person, its location (town or area, and country) and its public links (website, Google Maps, Instagram, Facebook, LinkedIn, YouTube, X, Wikipedia, business directories) | When you start a scan | To find and read the right public profiles |
| If there is no website or profile: the area, what is sold and how customers find it | When you choose "no online presence" | To describe the business so we can search for it |
| The type of subject (local business, online business, creator, professional or public figure) | Guessed by us, and you can change it | To pick the right checks |
| For a public figure: your confirmation that you are that person, or work for them and have their permission, and the time you gave it | Before a public-figure scan | To make sure public figures are only scanned with permission |
| Your email address | When you ask for your report | To send your one-time code, your report link and account emails, and to apply fair-use limits |
| Your mobile number (optional) | When you ask for your report | Kept with your scan and account so we can reach you about your report. We do not send texts or WhatsApp messages today |
| Corrections to the facts we found, and the peers (similar businesses) you keep or add | On the results pages | To correct and finish your report |
| Your name and your agreement to our terms | When you create an account | To run your account |
| The plan you choose | At checkout | To set up your plan and unlock the full report |
| Your answers to set-up questions, your goal, and facts you confirm | If you subscribe and set up your account | So Billie works from accurate facts about your business |
| Your work email, the features you want first, the page you signed up on, campaign tags (UTM) and your country | When you join the waitlist | To tell you when features launch and to plan what we build |
| Anything you write to us | When you email us | To answer you |
3.2 What we collect automatically
- Country and city. Our own server works out the country, and where it can the city, of your connection from your IP address using an offline database (IP geolocation by DB-IP). No other company is asked. We use it to show the right prices, currency and directories, and to suggest your location in the scan form. We store the country only, and the city only if you start a scan with it.
- Location suggestions. When you type in the scan's location field, or press "Use my exact location", our server asks Google Maps Platform to suggest or name the town or area. Google receives what you type, or your device's approximate position, never your name or email. We don't store your position.
- IP address. We do not store your IP address in readable form. We store a keyed one-way code made from it (an HMAC-SHA256 hash) so we can limit how many scans, codes and sign-ups come from one connection.
- Browser details. When you are signed in, we keep the browser description your device sends (the "user agent") with your sign-in session.
- Usage analytics and session recordings. Our website uses PostHog to count page views, clicks, scrolling (heatmaps) and which steps of the scan people reach, and to make anonymous recordings of how pages are used (mouse movement, clicks, scrolling and what is shown on screen) so we can see where the site is confusing. Everything you type is hidden in recordings: form fields such as your name, links, email, phone number and the one-time code are masked before anything leaves your browser, and sensitive areas are blocked. PostHog sets a cookie and stores a random ID on your device so it can recognise a returning visitor; it does not know who you are unless you create an account. PostHog also receives the device and browser type and your IP address (PostHog is set to discard client IP data), from which it may estimate an approximate location. The analytics events we send never contain your email, phone number, name, links or anything you type.
- Fonts. Our pages load their fonts from our own servers, not from Google or another font service.
- Cookies and local storage. See section 9.
3.3 What we collect from public sources
When you run a scan, we read public information about the business or person you named, and about up to five similar businesses (peers):
- map listings: name, address, phone, opening hours, categories, ratings, review counts and review text. We remove reviewers' names, profile links and photos before we store anything;
- search results and news results for the name, and how often people search for related terms;
- the website's public pages (such as the home page, robots.txt, llms.txt and the sitemap) and its page-speed score;
- public social profiles and recent public posts on Instagram, Facebook pages, YouTube and X;
- Wikipedia summaries;
- the answers that AI assistants (ChatGPT, Gemini, Perplexity and Claude) give to questions about the business's category and area.
This can include personal data, for example when the subject is a person (a creator, professional or public figure), or when a public page names an owner. We do not read private profiles, logged-in pages, private messages or anything behind a password. Some checks are not live yet (for example Meta's Ad Library); the report says "Not checked" when that happens.
4. How we use your information
We use it to:
- run your scan, build your free report, and send you your code and report link;
- create and run your account, take payments, and unlock and build your full report;
- let Billie write the report text, the action plan and draft content for you;
- keep the Service safe and affordable: rate limits, blocking disposable email addresses, spending caps and abuse prevention;
- understand how people use the Service, in aggregate, so we can improve it;
- answer your requests and meet our legal obligations.
We do not:
- sell your personal information, or share it for cross-context behavioural advertising;
- use your personal data to train AI models;
- send you marketing emails. Today we only send the code, your report and account emails. If we ever send marketing emails, each one will say who it is from and include a working unsubscribe link, and we will honour unsubscribes promptly.
Automated processing. Our software guesses the type of subject and calculates scores from public data. These are estimates for your business planning. They do not make decisions with legal or similarly significant effects on you, and you can change the type and correct any fact.
5. Why we are allowed to use it
- India (DPDP Act 2023). We process your personal data with your consent, which you give when you submit a scan and confirm your email or create an account. You can withdraw your consent at any time (section 12); this does not affect processing that happened before. Where the Act allows it, we also rely on the legitimate uses it lists, such as complying with law. Personal data that a person has made public themselves is outside the Act's scope.
- UAE (PDPL). We rely on your consent; on what is needed to provide the Service you asked for (a contract with you); on our legal obligations; and, for public scanning, on the processing of data that the person has made public themselves.
- USA. We give notice at collection through this policy. Our California disclosures are in section 13.
- Reading public information about businesses and public figures. We do this because it is the Service you asked for: understanding how a business or public figure appears online. We consider this a legitimate interest, for us and for the person who asked, and we balance it with the safeguards in section 6. Where a law does not recognise legitimate interest, we rely on the public-data rules above and on the requester's confirmation.
6. Scanning businesses and public figures
- Who can be scanned: businesses and brands, creators, professionals in their professional capacity, and public figures (for example politicians, officials and public personalities) in their public role.
- No private individuals. The Service must not be used to research a private person.
- Public figures need permission. Before a public-figure scan, the person asking must confirm that they are that person, or work for them and have their permission. We record when they confirmed, and we limit how many scans of the same name can run each day.
- Public sources only, as listed in section 3.3. Reviewer identities are removed.
- Shared research. To save cost, the public research about a subject may be reused for other scans of the same subject for up to 30 days. Every fact in a report shows when it was read.
- If you are the subject and want us to stop. Email ops@billionbrain.ai with the subject line "Takedown", and tell us the name and links concerned. Once we have checked your request, we will delete the research we hold about you, and tell you what we did.
7. Who we share it with
We share personal data only with the service providers below, who process it for us, and only what each one needs.
| Provider | What they do for us | What they receive |
|---|---|---|
| Railway (USA, US East) | Hosts our servers and database | Everything we store, as described in this policy |
| Vercel | Hosts our public website | Standard web request data (IP address, browser) |
| DataForSEO | Map listings, reviews, search and news results, search volumes, and the AI assistant answers | The subject's name, location, website and search terms. Never your email or phone |
| Apify | Reads public Instagram, Facebook, YouTube and X profiles and posts | Public handles and links. We delete the results from Apify straight after reading them |
| Firecrawl | Reads public website pages | The website address. We ask it to keep no copy |
| Google PageSpeed Insights | Measures the website's speed | The website address |
| Google Maps Platform | Suggests towns and areas in the scan's location field | What you type there, or your device's approximate position if you press "Use my exact location" |
| Anthropic (Claude) | The AI that writes report text and runs helper checks | Public facts about the subject and your corrections. Never your email or phone |
| Resend | Sends our emails | Your email address and the email's content |
| PostHog (USA) | Product analytics | Usage events, device and browser data and your IP address. Never your email, phone or what you type |
| Razorpay (India) | Payments in India | Your name, email, mobile (if you gave one) and the amount. Your card or UPI details go straight to Razorpay |
| Stripe (USA) | Payments in the USA and other countries | Your email and the amount. Your card details go straight to Stripe |
| A UAE payment provider | Payments in the UAE (coming soon) | Your name, email and the amount, as the gateway requires |
We also read public sources such as Wikipedia, which receive only the name being looked up.
We may also share personal data:
- when the law requires it, for example a valid court order or a request from a regulator;
- to protect our users, the public or the Service against fraud or abuse;
- with a buyer or successor if our business is sold or merged, under this policy;
- with anyone else, only if you ask us to.
Your report link. The free report email contains a private link that opens your report for 30 days. Anyone you forward it to can open it.
8. International transfers
Our servers are in the USA (Railway, US East region), and PostHog processes analytics in the USA. Some service providers work from other countries. So if you use the Service from India, the UAE or elsewhere, your data is transferred to the USA and possibly to other countries. We use providers that commit to protecting it, and we follow the transfer rules of the DPDP Act and the PDPL.
9. Cookies and local storage
| Name | Set by | Why | How long |
|---|---|---|---|
| ph_* (cookie) and ph_*_posthog (local storage) | PostHog, on our website | A random ID so analytics can recognise a returning visitor and stitch a visit together; also used for session recordings, in which everything you type is hidden | About one year (PostHog's default) |
| bb:scan, bb:session, bb:lastScan, bb:rtoken, bb:pay (local storage) | Our website | Keep your scan, your sign-in and an open payment, so reloading a page does not lose them | Until you clear them. The tokens inside stop working after 30 days |
| bb_session and bb_anon (cookies) | Our servers | Keep you signed in and link an unfinished scan to your browser. They cannot be read by page scripts and are only sent over secure connections | 30 days |
We use no advertising cookies. We do use an analytics cookie and anonymous session recordings (described above) to understand how the site is used and improve it; everything you type is hidden in recordings. You can block or delete cookies and local storage in your browser settings, or use a browser extension that blocks analytics; the scan still works, but you may have to start again if you reload a page.
Because we do not sell or share personal information, we do not change how the Service works in response to browser signals such as "Do Not Track" or Global Privacy Control.
10. How long we keep it
An automatic job deletes data once these periods are over. You can ask us to delete your data sooner (section 12), except what the law requires us to keep.
| Data | How long |
|---|---|
| One-time codes | They expire after 10 minutes. We store only a hash of each code, never the code itself, and delete that record 7 days after the code expires or is used |
| Copies of the emails we sent you | We remove the one-time code and private report links from our copy as soon as the email is sent, and in any case within about 10 minutes. We delete the copy after 90 days |
| Sign-in sessions | 30 days, or until you sign out. The record is deleted 7 days after it expires |
| Scan and report links | 30 days |
| Public research results | Treated as out of date after 1 to 30 days, depending on the source, and deleted when they expire |
| Scraped data at Apify | Deleted straight after we read it |
| Scans where the email address was never confirmed | 30 days |
| Your account, scans, reports and corrections, if you have no paid plan | 12 months after your last activity (your last sign-in, scan or change) |
| Your account and business data, if you have had a paid plan | While your plan is active, and after that for as long as we keep its payment records (below), because those records are linked to your account. Ask us and we will delete everything the law does not require us to keep |
| Waitlist sign-ups | Until 12 months after BillionBrain's public launch |
| Payment records (plan, amount, currency, status and the payment provider's reference) | 8 years after the payment, as tax and accounting law requires. An active subscription is kept while it is active |
11. How we protect it
- All connections to the Service use HTTPS.
- We store only one-way hashes of IP addresses, one-time codes and sign-in tokens.
- Payment details never reach our servers. Checkout runs on the payment provider's own page or window.
- Access to our systems is limited to the people who need it, and our provider keys are kept out of our code and logs.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
12. Your rights and how to use them
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and how we use it, and send you a copy by email;
- correct, complete or update it;
- delete it;
- withdraw your consent;
- object to or restrict some uses (UAE);
- nominate someone to use your rights if you die or become unable to (India);
- know, delete and correct your personal information, and not be treated differently for using these rights (California).
How: email ops@billionbrain.ai from the address you used with us, with the subject line "Privacy request". We may ask you to confirm the request from that address before we act. In California, you can also use an authorised agent, and we may ask them for proof that you gave permission. We will reply as soon as we can. There is no fee.
If you are not happy with our answer: in India, you can contact our Grievance Officer below and then complain to the Data Protection Board of India. In the UAE, you can complain to the UAE Data Office. In California, you can contact the California Privacy Protection Agency or the Attorney General.
Grievance Officer (India)
- Email: ops@billionbrain.ai, with the subject line "Grievance"
We will acknowledge your grievance and work to resolve it.
13. California notice (CCPA and CPRA)
In the last 12 months we collected these categories of personal information:
- Identifiers: name, email, mobile number, a hashed IP address and a random analytics ID;
- Commercial information: the plan you chose and your payment records;
- Internet activity: pages viewed, clicks and the steps you reached;
- Geolocation: the country of your connection, and your device's position only if you press "Use my exact location" (used to name your area, not stored);
- Professional information: business details and public links you give us;
- Inferences: the type of subject and the scores we calculate, which describe the business, not you.
We do not collect sensitive personal information as the CCPA defines it. Card numbers go straight to the payment provider.
- Sources: you, your device, and the public sources in section 3.3.
- Purposes: as listed in section 4.
- Disclosed for a business purpose to: the service providers in section 7.
- Sold or shared: none. We have not sold or shared personal information in the last 12 months, and we do not knowingly sell or share the personal information of anyone under 16.
- Retention: as listed in section 10.
- Financial incentives: we offer none.
14. Children
The Service is not for anyone under 18, and we do not knowingly collect personal data from children. This covers India's DPDP Act, which treats everyone under 18 as a child, and the US COPPA rule for children under 13. If you believe a child has given us personal data, email ops@billionbrain.ai and we will delete it.
15. AI in the Service
Billie is an AI agent, not a person. Our reports, scores and drafts are produced by software and AI models from public data, and they can be wrong. You can correct any fact we found. To reach a person, write to ops@billionbrain.ai.
16. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date. If a change is significant, we will email account holders or show a notice on the site before it takes effect.
17. Contact
- Email: ops@billionbrain.ai