BrainOS Privacy Policy

1.1. This Privacy Policy defines the procedure for processing and protecting personal data of users of the BrainOS service (hereinafter referred to as the “Service”).

1.2. Use of the Service означает the User’s unconditional consent to this Policy and to the terms of processing their personal data.

1.3. If the User does not agree with the terms of this Policy, they must stop using the Service.

1.4. Personal data operator: Sayfullaev Djamshid.

2.1. Automatically Collected Data

When using the Service, we automatically receive and process:

• Telegram ID — the unique identifier of your Telegram account
• Username — your Telegram username (if set)
• First and last name — as specified in your Telegram profile
• Interface language — your preferred communication language
• Date and time of interaction — when you use the Service

2.2. Data You Provide

• Messages and commands sent to the bot
• Files and documents uploaded for processing
• Settings and preferences within the Service

2.3. Integration Data

When connecting external services:

• Access tokens to your accounts (Notion, Gmail, Calendar, etc.)
• Metadata from connected services (database names, email lists, etc.)
• Content required to fulfill your requests (notes, emails, etc.)

Important: Access tokens are stored in encrypted form. We do not have access to your passwords for external services.

2.4. Payment Data

• Telegram Stars transaction IDs
• Date and amount of payment
• Subscription status (active / canceled)

Important: Payment data (cards, wallets) is processed by Telegram. We do not have access to it.

We process your data for the following purposes:

3.1. Provision of the Service

• Processing your requests and commands
• Integration with external services (Notion, Gmail, etc.)
• Personalization of interaction

3.2. Ensuring Security

• Protection against unauthorized access
• Prevention of abuse and fraud
• Monitoring compliance with usage rules

3.3. Subscription Management

• Activation and renewal of Premium access
• Processing payments via Telegram Stars
• Subscription status notifications

3.4. Service Quality Improvement

• Analysis of feature usage (in anonymized form)
• Detection and correction of errors
• Development of new features

3.5. User Communication

• Technical support
• Notifications about updates and changes
• Responses to inquiries

Personal data is processed on the basis of:

4.1. Consent of the data subject

• When starting to use the Service
• When connecting integrations with external services

4.2. Performance of a contract (public offer)

• To provide paid services
• To process payments and manage subscriptions

4.3. Legitimate interests of the operator

• Ensuring Service security
• Preventing fraud
• Improving service quality

5.1. Active account:

• Data is stored for the entire period of Service usage

5.2. Inactive account:

• If there is no activity for more than 180 days (TODO: specify period), we may delete your data with prior notice

5.3. After account deletion:

• Personal data is deleted immediately; all related data is deleted at once
• Anonymized statistics may be retained for analytics

5.4. Integration data:

• Access tokens are deleted immediately when the integration is disabled
• Cached content from external services is deleted within 7 business days

5.5. Financial data:

• Transaction information is stored for 3 years for accounting purposes (in accordance with the legislation of the Republic of Uzbekistan)

6.1. We disclose data to the following categories of recipients:

A) AI service providers:

• Transferred: message text and dialog context
• Legal basis: contract performance, consent
• OpenAI (ChatGPT API) — for processing your requests. Location: USA (cross-border transfer). Policy: openai.com/privacy
• Google (Gemini) — for processing your requests. Location: USA (cross-border transfer). Policy: policies.google.com/privacy
• GigaChat (Sber) — for processing your requests. Location: Russia (cross-border transfer)
• Anthropic (Claude) — for processing your requests. Location: USA (cross-border transfer). Policy: anthropic.com/privacy

B) Integrated service providers:

• Notion — when using Notion integration
• Google (Gmail, Calendar) — when using Google integrations
• Transferred: access tokens and requested data
• Legal basis: consent, contract performance

C) Telegram:

• Telegram Messenger — for bot operation and payment processing
• Transferred: messages, files, payment information
• Location: Telegram servers worldwide

D) Hosting providers:

• AHOST
• Transferred: all data stored in the database
• Legal basis: legitimate interests of the operator
• Location: Uzbekistan

6.2. We do NOT disclose data to:

• Advertising networks and marketers
• Data brokers
• Other Service users (except for shared access features, if applicable)

6.3. Disclosure to government authorities:

• Only upon an official request in accordance with the legislation of the Republic of Uzbekistan

7.1. When using the Service, your data may be transferred outside the Republic of Uzbekistan:

• OpenAI (USA)
• Google (Gemini) (USA)
• GigaChat (Russia)
• Anthropic (Claude) (USA)
• Telegram — servers in various jurisdictions
• Notion (USA)
• Google (USA)

7.2. We ensure an adequate level of data protection during cross-border transfers by:

• Using encryption during transmission
• Selecting reliable providers with security certifications
• Minimizing the amount of transferred data

We apply the following measures to protect your data:

8.1. Technical measures:

• Encryption of access tokens to external services (AES-256)
• Use of HTTPS for all connections
• Regular data backups
• Restricted access to servers and databases

8.2. Organizational measures:

• Access to personal data is limited to authorized persons only
• Training on data processing rules
• Regular security audits

8.3. What we do NOT guarantee:

• Absolute protection against all types of attacks (100% security does not exist)
• Data safety if your Telegram account is compromised
• Data security in integrated services (Notion, Gmail, etc.)

In accordance with the legislation of the Republic of Uzbekistan, you have the right to:

9.1. Right of access:

• Obtain information about what data is being processed
• Request a copy of your data (export function)

9.2. Right to rectification:

• Correct inaccurate or incomplete data
• Update outdated information

9.3. Right to erasure:

• Delete your account and all related data via the /delete_account command
• Request deletion of specific data

9.4. Right to restrict processing:

• Suspend data processing in certain cases

9.5. Right to withdraw consent:

• Withdraw consent to personal data processing
• After withdrawal, use of the Service becomes impossible

9.6. Right to object:

• Object to data processing for specific purposes

9.7. Right to lodge a complaint:

• File a complaint with the authorized personal data protection authority of the Republic of Uzbekistan

How to exercise your rights:

• Via the bot: commands /settings, /export_data, /delete_account
• Email: mr.sayfullaev@gmail.com
• Response time: no more than 30 days from the date of request

10.1. The Service operates via Telegram and does not use traditional website cookies.

10.2. We use:

• Local storage within the bot — to store settings and session state
• Session identifiers — to ensure secure interaction

10.3. Session data is stored for 24 hours after the last activity.

11.1. The Service is not intended for persons under the age of 18.

11.2. We do not knowingly collect personal data from minors.

11.3. If you believe that your child has provided us with data, please contact us for its deletion.

12.1. We may amend this Policy unilaterally.

12.2. Changes may take effect without prior notice.

12.3. The current version is always available at: https://brainos.ai-khan.uz/privacy

Operator (self-employed): Sayfullaev Djamshid

Address: specified in the final version

Tax ID: specified in the final version

Email for personal data inquiries: mr.sayfullaev@gmail.com

General support: mr.sayfullaev@gmail.com

Telegram: @sayfullaev_uz

14.1. This Policy and all related relations are governed by the laws of the Republic of Uzbekistan.

14.2. Personal data processing is carried out in accordance with the legislation of the Republic of Uzbekistan on personal data and information protection.

Document version: specified in the final version.

Effective date and last updated: specified in the final version.