Privacy Policy

1. Who we are

LAN Brain is operated by LAN Ventures E.A.S. (Tax ID / RUC 80141770-8), a Paraguayan company headquartered in Asunción, Paraguay. This policy explains what data we collect, how we use it, who we share it with, and the rights you have over it.

2. Scope

This policy covers our website, the LAN Brain platform, and related services. Your use of the Service is also governed by our Terms of Service. For a plain-language explanation of who inside your organization can see what, see our How We Handle Data page.

3. Information you provide to us

· Account data: name, email, organization, role, preferred language.

· Communication data: when you contact us by email, form, or meeting, we receive the information you choose to send.

· Payment data: purchases are processed by our payment processors. We do not store your card numbers; we keep references such as customer and payment identifiers.

4. Information collected automatically

· Usage data: pages visited, actions within the Service, device, browser, approximate IP address, timestamps.

· Analytics: we measure product usage with PostHog, configured in cookieless mode. It sets no cookies and leaves no persistent identifier on your device, so anonymous traffic is measured in aggregate. If you are signed in, product events are associated with your account so we can support you. You can opt out of product analytics from our Cookie Settings page.

· Site measurement: the public pages of lanbrain.ai, and also the signed-in screens (the dashboard, onboarding, OAuth consent and invitation pages), run Vercel Web Analytics and Vercel Speed Insights. Per Vercel's documentation, neither uses cookies or persistent identifiers on your device: they record, in aggregate, the page visited (its path, with the query string and fragment removed), the referrer, the approximate country or region, the browser, the operating system, the device type, and page-load speed metrics (Web Vitals). Nothing from your brain's content is sent to them.

5. Content from platforms you connect

Today LAN Brain runs no connector of its own that reads your tools: there is no LAN-side integration authorized via OAuth to reach your Drive, your email, or your CRM. Content reaches your brain through what you upload and through what your own artificial intelligence client sends to the brain over MCP, using your tokens and inside your own AI provider. If we ever build a LAN-side connector, this section will describe it and we will request only the minimum permissions necessary.

6. Google user data

If you sign in with Google, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. The only Google integration on LAN Brain's side is sign-in: we receive your account identifier, your email, your name, and your profile picture, and we use them solely to create and authenticate your account. We do not request or store Google access tokens, and we do not access your Calendar, your Gmail, or your Drive. If you connect those services to your artificial intelligence assistant, that connection runs with your own tokens inside your AI provider and never passes through LAN Brain. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models, and we never sell it.

You can revoke our access at any time from your Google account permissions page. Upon revocation or account deletion, the Google user data we hold (account identifier, email, name, and profile picture) is deleted within 30 days, unless the law requires us to retain it. You can also request deletion at any time by writing to info@lanbrain.ai. The same applies if you sign in with GitHub, which works the same way and with the same scope.

7. Your brain content and uploaded files

The pages, documents, and files that make up your brain, including source files you upload, are stored in your brain's own isolated storage and remain available to you while your account is active. Source files are kept alongside the pages derived from them so your brain can always cite its evidence. Access to all of it is governed by your organization's roles and visibility rules, described on our How We Handle Data page.

8. What we use information for

· To deliver the Service you contracted, including building, indexing, and serving your brain.

· To operate, secure, and support the Service, including fraud prevention and troubleshooting.

· To improve the quality of the Service, without using your personal data to train AI models.

· To send you transactional communications, and commercial ones you can opt out of.

· To comply with legal obligations and protect our rights and yours.

9. Legal bases

We process your data on the basis of the contract you have with us, your explicit consent (when required), our legal obligations, and our legitimate interests in operating the Service securely.

10. Sub-processors and how we share information

We do not sell your personal information. We share it only with the providers below, or when the law requires it, in a corporate transaction such as a merger or acquisition (in which case this policy continues to protect it), or with your permission. To deliver the Service we rely on carefully selected providers:

· Anthropic, PBC (language processing via the Claude API)

· Vercel Inc. (web application hosting, plus Vercel Web Analytics and Speed Insights on all pages of the site, including signed-in screens)

· Supabase Inc. (database, authentication and storage; hosted in São Paulo, Brazil)

· Google LLC (authentication, when you choose to sign in with Google)

· GitHub, Inc. (authentication, when you choose to sign in with GitHub)

· Amazon Web Services, Inc. (daily off-platform backup of the audit log, which contains user identifiers, your organization's identifier, the paths accessed, the text of search queries, the pages referenced in graph walks, free-text reasons given with corrections, the client's user agent, and per-request telemetry records (method, path, status and timing); data stored in the United States, us-east-1 region)

· Cloudflare, Inc. (Turnstile bot protection on the corporate contact form, which receives the visitor's IP address and browser signals, and DNS for the lanbrain.ai domain; global network)

· Takenos and dLocal Go (payment processing when you make a purchase)

· PostHog Inc. (product analytics in cookieless mode; data stored in the United States)

· Railway Corp. (hosting of the platform and API services; data stored in the United States, US East region)

· Resend (transactional email delivery; data stored in the United States)

· Other providers that we will list upon request and that apply equivalent security controls.

These sub-processors access your data only to the extent strictly necessary to deliver the Service and under contractual confidentiality obligations.

Sub-processor list last updated on August 30, 2026.

11. We do not use your data to train models

Your data is not used to train artificial intelligence models. Calls to the Claude model are made under configurations that exclude your content from training, in line with Anthropic's processing policies.

12. Retention

We retain your data while your account is active and for the additional reasonable time necessary to comply with legal obligations, resolve disputes, or enforce agreements. Some records have specific windows:

· Access and activity audit events are retained for up to 400 days. Besides user identifiers, your organization's identifier and the paths accessed, those events contain the text of search queries, the pages referenced in graph walks, free-text reasons given with corrections, the client's user agent, and per-request telemetry records (method, path, status and timing). The audit log is additionally backed up daily, off-platform, to Amazon Web Services storage in the United States (us-east-1 region); those copies hold the same contents, exist for recovery only and are retained under the same 400-day window.

· Your brain is snapshotted daily for disaster recovery; snapshots rotate out on a schedule of roughly five weeks, so deleted content also leaves the backup set as those snapshots rotate. Prior versions of each page, which we keep on every write so a bad change can be reverted, are pruned on the same roughly five-week window.

· When two writes collide on the same page, we keep the losing version as a conflict copy inside your own brain's storage, so nothing is silently lost. At most 10 copies per page are kept, they are never indexed or shown as current content, and they are deleted along with your brain when you delete your account.

You can request deletion at any time.

13. Account deletion

To delete your account, write to info@lanbrain.ai from the address associated with it. Deletion removes your brain's storage, including uploaded source files, prior versions, conflict copies, its search index, and your account records. Minimal legal and accounting records, and the audit trail of the deletion itself, are retained as required: audit events and their backup copies are not erased with the account, they age out under the 400-day window. Content already captured in rotating backups leaves the backup set as snapshots rotate, within roughly five weeks. Active subscriptions are cancelled as part of the process.

14. Your rights

You have the right to access, rectify, delete, and port your personal data, and to object to or restrict certain processing. To exercise these rights, write to info@lanbrain.ai. We will respond within a reasonable time, no more than 30 days.

How portability works, concretely: there is no download button in the product today. The export is run by a LAN Brain operator on request and delivered within 30 days of the request, as a complete copy of your brain's files in their native format (the pages as markdown, plus any source files you chose to retain), over a private download link. It is your content, exactly as stored, with no conversion that locks you to us.

15. Your choices

· Commercial email: opt out via the unsubscribe link in any commercial message. Operational messages continue while your account exists.

· Analytics: opt out of product analytics from our Cookie Settings page. The Service works the same either way. That preference switches PostHog off; Vercel's aggregate measurement has no switch of its own because it is anonymous and leaves nothing on your device.

· Do Not Track: our analytics is cookieless by design and we do not track you across other sites, so there is nothing additional to disable in response to Do Not Track signals.

16. Security

We apply reasonable technical and organizational measures to protect your data: encryption in transit (TLS), encryption at rest, role-based access control, audit logs, and periodic provider review. No system is perfectly secure, but we make our best effort and we will notify you without delay of any material incident that affects you, and in any case within 48 hours of confirming it. If we do not have the full picture by then, we tell you anyway with what we know and complete the detail as the investigation progresses. For more detail on our security model, see our Trust & Security page.

17. Minors

The Service is not directed to minors under 18 years of age and we do not knowingly collect data from minors of that age. If you believe a minor has provided us data, write to info@lanbrain.ai and we will delete it.

18. International transfers

Our sub-processors operate in different countries: the primary database and storage are hosted in São Paulo, Brazil; platform compute, analytics, transactional email, and the audit-log backup store data in the United States; and bot protection and the site's DNS run on a global network. When data leaves Paraguay, we apply contractual clauses and equivalent controls to ensure the same level of protection described in this policy. If you are a company subject to the GDPR or the LGPD, we will sign our data processing agreement with the applicable standard contractual clauses on request: write to info@lanbrain.ai.

19. Third-party links

Our website may link to third-party sites we do not operate. This policy does not apply to them; review their privacy policies before providing information.

20. Changes to this policy

We may update this policy. We will publish the current version on this page and, for material changes, notify you in advance.

21. Contact

For privacy questions: info@lanbrain.ai · LAN Ventures E.A.S., Asunción, Paraguay.