The small print

Privacy statement

Last updated 5 September 2026

Who we are

Your Business Today Ltd, a company registered in England and Wales under number [company number — fill in] with its registered office at [registered office address — fill in], is the data controller for the personal information handled by yourbrain.today and by our consultancy. For anything in this statement, contact consulting@yourbrain.today.

The short version of our promise, stated once here and repeated wherever it matters: your knowledge powers your tools and nothing else. It is never sold, never pooled, never used to train anything for anyone else, and it leaves when you do.

What we collect

We hold these kinds of information:

• Account details — your email address, display name, and which sign-in method you use (Google, or email and password).
• Knowledge base content — the documents you upload, the answers you give the interviewer, and the expertise, experience and process brains built from them.
• Chatbot conversations — the questions members ask, the answers given, which questions went unanswered, and how much of the pool each member has spent.
• Client register records — for the businesses we work for: the company, the people named as contacts, the requests they raise, and the threads and builds that follow.
• Enquiries — the name, email address, company, website and message you send through the contact page, which create a lead in the client register.
• Activity records — credit purchases and spends, shares you create, API tokens and OAuth authorisations you grant, notifications, and the log of what happened in each knowledge base. Card details go directly to Stripe; we never see or store them.
• Technical records — server logs with your IP address and browser details, kept briefly for security.

Why we use it, and the lawful basis

We use your information to run the service you asked for: signing you in, interviewing you and reading your documents, answering questions from your own records, running the chatbots you set up, fulfilling credit purchases, delivering shares and connected-tool access, running the client portal, and sending service emails such as invitations. The lawful basis for this is performing our contract with you.

We rely on our legitimate interests to keep the service secure, to improve it, to reply to enquiries and keep the client register, and to send the emails a business relationship needs. We rely on legal obligation to keep purchase records for tax and accounting law. Where we ask for consent — for anything beyond the above — we will say so at the time and you can withdraw it.

We do not use your information for advertising, we do not profile you, and we do not sell it to anyone.

AI processing

When the service generates something for you — an interview reply, a reading of a document, an answer from a brain, a chatbot answer — the content needed to do it is sent to Anthropic’s Claude API. That is your message or question and the relevant parts of the knowledge base, and for a chatbot it is the member’s question together with the relevant parts of the manager’s knowledge base. Anthropic processes it to produce the answer; it is not used to train models for anyone else.

Who processes it for us

A small number of providers process data on our behalf:

• Supabase — the database, authentication, and the storage where uploaded documents live.
• Stripe — payment processing for credit packs.
• Anthropic — AI processing of the content sent to generate replies and answers.
• Vercel — hosting of the application.
• Resend — sending the service’s emails, such as invitations and enquiry notifications.

International transfers

Some of these providers process data outside the United Kingdom, principally in the United States. Where they do, the transfer is covered by the UK’s adequacy regulations or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner, and by the provider’s own commitments to the same standard of protection.

Who else can see it

Only the people you choose. Sharing a knowledge base gives the named person read-only access to it. A chatbot manager sees the questions and answers of the members they invited. Our staff see the client register, the requests raised in the client portal, and — for the businesses we consult for — the knowledge base we build together. Beyond that, we disclose information only where the law requires it.

If you are a chatbot member or a client contact

You may be reading this because someone else brought you here: a manager invited you to a chatbot, or your business named you as a contact in the client portal. This section is for you.

If you were invited to a chatbot, we hold the email address the manager gave us, your display name if you set one, and every question you ask and answer you receive. The manager who funds the chatbot can see those questions and answers, including the ones the chatbot could not answer. Your questions are sent to Anthropic to be answered, as described above. The manager is responsible for telling you this before inviting you; if they have not, ask them.

If you were named as a client contact, we hold your name, email address, phone number and role as your business gave them to us, and the requests and messages you send through the portal. Our staff and the other contacts at your business can see them.

In both cases you have the same rights as any account holder, set out below. If you would rather not be a member or a contact, tell the manager or your business and they can remove you — or write to consulting@yourbrain.today and we will.

How long we keep it

We keep your information while your account is active. When your account is deleted, your knowledge bases, chatbots and their conversations, tokens and authorisations are deleted with it. Chatbot conversations are also deleted when the manager deletes the chatbot. Enquiries and client register records are kept while we are working with, or hoping to work with, the business concerned, and reviewed at least every two years. Records of purchases are kept for six years, as tax and accounting law requires, and no longer. Server logs are kept for no more than 30 days.

Your rights

Under UK data protection law you can ask us for a copy of your information, ask us to correct it, delete it, or restrict how we use it, object to our use of it, and receive it in a portable form — the expertise brain export exists precisely for that. Contact us and we will respond within a month.

If you are unhappy with how we handle your information you can complain to the Information Commissioner’s Office at ico.org.uk, although we would rather you told us first so that we can put it right.

Cookies

We use only the session cookies needed to keep you signed in and the service working. They are strictly necessary, so no banner asks for your consent, and there are no advertising or third-party tracking cookies.

Changes to this statement

If how we handle your information changes, this statement will change with it, and the date at the top will tell you when. Material changes will be flagged on the site or by email.