Privacy Policy

1. WHO IS RESPONSIBLE FOR YOUR DATA?

This English translation is provided for convenience; the French version prevails. Version 1.2 of 15 October 2026.

BUSINESS BRAIN, société par actions simplifiée with a share capital of €100 (SIREN: en cours d’immatriculation), whose head office is at 64 promenade du Maréchal Leclerc de Hauteclocque, 06500 Menton, France, represented by its President, Rayane Caputo.

E-mail address: support@mybusinessbrain.eu; telephone: 06 64 46 46 79; postal address: the head office above.

BUSINESS BRAIN has not designated a data protection officer; it is not required to do so. Its data protection lead is its President, Rayane Caputo, who can be reached at the contact details above.

2. WHAT THIS POLICY COVERS

BUSINESS BRAIN publishes BusinessBrain, online software that helps real-estate agencies keep their correspondence, their files and their register of mandates.

This policy describes the processing for which BUSINESS BRAIN is the controller: (1) the accounts of portal users; (2) the invoicing of client agencies; (3) business prospecting by BUSINESS BRAIN towards professionals; (4) support; (5) the security of the service and its logs; (6) the identification data of the authors of public property pages, which BUSINESS BRAIN keeps as hosting provider. It also describes the portal's cookies and other trackers (§ 11).

What it does not cover. The data that an agency puts into its workspace, or that are received there for it (its e-mails, its clients, its mandates, its properties, its viewings, its documents), are processed by BUSINESS BRAIN on behalf of the agency, which is the controller. This processing is governed by the processing agreement signed with the agency (GDPR, article 28). If you are a client, principal, buyer, visitor or correspondent of an agency, it is that agency's notice that informs you, and it is to the agency that you should address your requests. If you write to us about it, we forward your request to the agency concerned within five working days; it is the agency that answers you.

3. WHY WE PROCESS YOUR DATA, AND ON WHAT BASIS

Each processing operation for which BUSINESS BRAIN is the controller is described below (§ 3.1 to 3.6): the data subjects, its purposes, its legal basis, the data processed and their source.

3.1 PORTAL USER ACCOUNTS

Data subjects: managers and employees of client agencies who use the portal.

Purposes: creating and administering your account; authenticating you; securing access; sending you the service's notifications.

Legal basis: if you signed the contract for your agency, the performance of that contract (GDPR, art. 6.1.b); if you are an employee of the agency, our legitimate interest in providing and securing the service subscribed to by your employer (art. 6.1.f).

Data: professional identity, e-mail address, agency you belong to, role; password, stored in a non-reversible form; for the user authorised to check identity documents under anti-money-laundering rules, their access key (WebAuthn).

Source: you, or the administrator of your agency who invites you.

3.2 INVOICING OF AGENCIES

Data subjects: representatives and billing contacts of client agencies.

Purposes: invoicing the use of the service (pay-as-you-go, monthly invoice in arrears); collecting payment; keeping the accounts.

Legal basis: performance of the contract (art. 6.1.b); legal obligation to keep accounting records (art. 6.1.c; French Commercial Code, art. L123-22).

Data: company name, billing details, customer identifier at our payment provider, usage data used to calculate the price (number of replies written, tokens consumed), invoices, amounts. Bank card data are entered in Stripe's module and never pass through our servers.

Source: the agency.

3.3 BUSINESS PROSPECTING BY BUSINESS BRAIN

Data subjects: managers and employees of real-estate agencies, contacted in a professional capacity. BUSINESS BRAIN does not prospect any private individual.

Purposes: presenting BusinessBrain to real-estate agencies; following up our business exchanges.

Legal basis: our legitimate interest in making our service known to the professionals it concerns (art. 6.1.f). A professional may receive by e-mail, without prior consent, an offer related to their profession, provided they can object to it simply in every message (French Postal and Electronic Communications Code, art. L34-5).

Data: professional identity, position, professional contact details, company, history of our exchanges, any objection.

Source: public business registers (BODACC, INSEE Sirene); the contact form on our website; direct exchanges.

Every prospecting message lets you object to it. You may also object at any time, without giving reasons, by writing to support@mybusinessbrain.eu.

3.4 SUPPORT

Data subjects: users and contacts of agencies who write to support@mybusinessbrain.eu.

Purposes: answering your requests; diagnosing a malfunction.

Legal basis: performance of the contract (art. 6.1.b); our legitimate interest in answering the employees of client agencies (art. 6.1.f).

Data: identity, e-mail address, content of the request and attachments.

Source: you.

When a support request requires access to an agency file, BUSINESS BRAIN acts on behalf of the agency, on its instruction; the data in that file are not added to the support history.

3.5 SECURITY OF THE SERVICE AND LOGS

Data subjects: administrators of BUSINESS BRAIN; authors of connection attempts to our servers; users and visitors of the portal and of the programming interface whose request is refused.

Purposes: detecting intrusions and changes to sensitive files; finding vulnerabilities; investigating after an incident.

Legal basis: our legitimate interest in securing our information system (art. 6.1.f), in support of our security obligation (art. 32).

Data: system events (server connections, privilege escalations, administration commands), system identifiers, IP addresses, timestamps; application security events (failed sign-ins, forbidden access, rate limits exceeded with the visitor's IP address, invalid tokens, attempts to access another agency's data). E-mail addresses are masked before being sent to the monitoring tool. No data from agencies' files.

Source: our servers and our application.

Targeted alerts, containing extracts of these logs (IP addresses, technical account names), are sent to the team of BUSINESS BRAIN in a channel of the Slack messaging service.

3.6 AUTHORS OF PUBLIC PROPERTY PAGES

Data subjects: users of agencies who create, modify or withdraw a public property page.

Purposes: keeping, as hosting provider of these pages, the data that make it possible to identify anyone who contributed to the creation of content, in order to disclose them to the authorities empowered by law.

Legal basis: legal obligation (art. 6.1.c): law no. 2004-575 of 21 June 2004, art. 6; decree no. 2021-1362 of 20 October 2021.

Data: civil identity and contact details; account identifiers; for each operation: date, time, IP address and source port.

Source: you; the service's logs.

Today, the service keeps the author and the date of each operation on a property. Retention of the IP address and source port of each operation is not yet in place: BUSINESS BRAIN has undertaken to put it in place.

4. WHO RECEIVES YOUR DATA?

Authorised persons at BUSINESS BRAIN: its President and its developer, each for what falls within their duties.

The authorities empowered by law, in the cases it provides for, in particular for the identification data of the authors of public pages (§ 3.6).

None of these data is sold.

A daily copy of the security logs is kept on the administration workstation of BUSINESS BRAIN, located in France.

Our providers, who act on our instructions, are the following:

• OVH SAS (Roubaix, France): hosting of the service on a server located in France (Gravelines) and of the monitoring server, located in France; server sending the notifications; mail service for support@mybusinessbrain.eu;
• Stripe Payments Europe, Limited (Dublin, Ireland): payment and invoicing. Stripe also processes some data on its own account, in particular to fight fraud and comply with its regulatory obligations, under its own privacy policy;
• Slack Technologies Limited (Dublin, Ireland, Salesforce group): receipt of security alerts by the team of BUSINESS BRAIN. These alerts contain no data from agencies' files.

5. TRANSFERS OUTSIDE THE EUROPEAN UNION

The service is hosted in France. Two providers may transfer data outside the European Union: Stripe, some of whose payment and invoicing data may be processed in the United States; Slack, whose security alerts may be processed outside the Union.

These transfers are governed by the standard contractual clauses adopted by the European Commission (GDPR, art. 46.2.c). You may obtain a copy by writing to support@mybusinessbrain.eu.

6. HOW LONG DO WE KEEP YOUR DATA?

User account: for the term of your agency's contract; then 6 months after the end of the contract or after you leave the agency.

Identification data of the authors of public pages: identity and contact details, 5 years after the account ceases to be valid; identifiers, 1 year after the account is closed; date, time, IP address and source port of each operation, 1 year from the operation. For these users only, these periods replace the 6-month account period.

Accounting records of invoicing: 10 years (French Commercial Code, art. L123-22).

Other invoicing data (contact details, Stripe customer identifier): for the term of the contract. Their retention period after the end of the contract has not yet been set; until then, they are used only to settle sums due and to keep the accounting records.

Business prospecting by BUSINESS BRAIN: 3 years after the last contact; if you object, your objection is kept for 3 years, so that we no longer write to you.

Support: 2 years after the request is closed.

Security logs: 12 months.

Security alerts in Slack: 12 months at most; Slack's retention setting has not yet been set to this value.

When the period expires, BUSINESS BRAIN deletes the data itself, without waiting for a request. For accounts, prospecting, support and the copy of the logs on the administration workstation, automatic deletion is not yet in place: BUSINESS BRAIN carries it out manually. Deleted data may remain for up to 30 days in the server's backups before disappearing from them.

7. ARE YOU OBLIGED TO PROVIDE THESE DATA?

• Account: your e-mail address and a password are needed to use the portal.
• Invoicing: invoicing data are needed to perform the contract, and keeping them is a legal obligation.
• Public pages: keeping the authors' identification data is a legal obligation of the hosting provider; without it, a public page cannot be published by means of the service.
• Support: without the relevant information, we cannot handle your request.
• Prospecting and security logs: you have nothing to provide to us.

8. AUTOMATED DECISION-MAKING

BUSINESS BRAIN takes no decision on these data based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (GDPR, art. 22).

9. YOUR RIGHTS

None of this processing is based on your consent. You have the following rights:

• access to your data and to a copy of them (art. 15);
• rectification of inaccurate data (art. 16);
• erasure (art. 17), except where the law requires us to keep them (accounting records, identification data of the authors of public pages);
• restriction of processing (art. 18);
• portability of the data you provided to us, for processing based on the contract (art. 20);
• objection to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time, without giving reasons, to prospecting (art. 21);
• instructions on what happens to your data after your death (French law no. 78-17 of 6 January 1978, art. 85).

HOW TO EXERCISE YOUR RIGHTS

Write to support@mybusinessbrain.eu, or by post to BUSINESS BRAIN, 64 promenade du Maréchal Leclerc de Hauteclocque, 06500 Menton, France. We reply within one month of receiving your request. This period may be extended by two months if the request is complex or if there are many requests; we then inform you within the first month, with the reasons. The reply is free of charge.

We do not ask you for an identity document. If we have reasonable doubts about your identity, we may ask you for additional information, limited to what is necessary to confirm it (GDPR, art. 12.6).

Complaint. You may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.

10. SECURITY

The service is hosted in France. Exchanges with the portal and the programming interface are encrypted (TLS, with an HSTS header). Passwords are stored in a non-reversible form. The servers are monitored continuously by an intrusion-detection tool, and backed up every night. If a breach of your data presents a high risk to your rights and freedoms, we inform you as soon as possible (GDPR, art. 34).

11. COOKIES AND OTHER TRACKERS

The portal only uses trackers that are strictly necessary for the service you request, or for remembering a choice you have made. They are exempt from consent (French law no. 78-17 of 6 January 1978, art. 82). The portal uses no audience-measurement tool, no advertising tracker and no social-network tracker: no consent banner is therefore displayed.

authjs.session-token (set by BUSINESS BRAIN): keeps your session once you are signed in. Duration: until you sign out or the session expires.

authjs.csrf-token (set by BUSINESS BRAIN): protects the sign-in forms against request forgery. Duration: the browser session.

authjs.callback-url (set by BUSINESS BRAIN): brings you back, after sign-in, to the page you requested. Duration: the browser session.

NEXT_LOCALE (set by BUSINESS BRAIN): remembers the language you chose; it is set only if you change language. Duration: until a new choice or until it is deleted.

Display theme (browser local storage, not a cookie; set by BUSINESS BRAIN): remembers the light or dark display you chose. Duration: until your browser deletes it.

__stripe_mid, __stripe_sid (set by Stripe): prevent payment fraud. They are set only on the billing page, where Stripe's payment module is loaded. Duration, according to Stripe: 1 year for __stripe_mid, 30 minutes for __stripe_sid.

The portal also sends to the server of BUSINESS BRAIN technical measurements of page display speed, together with the identification of your browser. This measurement sets no cookie, is used for no tracking, and the server does not keep it.

You may delete these trackers at any time from your browser settings. Without the session trackers, you will not be able to stay signed in to the portal.

12. CHANGES TO THIS POLICY

BUSINESS BRAIN updates this policy whenever a processing operation changes, and at least once a year. The date of the latest update appears at the top. In the event of a significant change, portal users are informed by e-mail.

Last updated: 15 October 2026.