California Privacy Notice (CCPA / CPRA)

Last updated: 19 April 2026 · Applicable to: California residents under the California Consumer Privacy Act (2018) as amended by CPRA (2023).

1. Who we are

Brainiall Inc. — AI platform for chat, image, video, and voice generation. Contact: privacy@brainiall.com.

2. Categories of personal information collected (past 12 months)

Category	Collected?	Source	Business purpose
Identifiers (email, name, IP)	Yes	You, via OAuth login	Account, billing, fraud prevention
Commercial info (subscriptions)	Yes	You, via Stripe	Service delivery
Usage data (prompts, media)	Yes	Direct from you	Service delivery, feature improvement
Geolocation (approximate, IP-based)	Yes	Automatic	Currency localization, fraud
Audio/biometric voice prints	Only if you opt in	Voice Translate cloning feature	Feature delivery — deletable on request
Inferences	No	—	—

3. Your rights (CCPA/CPRA)

Right to know what personal info we collect and why.
Right to delete — account deletion wipes all data within 30 days.
Right to correct inaccurate info.
Right to opt-out of sale/sharing — we do not sell your personal information. We do not engage in cross-context behavioral advertising.
Right to limit use of sensitive info (voice biometrics) — delete anytime in settings.
Right to non-discrimination — exercising rights never results in degraded service.

Exercise any right: privacy@brainiall.com or via /api/account/export and /api/account/delete. Verification: we require you to confirm via the registered email. Response within 45 days (extendable once by 45 more).

4. "Do Not Sell My Personal Information"

We don't sell personal information. This link is provided as required by CPRA even though no action is needed: opt-out link (informational).

5. Authorized agents

You may authorize an agent to exercise rights on your behalf. Agent must provide signed permission + proof of identity — send to privacy@brainiall.com.

6. Shine the Light (CA Civil Code § 1798.83)

California residents may request disclosure of any third parties to whom we disclose personal information for their direct marketing. We do not share for third-party direct marketing; a zero-disclosure response will be sent within 30 days.

7. Children's data

Service not directed at users under 16. We do not knowingly collect data from minors under 16. If we learn of such collection, we delete promptly.

8. Changes

Material changes → in-app notice + email 30 days before effective.

Brazilian users: LGPD notice · European users: GDPR notice