The rules we build for, and where we stand.

Roles

Processor for businesses that build on our infrastructure, under a data processing agreement that meets Article 28; each business is the controller for its own product. Controller for this website and for messages you send us.

By design

Article 25 and 32: pseudonymisation by masking before any model, Spaces that keep data apart, no content kept on the route, encryption of clear values, audited keys.

Sensitive data

Products built on the pipeline may hold health data and other special categories; the business behind each product sets its lawful basis under Article 9. We will complete a data protection impact assessment under Article 35 before launch.

Rights

Access, rectification, erasure, restriction, portability and objection, built into the infrastructure, so a business can honour them without handling data by hand. The pipeline itself makes no decisions with legal or similarly significant effects (Article 22).

Representative

We are established in the United States. Before we offer a service to people in the EU we will appoint a representative under Article 27, and name it in our privacy policy.

Transfers

To the US under the EU–US Data Privacy Framework where the recipient is certified, with the Commission's standard contractual clauses as the fallback. The framework is in force; an appeal against it (C-703/25 P) is pending.

Data protection

The same design and rights as for the EU, with a UK representative under Article 27 of the UK GDPR before we offer a service to people in the UK.

Storage on your device

The theme and language settings fall within the exemption the 2025 Act added to the Privacy and Electronic Communications Regulations for storage that adapts a site to your preferences; you are told about it and can clear it.

State privacy laws

We do not sell personal data or share it for advertising. As the California Consumer Privacy Act and other state laws come to apply to us, their rights of access, deletion, correction and opt-out will be honoured.

AI laws

The pipeline makes no consequential decisions, which the Colorado AI Act (as re-enacted in 2026) regulates; a business whose product makes them carries those duties. We train no models, so California's training-data disclosure law (AB 2013) does not reach us.

Children

Our services are not for children under 13, and in the EU and UK not for anyone under the age of digital consent in their country.

Our promises

The Federal Trade Commission treats a broken privacy promise as deception. Ours are written into our terms, so they bind us.

• Separate services for memory, masking, route and authority, each with only the keys its job needs.
• Signing keys that cannot leave OpenBao; short-lived signed tokens; credentials stored only as hashes.
• Mutual TLS between memory and masking; TLS to every data store.
• Clear values encrypted with AES-256-GCM under keys per Space.
• No content in any log line; audited signatures, with serving stopped if auditing fails.
• Resilience, load and penetration testing of the router.

No SOC 2, ISO/IEC 27001 or ISO/IEC 42001 certificate yet. A security contact for reporting vulnerabilities: security@genesysbrain.com.