Effective Date: 04.05.2026 · Last Updated: 04.11.2026
This Privacy Policy ("Policy") explains how Vrtcl OÜ, a company registered in Estonia with its registered address at Maakri 19, Tallinn, Estonia, registry code 16281254 ("Vrtcl," "PickMyBrain," "Company," "we," "us," or "our"), collects, uses, shares, and protects personal data in connection with the PickMyBrain website, applications, APIs, and related services (collectively, the "Platform").
This Policy forms part of, and should be read together with, our Terms and Conditions ("Terms"). Capitalised terms not defined here have the meaning given to them in the Terms.
As a company established in Estonia, we process personal data in accordance with the EU General Data Protection Regulation ("GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
In plain English: We collect the data we need to run PickMyBrain — your account details, the content Experts upload to build a Digital Brain, the messages End Users send to Digital Brains, payment information for Revenue Share payouts, and technical usage data. We use third-party AI providers to generate Output, so conversation content is sent to them to produce a reply. We do not use your content to train our own general-purpose models unless you opt in. If you connect a Google account, we use your Gmail, Calendar, and Drive data only to answer the requests you make, change nothing there without your tap on an approval card, and never use it for advertising or model training (see Section 17). Experts who upload other people's personal data are responsible for that data in their own right. You have rights over your data — access, correction, deletion, objection, portability — and you can exercise them by emailing [email protected]. This box is a convenience summary only; the full Policy below is what legally applies.
1. Scope and Who This Policy Applies To
1.1 This Policy applies to everyone whose personal data we process in connection with the Platform, including Experts, End Users, visitors to our website, and individuals whose personal data may be contained within Expert Content or User Content.
1.2 Sections 5 and 6 contain provisions that apply specifically to Experts and End Users respectively. Where a general section conflicts with a role-specific section, the role-specific section governs for that role.
1.3 This Policy does not apply to third-party websites, services, or AI tools that you may access through or alongside the Platform. Those services have their own privacy policies, and we are not responsible for their practices (see Section 10 of the Terms).
2. Definitions
- "Personal data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
- "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and erasure.
- "Controller" means the party that determines the purposes and means of processing personal data.
- "Processor" means a party that processes personal data on behalf of, and on the documented instructions of, a controller.
- "Sub-processor" means a third party engaged by us to process personal data in the course of providing the Platform.
- "Digital Brain," "Expert," "End User," "Expert Content," "User Content," "Output," "Token," "Revenue Share," and "Active Status" have the meanings given in Section 2 of the Terms.
3. Our Role: Controller and Processor
3.1 Where we act as controller. We act as a data controller for personal data we process for our own purposes, including: account registration and administration, billing and payouts, Platform security and abuse prevention, customer support, product analytics, legal compliance, and marketing communications where permitted.
3.2 Where we act as processor. Where an Expert uploads Expert Content containing personal data of third parties (for example, client records embedded in an uploaded document), or where a Digital Brain collects personal data from End Users at the Expert's direction, the Expert is the independent controller of that personal data and we act as a processor on the Expert's behalf, as described in Section 9.2 of the Terms.
3.3 Expert obligations as controller. If you are an Expert processing personal data of others through the Platform, you are responsible for: (a) establishing a valid legal basis for that processing; (b) obtaining any consents required by applicable law; (c) providing the required privacy information to those individuals; (d) responding to their data subject requests; and (e) entering into a data processing agreement ("DPA") with us where required by Article 28 GDPR. Our standard DPA is available by request from [email protected].
3.4 Independent controllers. In relation to their own account, contact, and payout data, and in relation to End User data they receive in their own right, the Company and the Expert each act as independent controllers.
4. Personal Data We Collect
4.1 Data you provide directly
| Category | Examples | Applies to |
|---|---|---|
| Account data | Name, email address, password (hashed), profile photo, biography, country of residence, language preference | Experts, registered End Users |
| Identity and verification data | Identity documents, credentials, professional qualifications where you choose to disclose them under Section 5.3(e) of the Terms | Experts |
| Payment and tax data | Bank account or wire transfer details, billing address, VAT or tax identification number, payout history | Experts (payouts), paying End Users |
| Expert Content | Documents, text, audio, video, images, links, knowledge bases, prompts, and instructions uploaded to create, train, or configure a Digital Brain — which may itself contain personal data of the Expert or of third parties | Experts |
| User Content | Messages, prompts, files, and other input submitted to a Digital Brain | End Users |
| Communications | Support tickets, emails, reports of abuse or violations, survey and feedback responses | All users |
4.2 Data we generate or collect automatically
| Category | Examples |
|---|---|
| Output | Responses generated by a Digital Brain in reply to User Content |
| Usage data | How the Platform is used, such as features and screens used, Digital Brains interacted with, Token consumption, and Active Status metrics |
| Session recordings | How people move through the Platform, with safeguards that limit personal data (see Section 12.4) |
| Technical data | IP address, browser type and version, operating system, device identifiers, approximate location derived from IP, referring URL, crash and error logs |
| Cookies and similar technologies | Session identifiers, authentication tokens, preference settings, analytics identifiers (see Section 12) |
| Security and integrity data | Login records, authentication events, rate-limit and fraud-detection signals, moderation flags |
4.3 Data from third parties
We may receive personal data from: payment and payout providers (transaction confirmations, chargeback notices); identity or tax verification providers where used; authentication providers if you sign in via a third-party account; Google, if you connect a Google account (see Section 17); and analytics or infrastructure providers. We may also receive personal data about you from an Expert or End User, for example in a report of a violation.
4.4 Sensitive data
We do not intentionally collect special categories of personal data under Article 9 GDPR (such as health, biometric, religious, or political data). Consistent with Sections 5.4 and 9.3 of the Terms, Experts must not upload another person's sensitive personal data without a valid legal basis and, where required, explicit consent, and we strongly discourage uploading such data unless strictly necessary. End Users should not submit sensitive personal data through User Content unless they choose to do so and understand that it will be processed as described in this Policy.
5. How We Use Personal Data and Our Legal Bases
We process personal data only where we have a legal basis under Article 6 GDPR.
| Purpose | Categories used | Legal basis |
|---|---|---|
| Creating and administering accounts; authenticating you | Account, technical | Performance of a contract (Art. 6(1)(b)) |
| Operating the Platform, hosting Expert Content, and generating Output in response to User Content | Expert Content, User Content, Output, usage | Performance of a contract (Art. 6(1)(b)) |
| Calculating Token consumption, Active Status, and Revenue Share; making payouts | Usage, payment, account | Performance of a contract (Art. 6(1)(b)) |
| Meeting accounting, tax, and financial record-keeping obligations | Payment, tax, account | Legal obligation (Art. 6(1)(c)) |
| Providing customer support and responding to your requests | Account, communications, usage | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Content moderation, safety review, and enforcement of the Terms | Expert Content, User Content, Output, usage, moderation flags | Legitimate interests in a safe and lawful Platform; legal obligation where applicable (Art. 6(1)(f), (c)) |
| Detecting and preventing fraud, abuse, artificial inflation of usage metrics, and security incidents | Technical, usage, security, payment | Legitimate interests in protecting the Platform, Experts, and End Users (Art. 6(1)(f)) |
| Maintaining, debugging, securing, and improving Platform functionality and performance | Technical, usage, aggregated content signals | Legitimate interests (Art. 6(1)(f)) |
| Product analytics, measuring feature adoption, and understanding feedback | Technical, usage, communications, and the content you give feedback on | Legitimate interests, or consent where required for non-essential cookies (Art. 6(1)(f), (a)) |
| Sending service and transactional messages (security alerts, payout notices, Terms changes) | Account, communications | Performance of a contract; legal obligation (Art. 6(1)(b), (c)) |
| Sending marketing communications about the Platform | Account, communications | Consent, or legitimate interests for existing users where permitted by applicable law (Art. 6(1)(a), (f)) |
| Using content to improve or fine-tune AI models beyond Platform operation | Expert Content, User Content, Output | Consent — opt-in only (Art. 6(1)(a)) |
| Establishing, exercising, or defending legal claims; responding to lawful requests from authorities | Any relevant category | Legal obligation; legitimate interests (Art. 6(1)(c), (f)) |
Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests are not overridden by your rights and freedoms. You may request a summary of that assessment at [email protected].
6. AI Processing and Model Training
6.1 How Output is generated. The Platform relies on third-party AI models and cloud infrastructure to generate Output, as described in Section 10 of the Terms. When an End User interacts with a Digital Brain, the relevant User Content, together with the applicable Expert Content, configuration, and instructions, is transmitted to our AI infrastructure providers for the sole purpose of generating a response. We also use these providers to help us understand feedback you send us, on the same terms.
6.2 No training by default. We do not use Expert Content, User Content, or Output to train our own general-purpose AI models, and we contractually require our AI infrastructure providers not to use data submitted through the Platform to train their models, unless you have separately opted in under Section 6.3.
6.3 Opt-in model improvement. We may offer a voluntary programme allowing Experts or End Users to permit their content to be used to improve model quality, safety, or Platform performance. Participation is optional, is based on your consent, and can be withdrawn at any time by emailing [email protected], with effect from the point of withdrawal. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
6.4 Digital Brains are not the Expert. A Digital Brain is an AI system that simulates an Expert's knowledge and style. Interacting with a Digital Brain does not create a professional, confidential, or privileged relationship with the Expert, and content you submit is processed as described in this Policy rather than under any professional duty of confidentiality.
6.5 Automated decision-making. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, within the meaning of Article 22 GDPR. Automated systems do assist in content moderation, fraud detection, and Active Status calculation; where such a system results in suspension of your account, forfeiture of Revenue Share, or removal of a Digital Brain, you may request human review by contacting [email protected].
7. Data Relating to Experts
7.1 Public information. Information you choose to publish as part of your Expert profile or Digital Brain — such as your name, photo, biography, stated credentials, and the persona your Digital Brain presents — is visible to End Users and may be indexed by search engines. Do not include information you are not comfortable making public.
7.2 Expert Content. We host and process Expert Content in order to operate your Digital Brain and generate Output, under the licence granted in Section 5.2.2 of the Terms. Personal data within Expert Content is processed as described in Section 3.2 above.
7.3 Interaction data. We may make available to you aggregated or individual analytics about how End Users interact with your Digital Brain, including message volumes, Token consumption, and Active Status progress. Where this includes personal data of End Users, you act as a controller of that data and must handle it in accordance with applicable law and this Policy.
7.4 Payout data. Payment and tax data is processed to calculate and make Revenue Share payments under Sections 5.7 and 5.8 of the Terms, and retained for the statutory accounting periods described in Section 9.
8. Data Relating to End Users
8.1 Conversation data. User Content and Output are stored so that we can operate conversation history, provide support, enforce the Terms, and, where the Expert's configuration permits, provide the relevant Expert with analytics about interactions with their Digital Brain. If you rate an answer or give us feedback on it, we may review it together with the related conversation to improve the Platform.
8.2 Visibility to Experts. Depending on the configuration of a Digital Brain, an Expert may be able to view conversation content submitted to it. Do not submit information to a Digital Brain that you would not want the Expert operating it to see. This never includes Google user data or content derived from it, which Experts cannot view (see Section 17.9).
8.3 Unregistered End Users. Where you interact with a Digital Brain without a registered account, we still process technical and usage data, User Content, and Output as described in this Policy.
9. Who We Share Personal Data With
9.1 We share personal data only as described below, and never sell personal data.
| Recipient category | Purpose | Examples |
|---|---|---|
| AI model providers | Generating Output in response to User Content; helping us understand feedback | OpenAI, Anthropic |
| Cloud hosting and infrastructure | Hosting, storage, backups, content delivery | AWS |
| Payment and payout providers | Processing fees, Token purchases, and Revenue Share payouts | PayPal, Bank wire, Stripe |
| Analytics and product measurement | Understanding how the Platform is used and how it performs | PostHog |
| Communications and support tooling | Sending service emails, handling support tickets, and internal team notifications | Zendesk |
| Security, moderation, and anti-fraud services | Detecting abuse, artificial usage inflation, and security threats | Cloudflare |
| Professional advisers | Legal, accounting, audit, and insurance purposes | Law firms, auditors, accountants |
| Authorities and legal parties | Complying with law, court orders, or lawful requests; establishing or defending legal claims | Courts, regulators, tax authorities |
| Acquirers | In connection with a merger, acquisition, restructuring, or sale of assets, subject to Section 17.4 of the Terms | Prospective buyers under confidentiality |
9.2 Experts. As described in Sections 6.5 of the Terms and 8.2 above, User Content submitted to a Digital Brain may be shared with the Expert operating that Digital Brain. Google user data, and content derived from it, is never shared with an Expert (see Section 17.9).
9.3 Processors. Where a recipient acts as our processor, we put in place a written agreement meeting the requirements of Article 28 GDPR, requiring them to process personal data only on our instructions and to apply appropriate security measures.
9.4 An up-to-date list of our sub-processors is available via email request [email protected]. Experts subject to a DPA with us will be notified of changes to that list in accordance with the DPA.
10. International Transfers
10.1 We are established in Estonia and store personal data primarily within the European Economic Area ("EEA"). However, some of our providers — in particular AI model, cloud infrastructure, and product analytics providers — may process personal data outside the EEA, including in the United States.
10.2 Where we transfer personal data outside the EEA, we rely on an appropriate transfer mechanism under Chapter V GDPR, which may include: an adequacy decision of the European Commission; the European Commission's Standard Contractual Clauses; or, where applicable, an approved certification framework. Where required, we carry out a transfer impact assessment and apply supplementary technical and organisational measures.
10.3 You may request a copy of the relevant safeguards by emailing [email protected].
11. How Long We Keep Personal Data
11.1 We retain personal data only for as long as necessary for the purposes set out in this Policy, or for as long as required by law.
| Data | Retention period |
|---|---|
| Account data | For the life of your account, then deleted or anonymised within 90 days of account closure |
| Google account connection | Until you disconnect the Google account or close your account; see Section 17.8 |
| Expert Content | Until deleted by the Expert or the Digital Brain is deleted, then removed from active systems within 30 days |
| User Content and Output | 24 months from the interaction, or until deletion is requested, whichever is earlier |
| Payment, payout, and tax records | 7 years, as required by the Estonian Accounting Act |
| Security, access, and moderation logs | 12 months, or longer where relevant to an ongoing investigation |
| Support communications | 12 months from resolution |
| Product analytics and feedback data | Up to 7 years |
| Session recordings | 30 days |
| Marketing consent records | Until consent is withdrawn, plus 12 months to evidence the withdrawal |
| Data relevant to a legal claim, dispute, or regulatory request | Until the matter is finally resolved and any applicable limitation period expires |
11.2 As noted in Section 5.2.3 of the Terms, residual copies may persist in encrypted backups, security logs, or archival systems for a limited period after deletion from active systems. Such copies are isolated from active processing and are deleted or overwritten on the standard backup cycle.
11.3 Where continued retention is unnecessary but full deletion is impractical, we may irreversibly anonymise the data instead, in which case it is no longer personal data.
12. Cookies and Similar Technologies
12.1 We use cookies and similar technologies to operate the Platform, keep you signed in, remember your preferences, measure usage, and protect against fraud and abuse.
12.2 Strictly necessary cookies are used on the basis of our legitimate interests and cannot be disabled without affecting Platform functionality. Analytics. We use analytics tools to understand how the Platform is used and to improve it. These tools may use identifiers and similar technologies and, when you sign in or create an account, may link your activity to your account. We do not set marketing or advertising cookies, and we do not currently operate a cookie consent banner.
12.3 You can control cookies through your browser settings, and you can object to analytics processing at any time by emailing [email protected], as described in Section 14. Disabling certain cookies may limit Platform functionality.
12.4 Session recordings. To find and fix problems in the Platform, we may record how people use it, such as screens viewed and actions taken. We apply safeguards to limit personal data in recordings, including masking what you type and the content of conversations. Recordings do not include content from a connected Google account (see Section 17). Recordings do not capture audio. They are kept for 30 days, access is limited to authorised staff, and they are processed by our analytics provider on our behalf. You can object at any time as described in Section 12.3.
13. Security
13.1 We implement appropriate technical and organisational measures under Article 32 GDPR to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These include encryption in transit and at rest, access controls and least-privilege permissions, logging and monitoring, staff confidentiality obligations, secure development practices, and vendor due diligence.
13.2 No system is completely secure. As set out in Sections 3.2 and 12.1 of the Terms, you are responsible for keeping your login credentials confidential, and you must notify us immediately at [email protected] if you suspect unauthorised use of your account.
13.3 In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours where required by Article 33 GDPR, and will notify affected individuals without undue delay where Article 34 GDPR requires it.
14. Your Rights
14.1 Subject to the conditions and exceptions in applicable law, you have the right to:
- Access — obtain confirmation of whether we process your personal data and receive a copy of it;
- Rectification — have inaccurate or incomplete personal data corrected;
- Erasure — have your personal data deleted where one of the grounds in Article 17 GDPR applies;
- Restriction — have processing restricted in the circumstances set out in Article 18 GDPR;
- Portability — receive personal data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
- Object — object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object to direct marketing at any time without justification;
- Withdraw consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
- Human review — request human review of a significant automated decision, as described in Section 6.5.
14.2 How to exercise your rights. Email [email protected]. Some rights you can exercise yourself in the app: "What the Digital Brains remember" erases the profile built from your conversations, and your account details can be corrected in your profile. We will respond within one month of receipt, which may be extended by up to two further months for complex or numerous requests, in which case we will inform you within the first month. We may ask for information to verify your identity before acting on a request.
14.3 Requests relating to Expert Content. Where we process your personal data as a processor on behalf of an Expert (see Section 3.2), please direct your request to that Expert in the first instance. If you contact us, we will forward the request to the relevant Expert and assist them in responding as required by Article 28(3)(e) GDPR.
14.4 Complaints. If you believe we have processed your personal data unlawfully, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, [email protected], www.aki.ee, or with the supervisory authority in your country of residence or place of the alleged infringement. We would appreciate the opportunity to address your concerns directly first.
15. Children
The Platform is not intended for children. As set out in Section 1.1 of the Terms, you must be at least 18 years old, or the age of legal majority in your country of residence if higher, to use the Platform. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a person under the applicable age, we will delete it without undue delay. If you believe a child has provided us with personal data, contact [email protected].
16. Marketing Communications
16.1 We may send you service and transactional messages — such as security alerts, payout notifications, and notice of changes to the Terms or this Policy — which are necessary to our relationship with you and which you cannot opt out of while you hold an account.
16.2 We will send marketing communications only with your consent, or where permitted by applicable law on the basis of an existing relationship in respect of similar services. You can unsubscribe at any time using the link in any marketing email or by emailing [email protected]. We may measure how our emails are used, for example whether a link was followed, to improve them.
17. Google User Data
17.1 Scope. This Section applies if you connect a Google account to the Platform. It explains how we access, use, store, share, and delete data we receive through Google APIs ("Google user data"). For Google user data, this Section governs where it is more specific than the rest of this Policy.
17.2 When we access Google user data. Connecting a Google account is optional and is available only to registered users. When you connect, Google asks you to grant access, and each Google service (Gmail, Google Calendar, and Google Drive) stays off until you turn it on. You can turn a whole service or a single ability off at any time in Settings → Connected accounts. We access Google user data only when you ask a Digital Brain or the Platform's assistant for something that needs it, for example "what's important in my mail today". We do not access it in the background.
17.3 What we access and why. We ask Google only for the permissions listed below. When you sign in with Google to connect an account, we also receive your Google account's email address, so we can show you which account is connected.
| Google service and permission | What we read, to answer your request | What we do, only after your approval (Section 17.5) |
|---|---|---|
| Gmail (gmail.modify) | Search your mail; read a message or a thread; list and read your drafts; list your labels and filters; read your vacation reply; read your mailbox address and message counts | Send a new email; reply to an email; save a draft; send a draft; move an email or a conversation to Gmail's Trash |
| Google Calendar (calendar.events, calendar.calendarlist.readonly) | List your calendars; search and read your events; find your free time | Create an event (Google emails each guest an invitation); change an event's time, title, place, description, or guests; move an event you organize on a calendar you own to that calendar's trash (Google emails each guest that it is cancelled); repeating events are not moved |
| Google Drive (drive.readonly, drive.file) | Search your files; list recent files and the contents of a folder; read Google Docs, Sheets, Slides, and text files; read comments on a file; list the files in your trash | Save a new Google Doc to your Drive from text the assistant wrote; move a document the Platform saved to your Drive's trash |
17.4 What we never do with these permissions. We do not permanently delete emails, events, or files, empty your trash, set up mail forwarding, forwarding addresses, delegates, or send-as addresses, change IMAP or POP settings, share or delete a calendar or change its owner, change, or move to the trash, a Drive file the Platform did not save, change the owner of a file, or make a file available to anyone with a link.
17.5 Your approval before any change. We send an email, create or change a calendar event, save a document to your Drive, or move an email, an event, or a file to Google's trash only after you tap Approve on an approval card in your conversation. The card shows what will happen before it happens: the email exactly as it will be sent, with its sender, recipients, and subject; the event, and whether its guests will be notified; the document and the folder it will be saved to; or the email, event, or file that will go to the trash. Anything we move to the trash stays in Gmail's, Google Calendar's, or Google Drive's own trash, where Google keeps it for 30 days and you can restore it. Nothing is sent, created, changed, or moved until you tap. A spoken "yes" during a voice call does not approve an action, and text found in your mail, calendar, or files is treated as untrusted and cannot approve one.
17.6 How we use Google user data. We use Google user data only to provide the feature you asked for: to answer your request, or to carry out an action you approved. We do not:
- use it to serve advertising, including personalised, retargeted, or interest-based advertising;
- use it to develop, improve, or train AI or machine-learning models, whether ours or anyone else's, including generalised models;
- add it, or content derived from it, to the memory and profile that Digital Brains build from your conversations (see Section 14.2), or use it for quality evaluation of the Platform;
- sell it, or transfer it to data brokers or other information resellers;
- use it to determine creditworthiness or for lending purposes.
17.7 AI providers. To answer your request, the Google user data it needs (for example, the text of the emails a search found) is sent, together with your request, to the AI model providers listed in Section 9.1 (OpenAI and Anthropic), and is processed on the infrastructure of Amazon Web Services, including Amazon Bedrock where we use it. These providers act as our processors. They process Google user data only to generate the reply to that request, and their terms prohibit them from using it to train their models. They may retain it for a limited period solely to detect abuse, where their terms provide for this.
17.8 What we store and for how long.
| Data | What we keep | How long |
|---|---|---|
| Your Google connection | The access and refresh tokens Google issues (encrypted at rest), the connected account's email address, the permissions Google granted, and your service and ability settings | Until you disconnect the account or delete your PickMyBrain account; the tokens are deleted on disconnection |
| Google user data read to answer a request | Nothing beyond that request. Our diagnostic records of the request note that a Google function was called and with what inputs, never what Google returned. Temporary data held while a request waits for your approval is cleared when the request ends | Diagnostic records are deleted with your account |
| The reply and approval cards | The assistant's reply, which may quote or summarise Google user data, is part of your conversation and is stored as Output. An approval card is kept with the conversation as a record of what you approved | As set out for User Content and Output in Section 11; you can delete a conversation at any time |
Residual copies in encrypted backups are handled as described in Section 11.2.
17.9 Who can see Google user data. Our back office does not show content derived from Google user data: records of requests that used it show only volumes and timing, and they cannot be sent to an AI model for analysis. Our staff do not read Google user data unless (a) you explicitly ask us to, for specific content, for example in a support request; (b) it is necessary for security purposes, such as investigating abuse or a security incident; or (c) it is required to comply with applicable law. Experts cannot see your Google user data or replies derived from it: Google services work only in your own conversations as a registered user, which are not visible to the Expert operating a Digital Brain (see Sections 8.2 and 9.2).
17.10 Sharing. We do not share or transfer Google user data except: (a) to the processors described in Section 17.7, to answer your request; (b) to Google itself, when you approve an action, and to the recipients of an email or event you approve; (c) where required to comply with applicable law; and (d) as part of a merger, acquisition, or sale of assets, only after obtaining your explicit prior consent.
17.11 Disconnecting and deleting your data. You can disconnect your Google account at any time in Settings → Connected accounts → Disconnect. When you disconnect, we revoke our access at Google, delete the stored tokens, and turn every Google service off. You can also remove PickMyBrain's access from your Google account at myaccount.google.com/permissions. To delete your PickMyBrain account, email [email protected]. Deleting your account revokes our access at Google, deletes the stored tokens and the diagnostic records of your conversations, and deletes your other data as described in Section 11.
17.12 Limited Use. PickMyBrain's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
18. Changes to This Policy
18.1 We may update this Policy from time to time to reflect changes in our Platform, legal requirements, or business practices. We will post the updated Policy with a revised "Last Updated" date and, for material changes, provide reasonable advance notice via the Platform, email, or other reasonable means.
18.2 Where a change requires your consent under applicable data protection law, we will obtain that consent before the change takes effect in respect of you.
18.3 Your continued use of the Platform after an updated Policy takes effect constitutes acknowledgement of the updated Policy. If you do not agree, you must stop using the Platform and may close your account as described in Section 11.2 of the Terms.
19. Contact Us
If you have any questions about this Policy, wish to exercise your rights, or want to raise a data protection concern, please contact us at:
Vrtcl OÜ Maakri 19, Tallinn, Estonia Registry code: 16281254 Email: [email protected]