Privacy Policy

Last updated: July 13, 2026 · Version 2.0

This Privacy Policy explains how Uru Capital LLC, a Delaware limited liability company doing business as GetABrain.ai ("GetABrain", "we", "us"), the data controller, collects, uses, and protects your personal data. It is part of our Terms of Service.

1. Data We Collect

• Account information: Name, email address, phone number, password (hashed), and account type (Worker or Requestor).
• Identity and payout information: Verification and payout details collected and processed by Stripe (for Workers, including tax information such as a W-9). We do not store full bank or card numbers on our servers.
• Query and Response data: Queries submitted by Requestors and Responses provided by Workers, including any voice, video, or photo captures, and metadata such as timestamps and quality ratings.
• Behavioral data for bot detection: Interaction timing, mouse movement, keystroke cadence, and similar signals used to verify that Responses are human-generated.
• Device and browser information: Browser type, operating system, screen resolution, and language preferences.
• IP addresses: Collected for security, fraud prevention, and rate limiting.

2. How We Use Your Data

• Provide and maintain the Service: Operate the platform, match Workers with Queries, and deliver Responses.
• Process payments: Handle billing for Requestors and payouts for Workers through Stripe.
• Improve quality: Calculate quality scores, manage rate limits and tiers, and improve reliability.
• Detect fraud and abuse: Identify and prevent bot activity, fake or multiple accounts, and other abuse.
• Communicate with you: Send account, security, and service notifications, and (where permitted) product updates.

3. Legal Bases for Processing

Where the GDPR or similar laws apply, we process personal data on these legal bases: performance of a contract (to provide the Service and process payments); legitimate interests (to secure the platform, prevent fraud, and improve the Service, balanced against your rights); legal obligation (tax, accounting, and compliance); and consent (where required, for example certain analytics cookies, which you may withdraw at any time).

4. Data Sharing and Sub-Processors

We share personal data only as needed to run the Service, with service providers who process it on our behalf under contract:

• Supabase— database and application hosting.
• Stripe— payments, payouts, identity verification, and tax reporting.
• Twilio— phone-number verification.
• Resend— transactional email delivery.
• Eden AI— automated content-moderation checks.
• Google (Google Analytics 4) and PostHog— product and usage analytics.
• Google reCAPTCHA— bot and abuse detection.

We may also access, preserve, and disclose data to law enforcement or other authorities where required by law or valid legal process; where we believe in good faith it is necessary to enforce our Terms of Service and related agreements, detect, prevent, or investigate fraud, abuse, or security issues, or protect the rights, property, or safety of GetABrain, our users, or others; and in connection with a merger, financing, or sale of assets. We do not sell your personal data,and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

5. Automated Decision-Making

We use automated systems to score response quality, assign tiers and rate limits, detect bots and fraud, and, in some cases, automatically suspend or restrict accounts (for example, when a Worker's quality score falls below our threshold, or when automation is detected). These decisions can significantly affect you. You have the right to request human review of a significant automated decision, to express your point of view, and to contest it, by contacting us at privacy@getabrain.ai.

6. Data Retention

• Account data: Retained while your account is active, plus 30 days after account deletion to allow for recovery.
• Financial records: Retained for 7 years to comply with tax and financial-reporting requirements.
• Bot-detection data: Behavioral data used for bot detection is retained for 90 days and then automatically purged.

7. Cookies & Tracking

• Essential cookies: Required for authentication and to maintain your login session.
• Analytics: We use Google Analytics 4 and PostHog to understand how the platform is used and to improve it. Where required, we obtain consent for non-essential analytics cookies.

8. Your Rights Under GDPR

If you are in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion, subject to legal retention requirements.
• Restriction: Request that we restrict processing in certain circumstances.
• Portability: Request a machine-readable copy of your data.
• Object: Object to processing based on legitimate interests.
• Withdraw consent and lodge a complaint with your local data-protection supervisory authority.

To exercise these rights, contact privacy@getabrain.ai. We will respond within the time required by law (generally 30 days).

9. Your Rights Under U.S. State Privacy Laws

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know or access the personal information we collect, use, and disclose; to request deletion or correction; and to opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under those laws. We will not discriminate against you for exercising your rights. To make a request, contact privacy@getabrain.ai.

10. Security

• Encryption: Data is encrypted in transit using TLS/SSL, and sensitive data is encrypted at rest.
• Secure payments: Payment processing is handled by Stripe, a PCI DSS Level 1 certified processor.
• Ongoing review: We review our security practices and work to identify and address potential threats. No method of transmission or storage is 100% secure.

11. Children's Privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If we learn we have collected data from someone under 18, we will delete it promptly. Contact privacy@getabrain.ai if you believe we have.

12. International Data Transfers

We are based in the United States, and your data may be transferred to and processed there or in other countries whose laws may differ from yours. Where we transfer personal data internationally, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, where required.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy here, update the "Last updated" date, and, for material changes, provide additional notice. Your continued use of the Service after an updated policy takes effect constitutes acceptance of the update. Please review it periodically.

14. Contact Us

Uru Capital LLC, d/b/a GetABrain.ai. Questions about this Privacy Policy or our data practices: privacy@getabrain.ai.