Privacy Policy

1. Who we are

Braineura is the trade name of the product. For any matter related to this policy, contact ti@sublimador.com.br.

2. Data we collect

On this site:

• No measurement script is loaded and no cookie is set. Details in Cookies & tracking.
• This site has no forms: no name, email or phone number is collected here.

In the app (customers): account data needed for access, such as email and credentials (passwords stored only as Argon2id hashes; TOTP second factor); data from the sources the customer connects to the workspace, processed on the customer's behalf and isolated per workspace; and audit records of access, approvals and relevant changes.

Data obtained from Google APIs is described in the “Data from Google APIs” section.

3. Data from Google APIs

When a customer connects Google accounts to Braineura, access is authorized by the user on Google’s consent screen (OAuth). Braineura uses this access mainly to read data. Changes in Google accounts are limited to the operations described in “Changes made with human approval” below and are only performed after an explicit approval by a person authorized by the customer.

Data that may be read, depending on the products the customer connects:

• Google Ads: account data, campaigns, ad groups, ads, keywords, search terms, conversion actions and performance metrics (such as cost, impressions, clicks and conversions).
• Google Analytics 4: aggregated website metrics (sessions, users, channels, sources, landing pages, devices, countries and events).
• Google Search Console: the website’s search performance (impressions, clicks, queries and pages).
• Google Tag Manager: the published container configuration (tags and triggers), to verify measurement.
• Google Merchant Center: products and product performance.
• Google Business Profile: profile performance metrics.

Purpose. This data is used exclusively to provide Braineura’s features to the customer itself: performance analyses and reports, measurement diagnostics, recommendations, campaign drafts prepared for human review and, when the customer enables it, the publication of campaigns approved by a person. Recommendations are never applied automatically; changes in Google accounts only happen as described in “Changes made with human approval”.

Changes made with human approval. Only in the Google Ads and Merchant Center accounts that the customer linked to its own workspace, and only after a person authorized by the customer approves each specific operation in Braineura (account, budget, plan and the exact content of the operation), Braineura can: create new Google Ads campaigns in a paused state (Search and standard Shopping); enable or pause those campaigns; create purchase conversion actions that are not set as primary; and register Braineura’s Google Cloud project in the customer’s Merchant Center account so that its products can be read. Before a campaign is created or its status is changed, the operation is first validated with Google without being applied; afterwards it is reconciled with what was approved, and for Shopping campaigns the product selection is read back and verified. Apart from these operations, Braineura makes no other changes in Google accounts: it never deletes campaigns; it does not change campaigns, ads, keywords or budgets that already existed; it does not change billing, users, permissions or other account settings; it never applies recommendations automatically; and it never acts on accounts the customer did not link. Each approval and operation is recorded in the customer’s audit trail, isolated per workspace. A person authorized by the customer can pause a campaign created by Braineura at any time, directly in Google Ads.

Availability of change features. Currently available: registering the project in Merchant Center, and creating conversion actions, which stays off until the customer enables it. Creating, enabling and pausing campaigns through Braineura is still in development and is not performed on real accounts. While a change feature is not available or not enabled, Braineura only reads data.

Storage and protection. Google integrations run in the Braineura application of the operator authorized by the customer, which is what reads the Google APIs. Access tokens are kept in that computer’s operating system credential vault, never in files, are never displayed and are not sent to Braineura’s server or to the Braineura Brain. The data obtained is kept in the customer’s workspace, isolated per customer, in files accessible only to the system user. So that the Braineura Brain (a service on Braineura’s server that supports the store integration) can combine store results with marketing, the operator may send the server a copy of selected summaries for each customer: aggregated indicators from Google Ads, Google Analytics 4, Search Console, Merchant Center and Tag Manager (for example, cost and clicks per campaign, sessions per channel and per page, top search queries and pages, product status and tag configuration). This upload is done manually by the operator; each customer has a separate folder, which the Brain reads without being able to change it and uses only for that customer. Braineura also has a feature that lets the server read the Google APIs directly; it is turned off and no Google credential is stored on the server. If this feature is turned on, this policy will be updated first.

Sharing. Data from Google APIs is not sold, is not used for advertising and is not shared with third parties, except: with the infrastructure providers engaged by Braineura (server hosting and encrypted backup storage), which keep the data on Braineura’s behalf and do not use it for any other purpose; when the customer uses Braineura’s artificial intelligence features, aggregated performance data (without personal data) may be sent to the artificial intelligence provider engaged by Braineura only to generate the requested analysis or recommendation; and when required by law. Braineura does not use data from Google APIs to train artificial intelligence models. People only access this data to operate the service for the customer itself, for security, or when required by law.

Retention and deletion. Data read from Google is replaced at each synchronization. When the customer disconnects the Google account in Braineura, or revokes Google Ads access through Braineura, the access token and the data read through that connection are deleted from the workspace, including Google Ads search terms reports imported by the customer. If access is revoked directly at Google, Braineura detects it on the next read and shows that a reconnection is required; the data already obtained remains in the workspace until the customer disconnects the account in Braineura or requests its deletion. On the server, the copy of the summaries is replaced with each upload by the operator; after a disconnection it is only removed with the next upload or upon request. Disconnecting and revoking do not automatically delete what is already on the server or in backups. The Braineura Brain keeps each customer’s most recent analyses (up to 60); conversations older than 90 days (or another period set for the customer) are deleted when the customer sends a new message and, without new messages, remain until deleted upon request; the learnings it derives from this data are not deleted automatically. Derived analyses (indicators and recommendations calculated from this data) remain in the history of the customer’s workspace and are not deleted when the Google account is disconnected; they are deleted upon request, through the contact in this policy. Requests are handled manually by the Braineura team. Until selective deletion (only of what was derived from Google data) is available, the deletion may cover the workspace’s entire analysis history, including analyses based on other sources.

Backups. The server database, which includes the Brain’s analyses, learnings and conversations, is backed up daily. These backups are kept on the server itself (the Brain’s are deleted automatically after 14 days; the others are not deleted automatically) and are sent encrypted to external storage, where they cannot be deleted during the first 30 days and are not deleted automatically after that. The hosting provider also makes weekly backups of the whole server, including the copy of the Google summaries, which are replaced automatically by newer ones according to that provider’s cycle. Therefore, data deleted from the system may remain in these backups until it is removed manually or replaced.

How to request deletion. The customer can request deletion through the contact in this policy. Requests are handled manually by the Braineura team, which deletes the workspace data in the application, the copy of the summaries on the server and the customer’s analyses, learnings and conversations in the Brain. In the external backups, removal is also manual and is only possible after the 30 days during which they cannot be deleted; the hosting provider’s weekly backups are removed when they are replaced in its cycle.

Revocation. The user can revoke Braineura’s access at any time at myaccount.google.com/permissions. In Braineura, disconnecting the Google account deletes the access token, which can no longer be used; for Google Ads, the revoke option also invalidates the token at Google itself. Revoking access or disconnecting the account does not delete the copy on the server or the backups; for that, see “How to request deletion”.

Commitment. Braineura’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes

• Providing the contracted service and maintaining the customer account.
• Generating analyses, reports, measurement diagnostics, recommendations and campaign drafts from the sources the customer connects.
• Security, abuse prevention and auditing.
• Answering sales and support requests.
• Complying with legal obligations.

5. Sharing and processors

Braineura does not sell personal data and uses no third-party pixels on this site.

• Payments: once enabled, they will be processed by Stripe. Today no payment is made through this site.
• Public authorities, when required by law.
• Artificial intelligence provider engaged by Braineura, when the customer uses AI features, receiving only what is needed to generate the requested result.

6. Retention

• Account data: for as long as the account exists.
• Data from Google APIs: as described in the “Data from Google APIs” section.

7. Your rights

Subject to applicable law, you may request:

• confirmation of and access to your data;
• correction of incomplete or outdated data;
• deletion or anonymization;
• portability;
• information about who your data is shared with;
• withdrawal of consent and objection to processing.

To exercise these rights, use the contact below.

8. Contact

• Privacy, support and sales contact: ti@sublimador.com.br.

9. Changes to this policy

Material changes will be published on this page with a new effective date.

Effective date of this version: 2026-10-14.