Privacy Policy

Last updated: 27 June 2026

1. Overview

This Privacy Policy explains how mCoreBrain™ ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit mcorebrain.com (the "Platform"). This Platform is a proof-of-concept developed in the context of a Doctorate in Business Administration (DBA) research project at SSBM Geneva.

We are committed to protecting your privacy and processing personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679, the German Federal Data Protection Act (BDSG), and all applicable data protection legislation.

This policy applies to all visitors, registered users, survey participants, and beta testers of the Platform.

2. Data We Collect

2.1 Account & Authentication Data

When you register or sign in, we collect:

• Email address — required for account creation and communication
• Full name — optional, provided at signup
• Role / professional context — optional, e.g. investor, CRM manager, researcher
• OAuth provider tokens — if you sign in via GitHub; we receive your public profile name and email from that provider
• Encrypted password hash — if using email/password authentication (never stored in plain text)
• Account plan and status — free tier, active/inactive status
• Account creation timestamp

2.2 CRM Builder & Sandbox Data

When you use the Core AI builder, we store:

• Sandbox configurations — the AI-generated CRM JSON structures associated with your account
• Conversation history — messages exchanged with the Core AI agent within your session
• Session metadata — sandbox ID, session timestamps, and message counts
• Deployment records — history of any deployment actions taken

System configuration and metadata are generated using AI processing. Only metadata and configuration logic are processed externally — customer operational data remains in your configured environment. See Section 6 for details on third-party processors.

2.3 Research Survey Data

If you voluntarily participate in the DBA research survey:

• Survey responses are collected anonymously and cannot be traced back to individual users
• No personally identifiable information is required to complete the survey
• Aggregate, anonymised data may be published in academic papers or the doctoral dissertation
• Participation is entirely voluntary and you may withdraw at any time without consequence

2.4 Technical & Usage Data

We and our infrastructure providers automatically collect:

• IP address — used for security, fraud prevention, and access logs
• Browser type and version
• Operating system
• Referring URLs and page visits
• Timestamps of access and API calls
• Error logs and performance metrics

3. Legal Basis for Processing (GDPR Art. 6)

• Art. 6(1)(b) — Contractual necessity: Processing your email and authentication data to provide the Platform services
• Art. 6(1)(a) — Consent: Survey participation and optional profile information (full name, role)
• Art. 6(1)(f) — Legitimate interests: Security monitoring, fraud prevention, platform improvement, and academic research in AI-native CRM systems
• Art. 6(1)(c) — Legal obligation: Retaining records as required by applicable law

4. How We Use Your Data

• Providing and operating the mCoreBrain™ Platform and AI builder
• Authenticating your identity and managing your account
• Storing and retrieving your CRM sandbox configurations
• Generating system metadata, configuration logic, and structural definitions via AI processing layers
• Sending transactional emails (account confirmation, password reset)
• Analysing anonymised, aggregated usage patterns for academic research purposes
• Detecting and preventing unauthorised access, abuse, or security threats
• Complying with legal obligations

We do not sell your personal data. We do not use your data for targeted advertising. We do not share your data with third parties for their independent marketing purposes.

5. Data Retention

• Account data: Retained for the duration of your account and for up to 3 years after account deletion, as required for legal and dispute resolution purposes
• Sandbox and session data: Retained while your account is active; deleted within 90 days of account deletion upon request
• Server/access logs: Retained for up to 90 days for security monitoring
• Survey responses: Retained indefinitely in anonymised, aggregated form for academic research
• Backup data: May be retained in encrypted backups for up to 30 additional days after deletion

6. Third-Party Data Processors

We use the following sub-processors. All are bound by data processing agreements and appropriate safeguards:

7. Cookies & Local Storage

mCoreBrain™ does not use tracking cookies or advertising cookies.

We use browser localStorage (not cookies) to store your session token and user profile locally on your device. This is strictly necessary for the Platform to function and does not require consent under GDPR Recital 47. This data:

• Is stored only on your own device
• Contains your JWT access token and basic profile info (name, email, plan)
• Is cleared when you sign out
• Can be cleared manually at any time via your browser settings

Vercel may set essential infrastructure cookies for load balancing and DDoS protection. These do not track individuals across websites.

8. International Data Transfers

Some of our third-party processors are based in the United States. Transfers of personal data to the USA are made under Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46(2)(c) GDPR, providing appropriate safeguards for your data.

You may request a copy of the applicable transfer mechanisms by contacting us at info@mcorebrain.com.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:

• HTTPS/TLS encryption for all data in transit
• Encrypted storage of passwords (bcrypt hashing via Supabase Auth)
• JWT-based authentication with short-lived access tokens
• Row-level security (RLS) policies on all database tables
• API keys and service credentials stored as environment variables, never in source code
• Regular security monitoring and access logging

In the event of a personal data breach, we will notify affected users and the relevant supervisory authority (where required) within 72 hours of becoming aware, in accordance with Art. 33–34 GDPR.

10. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights, exercisable free of charge by contacting info@mcorebrain.com:

We will respond to requests within 30 days. In complex cases, this may be extended by a further 60 days, of which you will be notified.

You may also lodge a complaint with the competent supervisory authority in Germany: Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de), or the supervisory authority in your country of residence.

11. Children's Privacy

mCoreBrain™ is not directed at or intended for use by persons under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact info@mcorebrain.com and we will promptly delete such data.

12. Academic Research Context

This Platform is developed as part of a DBA doctoral research project at SSBM Geneva, supervised in accordance with academic ethics standards. Processing of anonymised, aggregated research data is carried out in the public interest of academic knowledge (Art. 6(1)(e) GDPR and Art. 89 GDPR).

No identifiable personal data is used in any published academic output. All research data used in publications is fully anonymised and aggregated.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. Continued use of the Platform after changes constitutes acceptance of the updated policy.

14. Contact