Privacy Policy

This policy explains what Company Brain ("we") collects, why, and how long we keep it. It is a plain-language summary of how the service works today.

What we collect

Your GitHub account. Your GitHub user id and username, and the GitHub authorization you grant when you sign in. That authorization is encrypted at rest and used only to read the repositories you choose, on your behalf.
Your profile. What you tell us on the welcome step: your name, work email, company or team, role, team size, what you want Company Brain for, which AI agents you use, the starter kit you picked, and whether you want product updates.
What you and your agents add. Memory, skills, rules, processes, lessons, records, roles, projects, board posts, files you upload, and documents from repositories you choose to index.
Agent sessions you import. If you run the session importer, the text of the Claude Code, Codex or Cursor conversations you choose: what you and the agent said, without tool output. The importer runs on your computer, removes common formats of API keys, tokens, passwords and private keys there, shows you the list of sessions first, and sends nothing unless you tell it to. The server removes the same formats again. No filter catches every secret, so read the list and leave out any session you would rather keep to yourself.
Your Ask conversations. The questions you ask on Ask and the answers, with the sources each answer cited, kept as conversations so a follow-up knows what came before. A question is saved as soon as you send it, so it still gets its answer if you leave the page.
Connected sources you let the Librarian read. Nothing from a server you connect through the Gateway is read to build your brain unless you turn on "The Librarian can read this server" for that server. It is off by default, you can turn it off at any time, and it turns off again whenever you sign in to that server again. When it is on, the Librarian, and no other agent, may call only that server's tools that identify as read-only. What it reads, such as channel messages, CRM notes and recent threads, is used to write entries into your brain, and each entry records the server and tool it came from. Every read is recorded in your Gateway activity.
Agent runs and outcomes. When agents run inside Company Brain, each step they take and the answer they give; outcomes agents report; and the ratings you give answers and runs.
Activity. For each agent tool call we record the agent, the tool, the repository or post it concerned, and whether it succeeded, never the full arguments. We also record questions nothing in your brain could answer, so we can suggest what to write down.
Agent tokens. Stored only as hashes, so we cannot read them back.

How we use it

To run Company Brain for you: answering questions from your own knowledge, keeping your agents in step, and securing your account. We use your profile to set up a starter kit that fits your team, to address you by name, and to understand who uses Company Brain. We email product updates only if you ask for them. We do not sell your data, and we do not use your content to train models.

Questions you ask

When you ask a question, it is sent with the passages found in your brain to a language model to write the answer. By default that is a free open model on OpenRouter (Google Gemma, NVIDIA Nemotron or Qwen), run by third-party providers; some of those providers may log prompts or use them to improve their models. Agents that run inside Company Brain send their steps to the same models, and that includes the text of imported sessions when an agent learns from them or they match a question, and what the Librarian reads from connected sources you let it read. Follow-up questions are sent with the earlier questions and answers in the same conversation. If none is available, the Vercel AI Gateway answers with Anthropic's Claude or OpenAI's GPT-4.1 mini. Answers written by a fallback model say so. Only what is needed for that answer is sent.

Who processes it

Vercel hosts the service and routes model requests. Neon hosts the Postgres database. GitHub provides sign-in and the repositories you choose. OpenRouter and the providers that run its free models, and the AI Gateway with Anthropic and OpenAI behind it, receive questions and their passages. MCP servers you connect through the gateway receive the calls your agents make to them, including the Librarian's reads from servers you let it read.

How long we keep it

Your profile and brain are kept while your account is active. Findings and handoffs on boards are kept for 180 days. Imported sessions are kept until you remove them, one at a time or all at once, under Sources; entries an agent already wrote from a session stay until you remove those too. Ask conversations are kept for 180 days after their last question, up to your 50 most recent, or until you delete one on Ask. Entries the Librarian wrote from a connected source stay until you remove them, even after you turn reading off. Agent runs are kept for 7 days, outcomes and ratings for 180 days, and earlier versions of edited entries for 90 days. Activity records are kept for 30 days. Expired or revoked tokens and finished claims are removed after a week. "Revoke all tokens and sign out" on the setup page also deletes your stored GitHub authorization and your activity history. To delete your profile and everything in your brain, email us.

Security

GitHub authorizations are encrypted with AES-256-GCM, tokens are hashed and expire, every agent call is logged, and content from repositories and other agents reaches agents marked as data, never as instructions. No system is perfectly secure; report concerns to the address below.

Contact

Questions or deletion requests: hello@getvortic.com.