1. Overview
BytesBrains (“BytesBrains”, “we”, “us”) respects your privacy. This policy describes the information we collect, how we use it, and the choices you have. It applies to our public website and the authenticated areas of our services.
2. Information We Collect
Account information
When you sign in (for example, with Google), we receive basic profile information such as your name, email address, and profile photo. We use this to create and manage your account.
Inquiries & communications
When you submit an inquiry or contact us, we collect the details you provide — such as your subject, message, and any optional company, industry, budget, or timeline information — along with the message thread, so our team can respond and track the conversation.
Usage information
We may collect limited technical information automatically, such as device and browser type, approximate location, and how you interact with the Services, to keep them secure and improve them.
3. How We Use Your Information
- To provide, maintain, and improve our Services;
- To authenticate you and secure your account;
- To respond to your inquiries and provide support;
- To communicate with you about your account or our services;
- To detect, prevent, and address fraud, abuse, or security issues; and
- To comply with legal obligations.
4. How We Share Information
We do not sell your personal information. We share information only:
- With service providers who process data on our behalf — including Google Cloud and Firebase for authentication, data storage, and hosting, Tucows/OpenSRS for domain registration and for hosting the mailboxes themselves, the model hosts named on our Sub-processors page for Cruise, Airwallex for card payments, and Telegram, which delivers internal alerts to our staff — including the name and email address on a new account or inquiry;
- For legal reasons, where required by law or to protect rights and safety; and
- In a business transfer, such as a merger or acquisition, subject to this policy.
5. Domain Registrant Details
Registering a domain requires contact details for the registrant — name, postal address, email address and telephone number — and these are treated differently from everything else in this policy, because their destination is not up to us.
- They are passed to our registrar (Tucows/OpenSRS) and, through them, to the registry operating your chosen extension. Both are required to hold them under ICANN policy.
- Some registries publish some of them. What appears in public WHOIS/RDAP records varies by extension and by applicable law; many registries now redact personal data by default, but this is their decision and not ours.
- ICANN requires them to be accurate and reachable. A registration whose contacts cannot be verified may be suspended, so we cannot minimise or anonymise these fields the way we would prefer to elsewhere.
- They are retained beyond your relationship with us — registrars are obliged to keep registration records for a period set by ICANN, independently of any deletion request made to us.
We store the registrant details you give us so a second purchase does not ask you to type them again, and you can review or replace them from your dashboard. The registrar management credentials for your domains are kept in a separate store that no browser can read.
6. Business Email & the Contents of Your Mailbox
Mailboxes are hosted by Tucows/OpenSRS under their Hosted Email service, not by BytesBrains. Your messages, attachments, folders, contacts and drafts live on their infrastructure, and your mail client, phone and webmail connect to their servers directly — that traffic does not pass through us.
What we hold for a mailbox is the account record and nothing else: the address, its storage size, its status, any aliases, who owns it, and the billing dates. We hold no message content, and we have no ability to read it. Our systems can create, rename, resize, suspend and delete a mailbox; there is no facility anywhere in our platform to open one. A request or legal demand for the contents of a mailbox is one we cannot satisfy and would have to direct to Tucows.
We never see or store your mailbox password. When you set or reset one it is passed straight to the mail provider and discarded.
Connections between your devices and the mail servers are encrypted in transit — IMAP on port 993 and POP3 on 995 over SSL/TLS, and SMTP on 587 with STARTTLS or 465 over SSL. How your messages are stored and protected once they arrive is governed by Tucows' own security practices and privacy policy rather than by ours, and we would encourage you to read them. If you require your mail to be encrypted such that no provider can read it, that is achieved with end-to-end encryption in your own mail client — for example PGP or S/MIME — using keys only you hold. Nothing in this service prevents that, and nothing in it provides it.
Because the mail is hosted by a third party, it may be stored and processed outside your own country; see International Data Transfers below. Deleting a mailbox deletes its contents at the provider, and that is not reversible by us. Suspending a mailbox — for non-payment, for example — deletes nothing.
7. Cruise — What Leaves for Model Providers
Cruise forwards each request to a third-party model host chosen by the lane that serves it. The prompt, any attached inputs and the completion therefore leave BytesBrains's systems and are processed by that host under its own terms and privacy policy. The hosts that may receive content are named on our Sub-processors page. We do not promise a single provider for a given call; see the Terms of Service, Cruise section.
Retention posture is disclosed per model (none / retained / trains / null). Models that may train on prompts, and models whose retention is unrecorded, are available by default on Cruise Cloud. Unrecorded means we have not verified the host's practice — not that prompts are safe there. A lane with no-training-on-data excludes both trains and null. Sending personal data through a training or unrecorded model is your responsibility; see the Terms.
Organisations that cannot accept third-party hosts on Cruise Cloud may contact us about Cruise Enterprise (BYOK / BYOI on their infrastructure) at contact@bytesbrains.com. Cloud does not provide that isolation.
8. Cruise — What We Retain
For every request we keep a ledger row: tokens, cost, model, key prefix, traffic class, cache scope and a body digest — an unsalted SHA-256 of the normalised request body. We do not store the prompt or the completion in that ledger. A digest cannot be reversed into content, but someone who already guesses the exact input can confirm the guess.
Customer traffic uses a gateway that does not log payloads. If caching is enabled for a lane or request, the model's complete output (for a stream, every frame) may be stored verbatim for up to the configured TTL, with a ceiling of thirty days. Production lanes start with caching off unless you enable it. Cache entries in a wider pool than your project are shared only when you choose that pool at key issue.
Account and workspace records (who owns the workspace, memberships, billing references) are held so we can operate the service and answer “which terms did this customer agree to.” Card details are taken on our payments provider's page and do not reach our servers; see Sub-processors.
9. Cruise — Retention When You Leave
Closing or disabling a workspace revokes keys and ends memberships. Ledger and audit rows that name those identifiers outlive the workspace; there is no customer erasure path for them today. Cache entries expire on their TTL. This is stated so an expectation of immediate deletion is not assumed.
10. Personal Data, PDPA and GDPR
BytesBrains is a Singapore company. Where the Personal Data Protection Act 2012 (PDPA) applies, we process personal data as described in this policy. If you are in the European Economic Area or the United Kingdom and GDPR or UK GDPR applies to your use of the Services, we process personal data as a controller for account, billing and site-operation data, and — where you send personal data through Cruise to model providers — you remain the controller of that content; we process it to route the request as your processor (or equivalent) under our Terms.
You may have rights to access, correct, export, delete, object to or restrict certain processing, and to lodge a complaint with a supervisory authority. Contact us at hello@bytesbrains.com to exercise them. Some Cruise records (ledger digests, audit rows) cannot be erased today; we will say so rather than imply a deletion we cannot perform.
If you need a written Data Processing Agreement for personal data you process through Cruise, contact us at hello@bytesbrains.com. We will provide one on request; this policy is not itself a DPA.
Model hosts and other sub-processors may process data outside Singapore and outside your country. Transfers to them are necessary to provide Cruise. Review their policies alongside ours.
11. Data Retention
We retain your information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Cruise ledger and audit retention is described in sections 8 and 9 above. You may request deletion of your account and associated data as described below; where we cannot erase a record we will say so.
12. Data Security
We use administrative, technical, and organizational measures designed to protect your information, including authentication controls and access rules. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
13. Your Rights & Choices
Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Section 10 describes how PDPA and GDPR apply. You can update your profile in your account. Signed-in users can delete their own account from Settings → Privacy: we anonymise personal details and keep payment, grant and order records needed for disputes and accounting. You can also contact us to exercise these rights. We will respond consistent with applicable law.
14. International Data Transfers
Your information may be processed in countries other than your own, including by our service providers and by the model hosts listed on Sub-processors. Where required, we take steps to ensure appropriate safeguards are in place for such transfers.
15. Cookies & Similar Technologies
Essential storage keeps you signed in and remembers settings needed for the Services. With your permission, we also use Google Firebase Analytics to understand page and product journeys, and Sentry to receive redacted browser error reports. Optional telemetry is off until you choose to allow it. We do not send form contents, account or resource identifiers, payment details, domain names, or URL query values to either provider. You can clear or change your choice through your browser's site-data controls; declining optional telemetry does not affect the Services.
16. Children's Privacy
Our Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us and we will take appropriate steps.
17. Third-Party Links
Our website may link to third-party sites and services we do not control. This policy does not apply to those sites, and we encourage you to review their privacy policies.
18. Changes to This Policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, provide additional notice of material changes. Material Cruise privacy changes travel with a terms-version bump so existing members accept again.
19. Contact Us
For privacy questions or requests, contact us at hello@bytesbrains.com.