Open Brain ("we", "us", "our") operates Meridian. This Privacy Policy explains how we collect, use, share, and protect information about you when you use our Service. For the full operational and compliance deep-dive, see our Data Compliance page.
Open Brain is the data controller for personal data processed through the Meridian Service. We act as a data processor in relation to the third-party AI model providers we route your prompts through. Contact us at privacy@openbrain.ai.
| Purpose | Lawful basis (GDPR) |
|---|---|
| Providing and maintaining the Service | Contract performance (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (receipts, alerts) | Contract performance (Art. 6(1)(b)) |
| Improving and developing the Service | Legitimate interests (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (with opt-out) | Consent (Art. 6(1)(a)) |
| Legal compliance and responding to legal requests | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data. We do not use your prompts or conversation content to train AI models without explicit consent.
We share your information only in the following circumstances:
We implement industry-standard security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, row-level security in our database, JWT-based authentication with short expiry, webhook signing for integrations, and environment-isolated secrets management. We maintain a vulnerability disclosure programme — report issues to security@openbrain.ai.
In the event of a data breach affecting your personal data, we will notify you and relevant authorities within 72 hours as required by applicable law.
Depending on your location, you may have the following rights regarding your personal data:
To exercise these rights, contact privacy@openbrain.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
We use strictly necessary cookies for authentication and session management. With your consent, we may use analytics cookies to understand how the Service is used. You can manage cookie preferences at any time in your account settings. We do not use third-party advertising cookies or cross-site tracking.
The Service is not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact privacy@openbrain.ai and we will delete it promptly.
Open Brain operates globally. Your data may be processed in countries outside your own, including the United States and India. We rely on the EU Standard Contractual Clauses (2021) and the EU–US Data Privacy Framework for transfers from the EEA. For details, see our Data Compliance page.
We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Privacy enquiries: privacy@openbrain.ai
Legal enquiries: legal@openbrain.ai
Website: openbrain.co.in