Privacy Notice

The data controller is TaQ Oy, Finland. This notice covers the Second Brain service (secondbrainbox.com) and follows the EU General Data Protection Regulation (GDPR).

1. Controller and contact

TaQ Oy is responsible for processing your personal data. Privacy questions: support@secondbrainbox.com.

2. Data we collect

• Account data: email address, password (stored as a secure hash) and account status.
• Your content: notes, journal entries, projects, tasks, imported conversations and speech-capture transcripts.
• Usage data: sign-in times, AI usage volumes, device and browser data, and IP address for security logs.
• Support messages: messages you send to support.

3. Purposes and legal bases

• Providing the service, account management and storing your content — contract performance.
• AI features (Q&A, summaries, classification) only when you use them — contract performance.
• Security, fraud prevention and account locking — legitimate interests.
• Subscription and payment management together with Paddle — contract performance and legal obligation.
• Feedback and anonymised product improvement — legitimate interests.
• Optional messages — consent, withdrawable at any time.

4. Sharing

We do not sell personal data. We share it only with:

• Service providers (subprocessors): cloud hosting, AI provider (your text is processed per request and is not used to train models), and support/analytics tooling.
• Paddle: selling, managing, billing and taxing subscriptions — our order process is conducted by our reseller Paddle.com, the Merchant of Record.
• Professional advisers: legal and accounting firms when needed.
• Authorities: only where required by law.

5. International transfers

Some providers operate outside the EU/EEA. Such transfers rely on European Commission Standard Contractual Clauses or adequacy decisions.

6. Retention

Your content is kept for as long as your account exists. After account deletion, data is deleted or anonymised within 30 days, except where the law requires retention (e.g. accounting records) or for security logs (up to 12 months).

7. Your rights

Under GDPR you have the right to access, rectify, erase, restrict and object to processing, to data portability, and to withdraw consent. Contact support@secondbrainbox.com; we respond within one month. You may also lodge a complaint with your local supervisory authority.

8. Security

We apply appropriate technical and organisational measures: encrypted connections and storage, access controls, database-level rules that lock each user's data to that user only, and audit logging. Your notes are never shared with other users, and administrators cannot see their contents.

9. Cookies

We use only cookies essential for the service (e.g. sign-in state and language choice) plus storage needed for security features. We use no advertising or tracking cookies. You can clear cookies in your browser settings.

10. Changes

We update this notice when needed and announce material changes in the service.

See also the Terms of Service and Refund Policy.