Privacy Notice – BrainX App

Last updated: 18 September 2026

1. Who we are

BRAINX ACADEMY SRL is a company that manages the development and operates the BrainX platform.

2. What personal data do we process

BRAINX ACADEMY SRL is a personal data controller. We process the following types of personal data:

Username
Name, Surname
Email
Telephone number
Date of Birth
Location
Sex (M/F/I don't say)
Educational level
Professional status
Industry/Field
Role
Desired job
Profile picture
CV (PDF)
LinkedIn profile
Socio-professional questionnaire
Pseudonymised dataset for AI processing
AI output (report)
Products in the cart
Payment amount
Retrieval reference number (RRN)
Confirmation/Rejection of Transaction
The last 4 digits of the card used for payment
Credit card type
Activity logs

3. Why do we need them

We need your personal data to provide you with the following services:

On the legal basis of the need to fulfil the contractual clauses or for the steps necessary to conclude a contract at the initiative of the data subject:

Username – we use this data to setup your account.
Name, surname – we use this data to setup your account.
Email – we use this data to setup your account.
Telephone number – for the one-time password.
Date of Birth – for the professional reports.
Location, Sex, Educational level, Professional status, Industry/ Field, Role – used as parameters for the professional reports.
CV – used as parameter for the professional report. -
Socio-professional questionnaire – used as parameter for the professional report.
AI output (report) – this is the report you are purchasing.
Products in the cart, Payment amount, Retrieval reference number (RRN), Confirmation/Rejection of Transaction – needed for online transactions.

Based on your consent:

Desired job – we need this information to allow us to help you match with the jobs posted by our hiring partners.
AI output (reports) – we share this information with the companies you choose to share with.
LinkedIn profile – you can share with us the link for your LinkedIn profile.
Profile photo – you can publish your photo, should you choose to.

Based on our legitimate interest to provide the state-of-the-art security for your personal data and profile:

Pseudonymised dataset for AI processing – this is the data used as input for the AI algorithm. Based on our implementation, the risk of re-identification of identity by any AI algorithm at this moment is minimal.
The last 4 digits of the card used for payment and Credit card type – to prevent fraudulent transactions.
Activity logs – by default, we log the activity in your account for six months.

4. What we do with them

Your personal data is processed in Romania and in Europe, on Amazon Web Services servers. Amazon acts as personal data processor for us.

Your personal data is processed by n8n GmbH in Germany, a company acting as personal data processor for us, managing the API connections with OpenAI and Anthropic as well as PDF.co, that assembles the final report. Only pseudonymised personal data is sent to the AI algorithms.

Your personal data is also processed by Twilio, Inc, a US-based company acting as data processor for us, managing the one-time password integration. The compliance of the personal data transfers to the US is ensured by the fact that Twilio, Inc is a member of Data Privacy Framework platform, for which the European Commission issued an adequacy decision.

Your personal data is also shared with VESA VENTURES SRL, a company which acts as a Data Processor offering development and platform maintenance.

Your personal data is also shared with Stripe, LLC, a US-based company, acting as a data controller, offering the Stripe payment processing service. The compliance of the personal data transfers to the US is ensured by the fact that Stripe, LLC is a member of Data Privacy Framework platform, for which the European Commission issued an adequacy decision.

5. Special categories of personal data

The data from the socio-professional questionnaire as well as the personal data in your report are special categories of personal data, assimilated to health data. We are protecting this data using state-of-the-art technologies, such as data minimization (the AI never sees your identity, all metadata is destroyed), encryption of data in-transit and at-rest, limited access on a need-to-know basis, activity logging, advanced threat protection, backup and resilience.

Also, you have full control over your special categories of personal data. You can choose to whom you are sharing your reports with, and you can withdraw your consent at any time, followed by immediate notification of consent withdrawal sent to those having your personal data.

Our hiring partners are data controllers so please make sure you understand how they process your personal data before sharing it with them. Make sure you read their privacy policies, privacy notifications and ask them any questions related to how they protect your personal data. BrainX is not responsible for how they are processing your personal data.

6. How long do we keep personal data

We keep personal data on your profile for three years since your last login. We keep the personal data in invoices and contracts for five years, per the Romanian Fiscal Code. We keep the logs for six months. We delete the JSONs after 30 days.

7. What are your rights?

If you have reason to believe that any personal data that we have about you is incorrect or incomplete, you have the right to ask to see your personal data, to correct it, to request to be deleted, to request restriction of processing or to object to the processing. You also have the right to data portability. To exercise these rights please contact [email protected].

In order to withdraw your consent for data sharing with third party companies, please contact [email protected].

If you want to submit a complaint regarding how we process your personal data, please contact Romanian Data Protection Authority at www.dataprotection.ro .