Privacy Policy
Last updated: 1 November 2026
KineticBrain™ (“we”, “us”, “our”) operates KineticLaunch (launch.kineticbrain.ai) with its Idea Validator, KineticCopy, and KineticMarketing, collectively referred to as “the Services”. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Services.
We are the data controller for the personal data processed through our Services. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Danish Data Protection Act (Databeskyttelsesloven), and the ePrivacy Directive 2002/58/EC as implemented in Danish law.
1. Data Controller
KineticBrain™
KineticBrain is the trading name of Clairre Sommer (an individual, not a company), c/o AB Montage, Vardevej 996A, 7100 Vejle, Denmark. Contact: support@kineticbrain.ai
She is the data controller.
2. What Data We Collect
2.1 Account Data
When you create an account, we collect:
- Email address
- Password (stored as a salted hash, never as plain text)
- Account creation date
- Subscription tier and billing status
2.2 Usage Data
When you use our Services, we automatically collect:
- Pages visited and features used
- Timestamps of interactions
- Browser type, operating system, and device type
- IP address (used for security and analytics; not stored long-term)
2.3 Content Data
When you use our tools, we process the content you create:
- Business ideas and descriptions submitted to the Validator
- Brand strategy data (positioning, naming, messaging, etc.)
- Chat conversations with the Brain assistant
- Research results generated by our AI pipeline
2.4 Payment Data
If you subscribe to a paid plan, our payment processor collects your card details. We do NOT store your full card details on our servers. The payment processor processes and stores this data as an independent data controller. We only receive a tokenised reference and the last four digits of your card.
2.5 Third-Party Authentication Data
If you sign in via Google OAuth, we receive your Google email address, display name, and profile picture URL. We do not access your Google contacts, files, calendar, or any other Google data.
3. Legal Basis for Processing (GDPR Article 6)
| Purpose | Legal Basis | GDPR Article |
|---|---|---|
| Account creation and management | Performance of contract | Art. 6(1)(b) |
| Providing core Services | Performance of contract | Art. 6(1)(b) |
| Processing payments | Performance of contract | Art. 6(1)(b) |
| Transactional emails | Performance of contract | Art. 6(1)(b) |
| Analytics and improvement | Legitimate interest | Art. 6(1)(f) |
| Security and fraud prevention | Legitimate interest | Art. 6(1)(f) |
| Marketing communications | Consent | Art. 6(1)(a) |
| Non-essential cookies | Consent | Art. 6(1)(a) |
4. How We Use Your Data
We use your personal data to provide, maintain, and improve our Services; authenticate your identity; process AI-powered analysis using third-party AI providers; process payments through our payment processor; send account-related notifications; respond to support requests; detect and prevent abuse; and comply with legal obligations.
We do NOT sell your personal data, use your content to train AI models, share your business ideas with other users, or display advertising.
If you add answers about yourself, they are sent to our AI provider to tailor the written text. For visitors who are not signed in, they are not stored.
5. Third-Party Processors and International Data Transfers
| Category | What it does and what it receives | Location | Safeguard |
|---|---|---|---|
| AI model providers | Generate your strategy, research and content from what you enter, plus a backup AI service if the main one is unavailable. They receive the text you enter and the context built from it. If you add your own API key, requests go to the provider you chose. | US (main provider). Backup service: location being confirmed. | EU SCCs for the main AI provider. Data processing terms being confirmed for the others. |
| Web search and page-reading services | Research. They receive search queries built from your business, market and competitor descriptions, and the web addresses of public pages. They do not receive your name or email. | US (as stated by provider) | Data processing terms being confirmed |
| Web search provider (to research your idea) | Validator research. Receives search queries built from the idea text you submit. It does not receive your name or email. | US | Data processing terms being confirmed |
| Social-account connection service | Only when you connect an account. Connects the accounts you choose and posts only what you approve. Receives your connection to that account and the post text and image you approve. | Location being confirmed | Data processing terms being confirmed |
| Error monitoring | Internal error alerts to our team. Alerts are sent with personal details removed (email addresses, web addresses and quoted text are stripped) and cut to 300 characters. | Location being confirmed | Data processing terms being confirmed |
| Database and authentication | Stores your account and your work, and signs you in. | EU (Ireland) | EU SCCs |
| Social sign-in | Only if you choose to sign in with a social account. Confirms who you are. | US | EU SCCs + DPF |
| Email delivery | Sends our waitlist and product emails, and keeps your unsubscribe status. Receives your email address and the details described in the email sections below. | US and EU | Data processing terms being confirmed |
| Payments | Takes card payments for paid plans. | US | EU SCCs + DPF |
| Website statistics | Counts visits to our public pages (not the logged-in app). Receives the page address, screen size and the page you came from. Sets no cookies. | EU (Spain) | Within the EU |
| Hosting and mail server | Runs the application and our support mailbox. | Germany (EU) | Within the EU |
When you submit content to our Services, it is sent to third-party AI providers for processing. Our main AI provider states that it does not use data sent through its API to train its models. The table above shows, for each category of processor, where it is located and the safeguard we rely on. Where a row says the terms are being confirmed, that step is not finished yet, and we will update this page when it is.
Want the full list of processors? Email support@kineticbrain.ai.
Email updates and the KineticMarketing waitlist
If you join the KineticMarketing waitlist, we store your email address, the page you signed up on and when, the version of the consent text you agreed to, and any campaign tags in the link you used (utm_source, utm_campaign). This is kept in our database and in our email service. Both process it on our behalf.
Before you are on the list, we email you a link to confirm your address (double opt-in). The link works for 14 days. Our database keeps only a one-way hash of it; our email service holds the link itself so it can send it to you, and we clear it there when you confirm. Until you confirm, we send you nothing else about KineticMarketing. If you do not confirm, we delete your waitlist entry from our database and take you off the waitlist in our email service within 30 days of sending the link. If you joined the waitlist before we started sending confirmation emails, you may get one email asking you to confirm; if we send it and you do not confirm, your entry is deleted as described in the retention table below.
We use it only to email you about KineticMarketing, including its founding offer. The legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by emailing us. Withdrawing does not affect emails sent before.
We do not sell your personal data or share it with third parties for their own marketing. It is processed only by us and the providers in the categories listed above, to run the service and send our emails.
When you unsubscribe, we delete your waitlist entry from our database within 30 days. We keep a one-way hash of your email address (not the address itself) on a suppression list, so we do not add you again by mistake. Our email service keeps your address marked as unsubscribed, which is what stops further emails.
Tips and offers after the Idea Validator (double opt-in)
On the Idea Validator you can tick a box to get tips and offers about our own KineticBrain products by email. The box is optional and your results and free account do not depend on it. We send you one email either way: the link that opens your results. There is no separate confirmation email. If you ticked the box, we ask you in the app, after you open your results, whether you want these emails, and you confirm there with one click. Until you confirm, we send you nothing about this. If you say no, we delete the record and do not ask again unless you tick the box again.
If you ticked the box earlier and got a confirmation email from us, that link still works for 7 days after it was sent.
When you confirm, we store the wording version you agreed to, when you confirmed, a shortened IP address and your browser's user agent. This is our proof that you agreed (GDPR Art. 7(1)). The legal basis for the emails is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by emailing us. Withdrawing does not affect emails sent before.
When you confirm, we send your idea score, verdict and segment to our email service, so the emails match your result. We send your first name and the title of your idea only when that run belongs to your verified account.
We do not sell your personal data or share it with third parties for their own marketing. It is processed only by us and the providers in the categories listed above, to run the service and send our emails.
If you do not confirm within 7 days, the record is deleted. We keep the proof of a confirmed consent for as long as the consent lasts and for 5 years after you withdraw it, so we can show it if a complaint comes in.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (email address, purchase history) | Until account deletion request + 30 days. Never deleted due to inactivity alone. |
| Project & content data: all paid tiers | Retained while account is active. Purged after 36 consecutive months of inactivity (no login), with 60 days' advance email notice before deletion. |
| Project & content data: free tier | Retained while account is active. Purged after 18 consecutive months of inactivity (no login), with 30 days' advance email notice before deletion. |
| Usage / analytics data | 26 months |
| Payment records | 5 years (Danish Bookkeeping Act (Bogforingsloven)) |
| KineticMarketing waitlist (email, signup page and time, campaign tags, consent version) | Until you unsubscribe; deleted within 30 days after. A one-way hash of the email stays on a suppression list. Sign-ups that are never confirmed: deleted within 30 days of sending the confirmation link. |
| Idea Validator email consent: sign-ups never confirmed | Deleted after 7 days, or straight away when you say no in the app. |
| Idea Validator email consent: confirmed proof (wording version, time, shortened IP, user agent) | While the consent lasts, and 5 years after you withdraw it. |
| Deleted products (the backup copy, files included) | Kept for 30 days after you permanently delete a product (Empty bin), as a backup in case it was a mistake. The files are kept with it. After the 30 days the backup and its files are deleted for good. You can ask us to delete it earlier. |
| Support correspondence | 2 years from resolution |
| Server logs | 90 days |
“Active” means you have logged in at least once during the applicable window. Logging in at any point resets the inactivity clock. We will always send advance email notice before deleting any project content due to inactivity. You may also request early deletion of your project data at any time under your right to erasure (Section 7 below).
We recommend exporting your Brand Bible (PDF or Markdown) from the Launch step of each project as a permanent local copy, regardless of your activity level.
7. Your Rights Under GDPR
As a data subject in the European Union, you have the following rights:
- Right of access (Art. 15): request a copy of your personal data
- Right to rectification (Art. 16): request correction of inaccurate data
- Right to erasure (Art. 17): request deletion of your data
- Right to restriction (Art. 18): request limits on how we use your data
- Right to data portability (Art. 20): receive your data in machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interest
- Right to withdraw consent (Art. 7(3)): withdraw consent at any time
- Right regarding automated decisions (Art. 22): our AI tools are advisory only and do not make automated decisions with legal effects on you
Send requests to support@kineticbrain.ai. We will respond within 30 days.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark (datatilsynet.dk). If you are in another EU member state, you may also contact your local supervisory authority.
8. Cookies
We use cookies and similar technologies. For full details, see our Cookie Policy. We do NOT use advertising cookies or cross-site tracking.
9. Children's Privacy
Our Services are not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us.
10. Security
We implement encryption in transit (TLS 1.2+) and at rest (AES-256), salted password hashing (bcrypt), Row-Level Security on our database, and access controls. If we become aware of a data breach posing high risk, we will notify you and the Datatilsynet within 72 hours (GDPR Art. 33).
11. Changes to This Policy
We may update this policy from time to time. We handle changes the same way as in Section 12 of our Terms. For a material change, we email you on the day it takes effect and update the “Last updated” date. The new version applies to new sign-ups straight away, and to existing users 30 days after that email. Until then, the previous version keeps applying to you, and you can ask us to close your account during those 30 days if you do not agree. Minor changes (clarifications, typo fixes, updated contact details) take effect immediately, and we still update the date. Changes we must make for legal or security reasons can take effect sooner. If that happens, we tell you in the same email. Where a change needs your consent, we will ask for it.
12. Contact Us
KineticBrain™
c/o AB Montage, Vardevej 996A, 7100 Vejle, Denmark (EU)
Email: support@kineticbrain.ai
For GDPR requests, include “GDPR Request” in your subject line.