Privacy

Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how Brainwave GmbH (“Brainwave”, “we”, “us”) processes personal data when you visit wearebrainwave.co, contact us, subscribe to updates, use the client portal or AI assistant, complete a talk scorecard, attend a Brainwave event, or work with us. It is intended to meet the transparency requirements of the Swiss Federal Act on Data Protection (“FADP”) and, where applicable, the EU GDPR and UK GDPR.

1. Controller and contact

Brainwave GmbH is the controller for the processing described here unless a separate notice says otherwise.

2. Personal data we process

2.1 Website and device data

When you access the site, our hosting and security systems may process your IP address, request URL, browser and device information, referring page, timestamps, response status, and related security or diagnostic events. We use this information to deliver the site, prevent abuse, and investigate failures.

2.2 Enquiries, session feedback and business relationships

If you contact us or submit a form, we process the information you provide, including your name, company, email address, optional telephone number, message, and later correspondence. Please do not send medical records or sensitive health information through the public contact form.

Submissions are stored in our database as well as sent to us by email, so that we can answer you reliably and so that a later request to see or delete your information can actually be met. We also keep a salted, one-way hash derived from your network address for a short period, used only to detect automated abuse of the forms; we do not store the address itself.

For current website enquiries only, we may use Anthropic's Claude API to prepare an internal draft reply. The structured input contains only your first name, company, selected services, budget band, and message for this purpose. We do not add the dedicated email-address or telephone-number fields, network address or its hash, internal identifiers, or consent metadata. Because the company and message fields are included as entered, anything you choose to type within either field is part of the model input. Once generated, the draft is frozen in a private Supabase retry record, an outbox used solely for durable retry, and then copied to the restricted Draft Responses field in Notion. It is not shown on the website or admin portal, added to a notification email, or sent to you automatically. A Brainwave team member must review it and decide whether and how to reply. A drafting failure does not prevent the original enquiry from reaching our Notion workflow.

If you complete one of our post-session feedback forms, we process the workshop and company identified by its link, your ratings, anything you write in your own words and, on the general form, the topics you would like us to cover next. We use it to improve the sessions we run and to report aggregate results over time. An organiser may give us attendee email addresses so that we can send the workshop link; we use those addresses for that invitation and keep its delivery outcome. We do not connect an invitation address to a response unless you choose to type your own email into the form. The name and email fields are optional: if you leave them blank we hold no contact details in your response, and the salted network hash and short-term records described above are the only technical traces, on the same schedules. If you tick the box giving us permission to quote your feedback publicly, we may publish your words on our website and social channels attributed to your first name and company only, never your email address or full name; we record that you gave the permission and when. You can withdraw it at any time by contacting us, and we will stop using the quote.

Our separate testimonial form collects your name, contact email, company, testimonial and publication permission choice. We store these in Supabase and copy them to our restricted Notion feedback workflow for review. We use your email only to follow up about your submission or permission; it is not published or used for marketing. The optional, unticked permission box covers only your first name and testimonial on the Brainwave website; it does not authorise publication of your company or full name. We record the exact wording, its version and the time permission was given. You can submit without agreeing to publication and withdraw permission at any time by contacting us. We will then stop using the quote.

2.3 Newsletter

If you actively consent to email updates, we process your email address, the consent wording and source, the date and time of consent, delivery events needed to operate the mailing, and any unsubscribe request. We store your signup and consent record in Supabase and add your email address to our newsletter list in Resend, which sends our fortnightly newsletters and manages unsubscribe preferences. Besides our Insights page and the website footer, you can sign up before or after the Workday Scorecard (section 2.10). When a new sign-up comes from there, we record the scorecard page as its source. None of your scorecard answers or results are attached to a sign-up. You can withdraw consent at any time using the unsubscribe link in a newsletter or by contacting us.

2.4 Client portal

For invited clients, we process the invited email address, authentication and session events, account role, engagement profile and dates, assigned actions and completion status, project milestones, requests or feedback submitted through the portal, document metadata, files Brainwave shares with that account, and access or administrative events needed to keep the service secure. Portal files are held in private storage. Each download is re-authorised by the portal and recorded using the document identifier, time, and pseudonymous user and network hashes; the private short-lived storage link stays on the server. Please do not submit medical records or sensitive health information in portal requests.

2.5 AI assistant

When you choose to use the AI assistant, the messages and recent conversation context you submit are sent to Anthropic to generate a response. The visible conversation is also stored in your browser's session storage so it remains available in that browser tab. Brainwave does not intentionally add public-assistant transcripts to its own client database. For both this assistant and the internal enquiry drafting described in section 2.2, Anthropic states that standard API inputs and outputs are automatically deleted from its backend within 30 days, except where a service has longer retention, different terms have been agreed, or longer retention is needed for usage-policy enforcement or legal compliance. Do not submit confidential, identifying, medical, or other sensitive information. The assistant is not a healthcare service and is not suitable for emergencies. If you choose to contact the team within the chat, the guided enquiry flow collects your name, company and email separately from the AI conversation. You can review and edit the message before sending. These contact-flow answers are not included in subsequent public-assistant requests to Anthropic. Your active draft and visible contact steps are held in this browser tab’s session storage. Sending or cancelling clears the active draft; starting a new conversation also clears the visible history. When you send it, Brainwave stores the enquiry and queues delivery to the team under the enquiry processing described in section 2.2; the chat transcript is not submitted with it.

2.6 Workshops, events, and services

When you or your organisation books or attends a service, we may process participant and organiser contact details, role, attendance, scheduling information, feedback, contractual records, and billing information. If photographs or recordings are planned, we will provide an event-specific notice and, where required, obtain consent or provide a practical opt-out.

2.7 Sensitive data

Brainwave does not need medical records for ordinary website use. Where a workshop or service legitimately requires health-related accessibility or wellbeing information, we collect only what is necessary, provide a specific notice, restrict access, and obtain explicit consent or rely on another valid legal basis where required. Reports for organisations should be aggregated or de-identified wherever practical.

2.8 Social media and external sites

This site links to Brainwave pages on Instagram and LinkedIn. The visible Instagram images on this website are hosted locally and are not social-media embeds. If you follow an external link, that provider processes information under its own privacy terms.

2.9 Talk scorecards

After some Brainwave talks, you can open that talk's scorecard from a QR code or link. It asks how often 12 or 24 statements about your recent working life apply to you. Depending on the talk, they cover attention and focus, how work is organised, delegated and communicated, change and capacity, sleep, rest and recovery, support, and mental load, including personal worries, how pressure affects the way you respond to people, and practical help with responsibilities at home. Each prompt takes one of five frequency answers or can be skipped. Taking part is voluntary. The scorecard is a reflection, not a health assessment or diagnosis.

When you submit, your answers are stored in our Supabase database under random identifiers: a submission ID made in your browser, a random response ID and a random private comparison key. Each response is linked to the scorecard for that talk, which belongs to a client organisation and an event, so a response can be attributed to a company and an event. It is stored without your name or email, and with no account, IP address, browser details, free text or submission time. Apart from the hosting and security processing in section 2.1, and Calendly if you open it, the scorecard uses your IP address only to limit abuse: we keep a keyed one-way hash (HMAC-SHA256) of it, combined with the scorecard link, in a rate-limit record. Records more than a day past their short limiting window are deleted automatically the next time the site checks a rate limit. Brainwave sets no cookies on the scorecard pages and stores nothing in your browser. Your results page is not saved in your browser and closing the tab clears it, but the answers you submitted stay stored as described here. Downloadable PDFs on earlier scorecards are generated in your own browser.

All talk scorecards ask for an email address before the questions. When you finish, the answers you provide are also processed on our server to create your personal PDF. LEAD Network uses its three-page plan when enough answers are available; other results use the relevant scorecard report. We temporarily store the PDF with your email in a delivery queue and send it through Resend. This queue contains no response ID or private comparison key. The PDF is removed from the queue once delivery succeeds or bounded retries stop; delivery bookkeeping is removed after 30 days. A separate private download copy is accessible through a random link in your email for seven days, then expires and is removed on the next queue maintenance run. Keep the email and PDF private.

On scorecards offering a final team comparison, your requested email also goes on a separate comparison list. Unless the scorecard is set to personal comparison, as described below, that list has no link to the separately stored response. An older, group-only campaign can email your requested PDF without adding you to a comparison list. A separate, unticked box offers the fortnightly newsletter. On eligible event scorecards, another unticked box offers contact about talks and workshops. Each permission is separate; taking the scorecard or requesting results does not give marketing permission. After publication, the comparison email contains the shared final group results. On a scorecard set to personal comparison, it also attaches a PDF of your own answers beside the group results; otherwise it contains none of your individual answers or scores. You can withdraw an email permission by contacting Brainwave.

Some event scorecards send a personal team comparison instead, and their introduction says so before you start. There, your results email request also carries your private comparison key, and we keep a separate link between your email address and your stored answers. The link is used only to email you a PDF of your own answers beside the final group results. It is deleted once that email is sent or delivery stops, and at the latest after 90 days. No admin view or report shows your email beside your answers, and the client organisation never receives the link. Brainwave keeps no copy of that PDF, so keep the email private. Responses submitted while the option was off are never linked.

On newer scorecards, authorised Brainwave staff with owner or admin access can review individual responses under their random identifiers in our admin console, including while a scorecard is still collecting, and see the email list only after collection has closed. On older scorecards, they see only grouped results after collection has closed. The client organisation has no access to individual responses or email addresses. Once Brainwave publishes the group results, anyone with the event's scorecard link can view them, including the total number of responses. An area's group average is shown only when at least five scored responses exist for that area.

On earlier scorecards with an email step, once your full plan is open (straight away where no tailored plan applies, otherwise after you enter an email), your results show a private comparison link, which is also printed in your PDF and does not expire. After the group results are published, anyone holding it can open your individual answers next to the group averages, so keep it private. Because your answers are stored without your email, this link is also the only way we can find them if you ask us about them. If you leave before your full plan opens, or you used an older scorecard, you receive no such link and we cannot identify your answers.

The results page also offers a free 15-minute call. The Calendly booking calendar loads in a frame only when you choose to book, and a plain link opens Calendly in a new tab instead; nothing from Calendly loads before then. Once it is open, Calendly receives your IP address, browser details and anything you enter, and may set its own cookies and similar technologies. Calendly's own cookie notice is not shown inside the frame. Your scorecard answers are not shared with Calendly.

2.10 Workday Scorecard

The public Workday Scorecard at wearebrainwave.co/scorecard asks 12 questions about recent working habits and conditions. It shows results and a suggested next step. The PDF download on the results page is created on your device. We set no cookies and use no browser storage, so closing or reloading clears your answers. This is a reflection, not a health assessment or diagnosis.

Email is required and comes before the questions. Your completed answers are processed on our server to create your personal PDF. We retain only that document and its delivery message, not a questionnaire response or event cohort. Resend delivers the PDF attachment. The private download expires after seven days and is removed on the next queue maintenance run. The queue message is removed after successful delivery or bounded retries; delivery bookkeeping expires after 30 days. Anyone with the private link can download it, so keep it private. Contact Brainwave with the link if you want its copy removed sooner. Newsletter signup is a separate, unticked choice, described in section 2.3. Rate limiting and website processing follow sections 2.1 and 2.2.

2.11 Sleep and workshop questionnaires

If the public sleep page offers a local reflection without a campaign, it asks for an email address before the questions. To receive your PDF you explicitly agree, as an adult, to processing your sleep answers for that document and email. We retain the PDF and delivery message temporarily using the same seven-day download and 30-day delivery-bookkeeping periods described above. This does not create a questionnaire cohort, private personal-results page or marketing subscription. Keep the download link private; contact Brainwave with it to request earlier removal.

Workshop questionnaires at /questionnaires ask adults about recent sleep habits and optional country, age band, gender and role. Participation is voluntary and every question can be skipped. Every participant enters an email before starting. Brainwave links that address to your answers to provide a saved personal page, email your personal PDF and private results link, and notify you when the final group comparison is published. This is different from the separate-email talk scorecards above. We do not add you to marketing lists. We record your explicit agreement and its date when you start.

Your personal page is protected by a random private link. Anyone with it can view the results, so keep the link and any PDF containing it private. We store its cryptographic hash; a temporary email queue contains the private link until delivery succeeds or bounded retries stop. Private pages expire 90 days after you start. We keep one copy of your initial personal PDF for the email attachment and protected download. This stored PDF does not contain your private link; access uses the same private key and expires with your personal page. Raw answers, optional demographics, email, consent record, stored PDF and queued messages are removed after expiry by the next results-mail maintenance run. You can withdraw earlier using the private page or contact Brainwave with that link. Withdrawing removes your raw response, stored PDF and pending messages; an email already being delivered cannot be recalled.

The employer and the ordinary Brainwave administration screens receive only grouped results, after collection closes. An area needs at least ten scored responses. Demographic results also require at least ten scored responses outside the displayed subgroup, checked separately for each area. We do not infer demographics or country from your IP address. Published group snapshots are fixed and retained for programme reporting; withdrawal does not rewrite an already published snapshot. Infrastructure personnel can access stored data where necessary to operate the service or respond to your rights. Supabase hosts the private storage and Resend delivers results emails, as described below.

When no public campaign is configured, /questionnaires/sleep is a local reflection. Apart from the PDF email described at the start of this section, it stores no answers, uses no browser storage and loses its on-screen results when the tab closes or reloads. The PDF download on its results page is created on your device. None of these questionnaires diagnoses a health condition or measures job performance. Taking part is optional and declining must have no adverse employment consequences.

3. Where the data comes from

We receive personal data directly from you, from your employer or event organiser, from people who invite you to the client portal, and automatically from your device and our service providers when you use the site. We may also receive ordinary professional contact information from publicly available sources or business partners.

4. Purposes and legal bases

Under the FADP, we process data lawfully, proportionately, and for disclosed purposes. Where the GDPR or UK GDPR applies, the corresponding legal bases are set out below.

Where we rely on legitimate interests, we assess the necessity and impact of the processing and take reasonable steps to protect your rights. You may object as described below.

5. Recipients and service providers

We disclose data only where needed for the purposes above, including to authorised Brainwave personnel, professional advisers, public authorities where legally required, and the following categories of processors:

Service providers may use subprocessors. They are contractually restricted to the relevant service and must protect the information. If Brainwave changes a material provider, this notice will be updated.

6. International transfers

Brainwave is based in Switzerland. Depending on the selected hosting region and provider subprocessors, data may be processed in Switzerland, the European Economic Area, the United Kingdom, the United States, or other countries. Where a destination does not provide an adequate level of protection, we use recognised safeguards such as contractual data-protection clauses, data-processing agreements, and supplementary technical or organisational measures, or rely on a permitted exception. You may contact us for more information about applicable safeguards.

Notion is operated by a United States provider and its published infrastructure subprocessors currently include processing in the United States and Germany, with some global support services. Where a Notion transfer is restricted, Brainwave relies on the applicable Notion data-processing terms and recognised contractual transfer safeguards, together with access restriction and data minimisation.

7. Cookies and browser storage

The site currently uses only technologies needed for secure client access, saving your privacy choice, and chat functionality that you actively request. No analytics, advertising, or cross-site marketing cookies are active. On talk scorecard pages and the public Workday Scorecard, Brainwave sets no cookies and stores nothing in your browser. Two optional third-party frames load only when you choose them: the Spotify player on the founder page and the Calendly booking calendar on talk scorecard results. Once loaded, those providers may set their own cookies under their own policies. The details, storage periods, and permanent settings control are in our Cookie Policy.

8. How long we keep information

We keep personal data only as long as needed for its purpose, legal obligations, or the establishment, exercise, or defence of legal claims. Typical periods are:

A legal, regulatory or dispute-preservation hold may pause deletion for the affected record. It does not extend the 30-day abuse-hash period. When a hold ends, the ordinary schedule resumes. Notion copies are included in access and deletion handling; a local database deletion is not treated as complete until the corresponding Notion copy has also been removed or a documented legal exception applies.

9. Security

We use reasonable technical and organisational measures appropriate to the risk, including access controls, private storage, short-lived file links, authenticated routes, input validation, rate limits, transport encryption, least-privilege credentials, and provider security controls. No internet service is completely secure. If you believe information has been exposed, contact us promptly.

10. Your rights

Depending on the law that applies, you may have the right to:

• ask whether we process personal data about you and receive a copy;
• correct inaccurate or incomplete information;
• request deletion or restriction, subject to legal exceptions;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting earlier lawful processing; and
• complain to a competent data-protection authority.

To exercise a right, email hello@wearebrainwave.co. We may ask for proportionate information to verify your identity. In Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. If the GDPR or UK GDPR applies, you may also contact the authority where you live or work.

11. Automated decisions

Brainwave does not use the public AI assistant, internal enquiry reply drafts, or the website to make decisions about you that produce legal or similarly significant effects. AI assistant answers are informational. Enquiry drafts are never sent automatically and must be assessed by a Brainwave team member.

12. Children

The public website and assistant are not directed at children under 16. If you believe a child has submitted personal data without appropriate authorisation, contact us so we can review and delete it where required.

13. External links

Links to external websites are provided for convenience. Brainwave does not control their privacy practices; review the external service's notice before providing personal information.

14. Changes to this policy

We may update this policy when our services, providers, or legal obligations change. The current version and revision date will remain available here. Material changes will be highlighted where appropriate.

Related: Cookie Policy · Legal Notice & Website Terms