Privacy Policy

FamilyBrain is a UK-based family assistant product that helps households organise their calendar events, store important documents, capture memories, and manage daily life — all through WhatsApp. FamilyBrain is operated by FamilyBrain Ltd, a private limited company registered in England and Wales under company number 17143333. Privacy matters are currently handled by Mr Rheinallt Daniel Jones, who is registered with the Information Commissioner's Office under reference ZC109957.

For any privacy-related enquiries, please contact us at privacy@familybrain.co.uk.

We collect only the data necessary to provide the FamilyBrain service. The table below describes each category of data we process.

We use your data solely to provide and improve the FamilyBrain service. We do not sell your data, share it with advertisers, or use it for any purpose unrelated to the service you have requested.

AI Processing (OpenAI)

When you send a message to FamilyBrain, the text content is sent to OpenAI's API to extract structured information (such as event details, document type, and action items), generate a semantic embedding for search, and compose a helpful reply. OpenAI processes this data as a data processor acting on our instructions. Your messages are not used to train OpenAI's models under our API agreement.

Calendar Synchronisation (Google Calendar API)

If you choose to connect your Google Calendar, FamilyBrain will read your upcoming events to provide reminders and context, and will write new events when you ask the bot to add something to your calendar. This connection is entirely optional and can be revoked at any time from your Google Account settings at myaccount.google.com/permissions.

Document Storage (Supabase / PostgreSQL)

Extracted text from your messages, documents, and photos is stored in a PostgreSQL database hosted by Supabase. This allows FamilyBrain to answer questions about information you have previously shared. Core FamilyBrain data is stored in the United Kingdom (AWS eu-west-2, London) and is encrypted at rest and in transit.

WhatsApp Messaging (Twilio and/or Meta Platforms, Inc.)

FamilyBrain sends and receives WhatsApp messages through configured WhatsApp messaging providers. In production this may include Twilio, and where Meta Cloud API is enabled it may include Meta Platforms, Inc. These providers process your phone number and message content in order to route messages to and from the FamilyBrain bot.

Morning Briefings & Alerts

FamilyBrain may send you proactive WhatsApp messages, such as a morning summary of the day's events or an alert about an upcoming document expiry. These are generated from data you have already stored and are sent only to registered family members.

Under UK GDPR, we rely on the following legal bases for processing your personal data:

We use a small number of carefully selected third-party data processors. Each processor is bound by a Data Processing Agreement (DPA) and processes your data only on our instructions.

We keep application data while your FamilyBrain account is active so that long-lived family records, such as insurance documents and emergency information, remain available. We do not delete active-account records merely because they are old or have not recently been used.

If a subscription is cancelled and not renewed, the current retention process schedules the family account for deletion after a 90-day grace period. We start trying to deliver a WhatsApp warning at around day 60. Deletion will not happen until at least 30 days after the messaging provider has accepted that warning, so a delayed warning does not shorten the notice period. Renewing before deletion removes the account from the cancelled-account deletion path.

Some short-lived operational records are removed on separate schedules. These include expired invitation tokens, old processed-payment event records, security records after their configured period, expired export files, and temporary pseudonymous safety receipts that prevent a deleted account from being accidentally recreated. Provider and infrastructure logs or backups follow the relevant provider's retention arrangements rather than the live FamilyBrain account deletion transaction.

Note on files: Raw images, PDFs, and voice notes stored in FamilyBrain's governed object storage follow the family account lifecycle. Deletion from the live FamilyBrain service does not itself erase copies held in WhatsApp, on a family member's device, by a messaging or AI provider, or in infrastructure backups.

As a data subject under the UK GDPR and the Data Protection Act 2018, you have the following rights. You can exercise any of these rights by contacting us at privacy@familybrain.co.uk or by using the in-bot commands described in Section 8.

We will respond to all rights requests within one calendar month. In complex cases we may extend this by a further two months, in which case we will notify you within the first month.

FamilyBrain stores shared household records that can describe several people at once. To prevent one adult from erasing another adult's shared history, the automated WhatsApp deletion flow currently supports a full-family wipe only after the registered adults agree. A selective personal deletion command is not offered until the service can prove the authorship and shared-person scope of every affected record.

Full Family Wipe (Adult Consensus Required)

To delete all data for the entire family (including data submitted by other members), send:

/delete or /delete-all-family-data

Because this affects everyone, it requires consensus. The bot messages the registered adult members who are eligible to decide the request. Every eligible adult must reply YES within 48 hours. After the final confirmation, FamilyBrain starts a governed purge and confirms completion only after it has removed the live application data within its control, including:

• Family-scoped rows in the FamilyBrain application database
• Family originals and generated files in FamilyBrain's governed object-storage buckets
• FamilyBrain connector, notification, and pending action/effect state covered by the purge

If 48 hours pass without full consensus, the request expires and no purge begins. If a storage deletion or pending governed effect cannot be safely reconciled, FamilyBrain keeps the deletion blocked for recovery rather than reporting success prematurely.

Personal-scope or email request

For a personal-scope erasure request, or if you cannot use WhatsApp, email privacy@familybrain.co.uk with the subject line "Data Deletion Request" and the WhatsApp phone number(s) associated with the request. We will verify identity and scope, consider the rights of other people in shared records, and respond within the UK GDPR time limit. Complex requests may take longer where the law permits, and we will tell you if an extension is needed.

Children as data subjects

Although children are not users of FamilyBrain, information about children may be stored as part of a family's data. For example, an adult user may store a child's name in a calendar event (such as a school sports day), a school letter, or a medical appointment. In these cases:

• The child is a data subject but not a user of the service.
• The adult account holder acts as the data controller in relation to their child's information, and FamilyBrain processes that information on the adult's behalf.
• Children's data stored in this way is subject to the same retention, deletion, and security rules as all other family data (see Section 6 and Section 8).
• Children's data is never shared with third parties beyond the data processors listed in Section 5, and is never used for advertising, profiling, or any purpose unrelated to providing the family assistant service.

Parental responsibility

By using FamilyBrain and storing information that relates to a child under the age of 18, the adult account holder confirms all of the following:

• They have parental responsibility for the child, or are otherwise legally authorised to store and process information about that child.
• They have considered whether it is appropriate to store the child's information in the service, and are satisfied that doing so is in the child's best interests.
• They understand that the child's information will be processed by the data processors listed in Section 5 (OpenAI, Twilio and/or Meta Platforms, Inc., Supabase, Google Calendar API, Railway) as part of the normal operation of the service.
• They accept responsibility for ensuring that any information stored about a child is accurate and up to date.

No direct collection from children

FamilyBrain does not knowingly collect personal data directly from children. The service requires a WhatsApp account and active engagement with the bot; both of these require the user to be an adult. If we become aware that a child has accessed the service directly, we will take steps to remove their data and close their access.

Scope of the UK Children's Code

The UK Age Appropriate Design Code (Children's Code) applies to online services that are likely to be accessed by children. FamilyBrain is an adults-only service. We do not market to children, we do not design features to appeal to children, and we require users to confirm they are 18 or over at onboarding. Accordingly, the Children's Code does not apply to FamilyBrain. Should our service scope change in future, we will reassess this position and update this policy accordingly.

FamilyBrain uses only essential session cookies on its web pages (such as the family calendar page). We do not use tracking cookies, advertising cookies, analytics cookies, or any third-party cookies of any kind.

Because we use only strictly necessary cookies, we are not required by law to obtain your consent before setting them. However, we inform you of their use here in the interest of full transparency.

Some of our data processors are based outside the UK or process data in countries outside the UK. Where this occurs, we ensure that appropriate safeguards are in place as required by UK GDPR Chapter V.

We may update this Privacy Policy from time to time to reflect changes in the service, changes in applicable law, or feedback from users. When we make material changes, we will notify registered family members via WhatsApp at least 14 days before the changes take effect.

The "Last updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this policy periodically. Continued use of FamilyBrain after the effective date of any changes constitutes your acceptance of the updated policy.

Previous versions of this policy are available on request by emailing privacy@familybrain.co.uk.

FamilyBrain is operated by FamilyBrain Ltd, company number 17143333. Privacy matters are currently handled by Mr Rheinallt Daniel Jones, who is registered with the Information Commissioner's Office (ICO) under registration number ZC109957.

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us using the details below.