Terms

The agreement

1. Who and what

Second Brain is software that keeps your conversations with AI and brings in the context when you ask something. It works in Claude Code and Codex. It is offered by Valentine Buiten ("we"), established in the European Union. Reachable at valentinembacademy@gmail.com.

By "you" we mean the entrepreneur or organisation that enters into the agreement. You enter into this agreement in the course of your profession or business. If you start on behalf of an organisation, you must be authorised to do so. Second Brain is not for consumers.

By applying for your brain you agree to these terms. The agreement starts as soon as we approve your application. Part 3 applies to personal data that we process on your behalf; it sets out the role of each party. Part 2 explains what happens to personal data. Everything is on this one page, which you can read before you click.

2. Your brain

You get one brain, in your name and e-mail address. The brain keeps your conversations in the AI tools you connect (Claude Code, Codex) and the files you share in them, and the export of your earlier chats that you provide at the start. Nothing else from your computer. An ordinary chat on claude.ai or chatgpt.com is not recorded automatically.

Your brain is yours. What you put in it stays yours. You only give us the use needed to make Second Brain work and to make it better (article 6). We treat your content as confidential, and we never process it to train models. New features become part of the service as soon as we make them available.

We never ask for, collect, store or pass on your Claude or ChatGPT login, password or session token. You sign in to Claude Code or Codex yourself, on your own computer.

Our own processing, such as account management, security and improving Second Brain, is set out in Part 2. The suppliers in Part 2 also process data for the service. Administrators can only access it for maintenance, in case of a failure, or to make Second Brain better, and never for anything else. We are building a log of that access; until it exists, nothing records each look, and only Valentine has administrator access.

3. Take it with you or erase it, at any time

You can export your conversations at any time as JSON and Markdown, and erase everything: on request via valentinembacademy@gmail.com within five working days, and with one click on your own page once it exists. Erasing is final: your brain and the encrypted conversations disappear from the server. Online backups of an erased brain are gone after thirty days. Offline emergency copies of the server serve only to recover after a disaster. No automatic clean-up removes them yet; we destroy them by hand, at the latest twelve months after they were made. If one is restored, we erase erased brains again. Copies held by suppliers disappear within the periods that Part 2 names.

4. What it costs

Second Brain costs €19 per month, excluding VAT. For members of MB Academy it is currently free, for as long as we decide.

After approval you pay in the app. Your brain starts as soon as your payment has arrived; for members of MB Academy, as soon as we approve your application. If you do not pay within thirty days of our approval, the agreement ends and we erase your data as the privacy statement describes. This does not apply to members of MB Academy.

The price is per month and renews each month until you cancel. If a payment does not arrive, your brain pauses. The connector then only says that your brain is paused: nothing new is stored and nothing is retrieved. All your conversations stay stored until you pay again or erase them, as article 3 says.

You only pay after you have agreed to it separately and explicitly; a payment never arises by itself. We can give an offer, such as free use for members of MB Academy, and end it again. We announce that at least thirty days in advance, with what it costs afterwards. If you do not agree, your brain stops on the announced end date, which is at least thirty days after our message. Before that date you can export your conversations as article 3 says.

If the price changes, the same applies: thirty days' notice in advance, and payment only after your agreement. You can always cancel.

Features can change, be added or disappear. We tell you when something changes that you notice.

5. What you can expect

We keep developing Second Brain. We deliver the service with care, but we do not agree a fixed availability or recovery time. We announce maintenance in advance when we can.

The brain thinks along; you decide. Second Brain works with language models, and an answer or note can be wrong or incomplete: a wrong date, an amount that does not add up, a connection that is not there. With every answer that rests on something from your brain, the source is shown with it; for important matters, take a quick look at that source. Second Brain does not replace advice from an expert. What you do with an answer is your choice.

Keep your own copy of documents you really need, and make an export of your brain now and then.

6. Together we make the brain better

Second Brain gets better through how people use it. That is why we also look at your conversations and at what your brain makes of them: to come up with new features, to test what works well and to make the brain smarter. That way your own brain also gets better over time. If you would rather your brain did not help with this, let us know; we then leave it out and nothing else changes.

7. What you put in your brain

What you put in your brain is your responsibility. Only put in conversations and files that you are allowed to use, and make sure you have the arrangements with your customers or your client that this requires.

• You do not use Second Brain for anything that is prohibited, and you do not put in material that you are not allowed to have.
• You do not put data of others into your brain for which you have no legal basis. Part 3 applies to personal data that we process on your behalf; you see to lawful instructions and to the information for the people concerned.
• You do not provide special categories of personal data or criminal offence data. Also check your chat export before the import.
• You do not share your access with others, you do not put passwords or keys in it, and you do not try to get into another brain. If you suspect misuse of your access, report it immediately.
• You do not deliberately put a heavy load on the service, and you do not take the software apart to rebuild it.

If you do not keep to one of these terms, we first ask you to put it right. If there is a direct danger to security, we pause access immediately. We always say why. If it stays wrong, we can end your brain.

If someone else comes to us with a claim because you did not keep to these terms, you bear the part that arose from that, with reasonable costs of defence. We remain responsible for the part caused by us. We let you know in time, agree the approach together and make no settlement at your expense without your agreement.

8. If something goes wrong

If something goes wrong, we solve it together. If you notice a problem, report it as soon as you see it and give us what we need to look into it. We first get the chance to fix it. In an emergency you do not have to wait for that.

As long as you pay nothing, our liability is at most €250 in total per contract year. With paid use, it is at most what you paid in the twelve months before the first event that caused the damage, and never less than €250. We compensate the same damage once. We do not compensate lost profit, lost revenue, anticipated savings or lost opportunities, nor loss of data that you could reasonably have kept yourself. With damage, we also look at what each of us could reasonably have done to keep it small.

You submit a claim for damages to us within one year after you became aware of the damage and our possible role in it.

These limits do not apply in case of intent, fraud or gross negligence on our part, nor where the law does not allow a limit or time limit. The statutory rights of people who appear in your conversations remain.

Sometimes something beyond our control stops the service, including a failure at a supplier we need. We then do what we can to absorb it; this does not apply to what we could reasonably have prevented. If such an interruption lasts longer than thirty days, either of us may stop.

9. Stopping

You can always stop. We can stop if you do not keep to the terms (article 7) or if we end the service; in that last case you get thirty days' notice in advance. At every end you first get the chance to export your conversations. After that we erase your brain as in article 3.

10. Changes

If these terms change, we let you know thirty days in advance. A change to your disadvantage only applies after you have agreed to it. Without your agreement the existing terms continue to apply until the agreement validly ends. For a price, article 4 always applies.

11. Other arrangements

These terms apply between you and us. Those who work for us fall under the same protection. We can transfer this agreement to a company that continues Second Brain; we let you know in advance. If a term is invalid, the others simply continue to apply. Where they differ on personal data, Part 3 prevails.

12. Governing law

The law of Singapore applies to the agreement. We first put a dispute to each other. If we cannot resolve it, the court in Singapore decides. Mandatory statutory protection and rules of jurisdiction continue to apply; a consumer in the EU always keeps the protection of their own country.

Privacy

Here you can read what happens to personal data when you use Second Brain. This part is also for people who are not customers, such as someone who appears in a conversation or visits this site.

1. Who is responsible

Valentine Buiten, established in the European Union. Questions about your data: valentinembacademy@gmail.com. There is no data protection officer.

Two roles. For your account, contact with you, security, the counts for the site and making Second Brain better, we are the controller. For the content of your conversations, which we store and process on your behalf, Part 3 applies. For that, the controller (you, your organisation or your client) determines the purpose and the legal basis.

2. What data, and whether you have to provide it

• Your account: your name and your e-mail address. These are needed for the agreement; without them we cannot make a brain for you.
• Your conversations in Claude Code and Codex: the text and the files you share in them. Nothing else from your computer. Each message goes to your own brain during the conversation.
• The export of your earlier chats on claude.ai, which you provide at the start. Once. That step is part of the start: without the export your brain starts empty and does not know what you were working on.
• What your brain keeps of it: your conversations, stored as they are with their original dates, so you can search them and bring them back later. Your brain also makes embeddings of them (numerical fingerprints of text, made through OpenAI, article 4) so search can find them. It does not turn them into notes, facts or connections.
• Technical data: the time of a conversation, error messages and server logs with your IP address. How long each is kept is in article 5.
• What your brain does when it looks something up: for each look-up, the time, which tool, what was searched for and which messages came back. This is stored inside your brain, encrypted, so we can see how the brain retrieves and uses what it knows (article 3).
• Counts for the site: how many conversations and files there are in all brains together. Only numbers, added up across everyone; no text, no name, no individual brain.

Ordinary chats on claude.ai or chatgpt.com are not recorded automatically.

We only start storing and searching your conversations once your payment has arrived or, if you are a member of MB Academy, as soon as we approve your application. Until then we do not process them and do not use them to make Second Brain better.

About others. People appear in your conversations: customers, suppliers, colleagues. For their data that we only process on your behalf, you provide the information to those people, or you support your client in doing so, in line with your role. We help you with that. For our own purposes, the data about others that we use is the name and e-mail address of the contact person who starts on behalf of an organisation, and what is said about them in conversations when we use those conversations to make Second Brain better (article 3 of this part). Anyone who appears in a conversation and wants to know what happens to their data, or wants to object, can e-mail us.

3. For what, and on what basis

• For your account and contact with you, we process your name and e-mail address: to make your brain and to reach you if something changes in the service or the price, or if something is broken. Basis: the agreement with you; if you start on behalf of an organisation, our legitimate interest in reaching that organisation's contact person. No newsletter, no advertising.
• To keep the service secure and working: server logs with IP addresses, error messages, fixing failures, and the account sign-in and mail we send you (article 4). Basis: our legitimate interest in a secure, working service. The backups of your conversation content are part of the processing on your behalf below.
• Storing and making your conversations searchable: on your behalf, under Part 3.
• The counts for the site: the numbers per brain are added up to one total. Basis: our legitimate interest in showing that the service is alive; the totals cannot be traced back to a person.
• To make Second Brain itself better: coming up with new features, testing how people really use the brain, and making the brain smarter. For this we look at conversations and at how the brain retrieves and uses them, with the same suppliers as below. We use as little as necessary. Basis: our legitimate interest in improving the product, for you and for everyone who uses it. Never to take over or use your business ideas, your customers or your plans ourselves, and never to share them with others. If you do not want your brain to be used for this, e-mail us; we then exclude it and nothing else changes in your brain.

No processing is based on consent. There are no automated decisions with legal or similarly significant effects; a summary by AI is not one of them.

We do not use your data to train models and we do not sell it. We only share it with the suppliers below, and when EU law or the law of a member state requires us to.

We never ask for, collect, store or pass on your Claude or ChatGPT login, password or session token. You sign in to Claude Code or Codex yourself, on your own computer.

4. Who sees your data

Your brain is in its own database, separate from other brains. Administrators can only access it for maintenance, in case of a failure, or to make Second Brain better as article 3 of this part describes, and never for anything else. Only Valentine has administrator access today. We are building a log of administrator access to a brain; until it exists, nothing records each look. MB Academy does not see your data.

The suppliers below process data for the task described, under their own data processing agreement.

For every transfer outside the EEA we use the instrument in the table. You can view the safeguards via valentinembacademy@gmail.com.

5. How long

If we reject your application, we erase it immediately, with everything you provided. If we approve it and you have not paid thirty days later, we erase your application and everything you provided. This does not apply to members of MB Academy. If you ask for an export before that day, you get it first. Your account data and the backups follow the periods below. A brain that was already paid for and is paused does not fall under this.

We keep conversations and their embeddings for as long as your brain exists. After deletion, active copies disappear immediately. Online backups of an erased brain are gone after thirty days. Offline emergency copies of the server serve only to recover after a disaster. No automatic clean-up removes them yet; we destroy them by hand, at the latest twelve months after they were made. If one is restored, we erase erased brains again. Copies held by suppliers: Anthropic and OpenAI keep the content of a request for at most thirty days for abuse monitoring; the backups at Cloudflare disappear within thirty days of your brain being erased; your files and very large messages at Cloudflare disappear with your brain. Examples we keep to test Second Brain disappear with your brain. We erase your chat export as soon as it has been read in. We keep your account data for thirty days after the end.

Logs, one by one:

• The look-up log inside your brain (article 2): it has no automatic deletion. It stays until your brain is erased. "Forget this" removes the look-ups of that conversation, and we can delete the whole log on request.
• Records of how your brain chose which conversations to show (which conversations were considered, not the text of your message) and of each model call (task, model, token counts, cost, and an error message of up to 500 characters): no automatic deletion. They stay until your brain is erased.
• Server logs with IP addresses (the request lines and error messages of the server): the server's own log settings decide. We have not set a fixed term for them yet. We plan to limit them to thirty days; until that is in place they are removed when the server's own log rotation does so.
• The sign-in service keeps your sign-in session (with the IP address and the browser) for as long as it is valid, seven days, and until your account is erased. Records of the mails we sent to limit abuse (a short code of your address and IP address) are deleted after two days; mails waiting to be sent after seven days. The service's own logs rotate by size, not by time.

6. Security

Your raw conversations are stored encrypted and are only ever added to, never overwritten. A backup is made every night. Each brain has its own encryption key, which is only on the server and only readable by the administrator. Access to the server is with SSH keys, not passwords; administrators only work from within the EU. We are building a log of administrative access to a brain; it is not in place yet. Backups are encrypted before they leave the server, and each database dump is test-restored whenever an offline emergency copy is made.

For our own processing, we report a notifiable data breach to the supervisory authority without undue delay, where possible within 72 hours of becoming aware of it. If we have to inform you as a data subject, we do so without undue delay. For processing on your behalf, the notification arrangement in Part 3 applies.

7. Your rights

You can ask for access, a copy, rectification, erasure or restriction of the use of your personal data. You can object to processing based on our legitimate interest, including the use to make Second Brain better. Where the right to data portability applies, you get the data in a commonly used, structured and machine-readable file. E-mail valentinembacademy@gmail.com for this; we answer within one month. You can do a lot yourself: "forget this" removes something from your conversations and the embeddings; exporting and erasing everything is done on request within five working days, and with one click on your own page once it exists. You can also lodge a complaint directly with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

8. The site itself

second-brain.site sets one cookie, and only if you choose a language yourself: sb-lang, containing "en" or "nl", for one year, so that the home page opens in that language on your next visit. Beyond that the site sets no cookies and loads nothing from third parties; the fonts are on our own server. If you come via MB Academy, your browser remembers that in one local value, so that you see the welcome line. That value does not leave your browser. If you come via the MB Academy members' link, this browser tab remembers the code from that link. When you create your account, that code goes along to app.second-brain.site, so that we can confirm your membership. The site also asks the app whether the code still works; only the code goes along with that.

9. Age and changes

Second Brain is for adults who use it for their work. If this part changes, the new version is here with a date, and if a change affects you, you get a message.

Processing on your behalf

This part is the data processing agreement between you and us, as the GDPR requires.

1. Why this part

People appear in your conversations: you yourself, customers, suppliers, colleagues. This part applies to all personal data that we process on your behalf: the content of your conversations and what your brain makes of it. You act as the controller, or as a processor for your client. We, Valentine Buiten ("Second Brain"), then act as processor, or as sub-processor. The GDPR (Article 28) then requires arrangements. Here they are. They apply until all data has been returned or deleted.

You see to lawful instructions and to the information you must give to data subjects.

2. What we process

• Subject matter and nature: storing, making searchable and returning as context your conversations in Claude Code and Codex, and the export of your earlier chats that you provide.
• Purpose: supporting your work with what you discussed before.
• Duration: as long as your brain exists, and after that until all copies, backups included, have been returned or deleted.
• Data subjects: you yourself and the people who appear in your conversations (customers, suppliers, employees, contact persons).
• Data: names, contact details, business correspondence, arrangements, prices and amounts, and anything else you share in a conversation.
• Not allowed: special categories of personal data and criminal offence data. Also check your chat export before the import. If such data comes in anyway, we remove it on your request from conversations and embeddings; there is no automatic filtering.

3. Only on your instructions

We process data only on your documented instructions. This also applies to transfers outside the EEA. This part contains your first instructions. You give additional instructions by e-mail to valentinembacademy@gmail.com. We do not use the data to train models.

We use it for ourselves in two ways, both as controller and described in Part 2. We add up counts (how many conversations and files) to one total across all brains. And we use conversations to make Second Brain itself better: coming up with new features, testing how people use the brain, and making the brain smarter. Never to take over or use your business ideas, your customers or your plans ourselves, and never to share them with others. With these terms you allow that use, and you make sure that you are allowed to do so for the data of others in your conversations. If you do not want it, you say so and we exclude your brain.

If EU law or the law of an EU member state requires us to act otherwise, we tell you in advance. We do not do so if that law prohibits telling you on important grounds of public interest.

If we think an instruction infringes the GDPR or other applicable EU or national privacy rules, we tell you immediately. We do not carry out the disputed part as long as the conflict has not been resolved.

4. Confidentiality and security

Everyone on our side who can access the data is bound to confidentiality.

We take the measures that Article 32 GDPR requires. The agreed measures are in Annex 2. There we describe access control, encryption and recovery. Administrators only look into a brain for maintenance, in case of a failure, or to make Second Brain better (article 3 of this part). We are building a log of that access; until it exists, nothing records each look, and only Valentine has administrator access.

5. Sub-processors

With these terms you give general written authorisation for the sub-processors in Annex 1. We announce an addition or replacement at least thirty days in advance. Within that period you can object, with reasons, on grounds of data protection. Until there is a solution, we do not transfer your data to the disputed new party. If no solution is possible, you can stop; article 9 of this part then applies. We remain responsible towards you for the obligations of our sub-processors and impose at least the same obligations on them.

6. Outside the EEA

Transfers outside the EEA only take place according to your documented instructions and Chapter V of the GDPR. Annex 1 names, for each recipient, the legal name, task, data, countries of processing and transfer safeguard. The storage of your brain itself is in the European Union. Administrators only work from within the EU.

7. Help for you

We help you where possible with requests about all rights under Chapter III GDPR. Requests that we receive directly, we forward without undue delay to the e-mail address of your account. Deleting ("forget this"), exporting and erasing are done on request within five working days, and with one click on your own page once it exists.

We also help with security, data breach notifications, a data protection impact assessment (DPIA) and prior consultation with the supervisory authority. In doing so we take into account our processing and the information available to us. Our response time for this assistance is five working days.

A data breach involving data that we process for you, we report without undue delay, at the latest within 48 hours of becoming aware of it. We report what happened, which data and people are affected, the known numbers, possible consequences and measures taken. You get a contact point. Missing information follows as soon as it is available. Notifying the supervisory authority and data subjects is up to you; we help with that.

8. Audits

We give you the information needed to verify compliance with Article 28 GDPR. We cooperate with audits and inspections by you or an auditor you appoint. We agree reasonable conditions for scheduling, confidentiality and costs. Those conditions do not prevent a necessary audit.

9. End

At the end you choose whether we return or erase the personal data. Return takes place as an export in JSON and Markdown, on request within five working days, and with one click on your own page once it exists. After return we erase our copies. We also have copies at sub-processors erased. Online backups are gone after thirty days. Offline emergency copies of the server serve only for recovery after a disaster. No automatic clean-up removes them yet; we destroy them by hand, at the latest twelve months after they were made. If one is restored, we erase the erased data again. Copies held by sub-processors: Anthropic and OpenAI keep the content of a request for at most thirty days for abuse monitoring; the files and very large messages at Cloudflare are erased with the brain, and the backups at Cloudflare follow the thirty days. Only a retention obligation under EU law or the law of an EU member state can depart from this. On request we confirm the deletion in writing.

10. Liability and law

For our liability towards each other, article 8 of Part 1 applies, including the indemnity in article 7. This arrangement does not limit any statutory rights of data subjects under Article 82 GDPR. Our responsibility for sub-processors under Article 28(4) GDPR remains. The law of Singapore applies to this part; disputes go to the court in Singapore.

Annex 1: sub-processors

Google LLC takes part only if you choose "Continue with Google" to sign in. It is not our sub-processor for the content of your brain and gets none of it; it receives that you sign in to Second Brain, and decides on its own sign-in.

Annex 2: security measures

Confirmed (server repository, 1 Nov 2026): one database per brain; raw conversations encrypted and only ever added to; nightly backup; server in the EU. One encryption key per brain (AES-GCM for the raw conversations), only on the server and only readable by the administrator; access to the server with SSH keys; administrators only from within the EU; administrative access to a brain is not yet logged (we are building the log); backups encrypted (age) before they leave the server, every night, kept for thirty days; each database dump test-restored in a scratch database whenever an offline emergency copy is made; automatic security updates and fail2ban on the server. Online backups after deletion: thirty days (automatic clean-up on the server). One offline emergency copy, only for recovery after a disaster.