Privacy

Last updated 26 October 2026. Added how Teams works.

This explains what Cerebera knows about you, where it goes, how long it is kept, and what you can ask us to do with it. It is written to be read, not to be survived.

1. Who this is about

Cerebera is operated by Cerebera Systems Ltd, of 167-169 Great Portland Street, London W1W 5PF, United Kingdom (company number 13522872). For your own account we are the data controller: we decide what is held and why, and we answer for it.

For the customers and contacts you put into Cerebera, it is the other way round. Those people are yours, you decide what happens to them, and we hold them only so the software can work for you. Section 7 is about that.

2. What we hold

What you tell us

• Your name, so Cerebera can talk to you by it.
• An email address or a mobile number, so you can sign in and we can reach you. Both are encrypted where we store them, and a one-way key sits beside them so we can find your account without being able to read the address itself.
• Your company: what it does, where it is, its name, shareholders, tax details and the dates that apply to it.
• Your work: customers, deals, quotes, invoices, the words on your website, your posts, your reminders and your books.
• What you say to Cerebera in the chat, and the files you upload through it.
• Your preferences: your theme, your avatar style, and whether you like to talk or type.

What is collected without you typing it

• Two cookies we need: one that keeps you signed in and one that renews it. They are strictly necessary and carry no identifier used for anything else. Google Analytics cookies are only ever added if you say yes to them, as set out under "Cookies and Google Analytics" below.
• Which pages and features are used. Our own record notes what happened, such as "opened the Sales page", "sent a chat message" or "bought the PRO plan", with the page as a pattern ("/customers/:id", never whose) and a few plain words like the plan or the module. It never holds what you wrote, your name, your email, your company details or your network address, and it sets no cookie. When you are signed in it is kept against your account, so it is deleted with your account. It is kept for 400 days.
• A country code. When you sign in, your network address is checked once, on our own server, against a list held on that server, to work out which country you are in. If it cannot tell, your device's time zone may be used instead. That decides which currency you see, and which country we set your business up for until you tell us where it is; what you tell us always wins. The country code is kept. Your network address is not stored, and it is never sent anywhere to do this.
• Server logs of which address was requested, whether it worked, and how long it took. They do not contain your network address, your account, or anything you typed.
• Sign-in records: when a session started, when it expires, and the browser it started from, so you can be signed out and so we can tell a stolen session from yours.

What we do not collect at all

No advertising or marketing pixels. No third-party trackers other than Google Analytics, and that only with your yes. No location beyond the country. No device identifiers. The typefaces are served from our own server, so simply opening a page does not tell anybody else that you did.

Cookies and Google Analytics

3. Why we are allowed to hold it

4. The AI part, said plainly

Cerebera answers you using a large language model run by Anthropic. To do that we send them what you said, the recent conversation, and the parts of your records the answer needs. That can include your company details and the names and figures on your own customers, deals and invoices.

• It is sent to be answered, and then it is done. Under the commercial terms we use it is not used to train their models.
• We do not send a password, because there is not one. We do not send payment details, because we never have them.
• Anything a stranger wrote, such as a message through your website, is wrapped and marked as somebody else's words before the model reads it, so text from outside cannot be treated as an instruction.
• The model can be wrong. Nothing it proposes leaves Cerebera or changes a record until you say yes. That is a rule the product enforces, not just a sentence in a document.

5. Talking to Cerebera

If you use your voice, the listening is done by your own browser, not by us. In Chrome that means the audio goes to Google's speech service and comes back as text. In other browsers it may be done on your device. We never receive the audio and we never store it. What we receive is the text, exactly as if you had typed it, and you can read that text on screen before anything is done with it. The app says this on the screen where you speak, every time.

6. Who else sees it

We do not sell anything to anybody, ever, and we do not share your information for anybody else's marketing. These are the services that do a job for us, and each one gets only what that job needs.

Which of these are switched on is not a secret. The address /system/adapters reports it, and anything running in practice mode is labelled as practice mode on screen too, so a demonstration can never quietly look like the real thing.

We will also hand something over where the law actually requires it, and if the business is ever sold or merged your records go with it, on these same terms.

7. Your customers are yours

When you add a customer, upload a list, or somebody writes to you through the website we host for you, you are the one who decides what happens to those people. We hold them on your behalf and do as you ask. In the law's words, you are the controller and we are your processor.

• Their email addresses and phone numbers are encrypted where we store them.
• Campaigns only go to people who gave you their address. Not a list you bought, and never somebody Cerebera found for you. The product refuses it; this is not only a promise on a page.
• A first letter to a business is the one exception. Find customers looks at public web pages for businesses that list their details for enquiries. It keeps only what the business published there: its name, the contact it lists, the email or phone it lists, and the page it came from, so you can check it. It never guesses an address. You can write to one of these businesses one letter at a time, after reading every word. That letter says why they are hearing from you and how to stop it, and they never go on a campaign, even if they later become your customer.
• Every marketing email and every first letter carries a way out, and once somebody opts out we hold their address only as a one-way key, so the list that remembers them cannot be read back.
• You are responsible for having the right to hold the people you put in, and for telling them what you do with their information.

7A. If you're on someone's team

When a business on Cerebera adds you to its team, we hold your name, your email address, and what you do in Cerebera for that business.

The business's owner decides what you can see and do. The owner can see your name, email, role, when you were last here, and how much of your Cerebera allowance you've used. Your private Message conversations stay private, unless the owner is in that conversation.

Messages in Message are stored encrypted. We keep them while the business uses Cerebera.

If the business's plan ends, you're paused, not deleted. If you're removed from a team, we remove your name, email and photo 90 days later. The work you did stays with the business, shown as "Former team member".

If you add people to your team

When you add people to your team, you're responsible for having a good reason to give them access, and for telling them what you use Cerebera for.

8. How long we keep it

Your account and your work stay until you ask us to remove them. The housekeeping around them clears itself on the schedule the database enforces:

Records with money in them stay for as long as the law says a business must keep its books, which is longer than anything above.

9. What you can ask us to do

Whether you are in the UK, in India, or somewhere else, you can ask us to show you what we hold, correct it, delete it, give you a copy to take elsewhere, or stop doing something with it. You can also complain to a regulator. In the UK that is the Information Commissioner's Office.

How to ask, honestly. Today there is no button. You write to privacy@cerebera.com from the address on your account, and a person does it. We answer within 30 days. We are building the button; until it exists this is the way that works, so this says so rather than describing a screen that is not there.

Some of it you can already do yourself. Your money records download as spreadsheet files from the Money page, and everything you have made stays readable and editable on its own screen for as long as your account is open, including after a plan has stopped.

10. Keeping it safe

• There is no password to steal. You sign in with a code sent to you, and it expires.
• Email addresses and phone numbers, yours and your customers', are encrypted with AES-256-GCM before they are written down.
• Where we only need to answer "is this the same address?" we store a one-way key and not the address.
• Everything travels over an encrypted connection.
• Every record is fetched with its owner named in the same question, so one account cannot reach another's. Three tests hold that open for every kind of record we store.

No system is perfect. If something happens that puts your information at risk we will tell you and the regulator within the time the law allows, and we will tell you what actually happened.

11. Where in the world it is

Cerebera is used in the United Kingdom and in India, and the services in section 6 handle information in the United States and elsewhere. Where information leaves the country it started in, it moves under the standard contract terms approved for that purpose, and each of those services is under a written agreement with us to hold it only for the job it is doing.

12. Not for children

Cerebera is for running a business and is not for anybody under 18. We do not knowingly hold information about a child. If you think we have, write to us and it will be removed.

13. When this changes

If we change something that matters we will say so in the app before it takes effect, and the date at the top will move. Small corrections happen without a fuss, and the date still moves.

14. Getting hold of us

About your information: privacy@cerebera.com. About anything else: support@cerebera.com.