Privacy Policy

MetaBrain is an AI-powered metadata generation tool for microstock photographers, operated at metabrain.online by Aleksandrs Tihonovs. For the purposes of data protection law, Aleksandrs Tihonovs (operating as MetaBrain) is the data controller with respect to your personal data. For questions regarding this policy, contact us at support@metabrain.online.

We collect the following categories of data:

Account Data

• Email address, display name, and profile photo URL, obtained from your Google account when you sign in.
• A unique user identifier assigned by our authentication system, and your subscription and credit status.

Usage Data

• A record of each processing request: mode, AI model used, token counts, estimated cost, whether it succeeded, and the timestamp. This is what enforces your plan limits.
• Your processing history: file name, the generated title, description and keywords, and a thumbnail of the file. This is stored so that you can see your own past results in the application.

Abuse Prevention Data

• The IP address your processing requests come from, together with the first and last time we saw it. We use it to detect multiple free accounts operated by one person. We do not track which pages you visit.
• In the macOS application only: a hardware identifier derived from your Mac's platform UUID. It is one-way hashed (SHA-256) before it leaves your computer; the raw UUID is never transmitted.

Content Data

• The images and videos you submit are sent to our server and to the AI provider that generates the metadata (see “Data Sharing” below). We do not keep the original file — it is processed in memory and discarded once the response is returned. What remains is the generated text and the thumbnail described above.

We use your data for the following purposes:

• Service delivery — to authenticate you, enforce subscription limits, process your images, and return generated metadata.
• Billing — to track credit usage and subscription status. Payment data (card details) is handled exclusively by Paddle and is never accessible to MetaBrain.
• Abuse prevention — to detect and prevent fraudulent account creation, misuse of the free tier, and violation of our Terms of Service.
• Service improvement — to track aggregate usage and error rates and improve the reliability and quality of the Software. We do not use your Content to train AI models.
• Legal compliance — to comply with applicable law, respond to lawful requests, and enforce our Terms of Service.
• Product communications — to send you release notes, product updates, and occasional offers related to MetaBrain. You can unsubscribe at any time via the one-click unsubscribe link included in every email. Transactional emails (account confirmation, billing receipts) cannot be opted out of while your account is active.

For users in the European Economic Area (EEA) and the United Kingdom, we process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Service you have requested (account management, AI processing, subscription enforcement).
• Legitimate interests — fraud prevention, abuse detection, and service reliability monitoring, where our interests are not overridden by your rights.
• Legal obligation — where we are required to retain or disclose data to comply with applicable law.

We do not sell, rent, or trade your personal data. Our database, authentication and file storage run on our own servers, which are hosted at an Oracle Cloud data centre in Frankfurt, Germany. Beyond that, we share data only with the following providers, each acting on our behalf:

• Google LLC — provides sign-in with your Google account, and the Gemini API that generates metadata from your files. Google processes submitted files under their API data processing terms.
• OpenAI, L.L.C. and Anthropic, PBC — provide the alternative AI models used when the primary provider is unavailable, and for certain content types. They receive the same submitted files and process them under their respective API terms.
• Paddle.com — processes all payments as the Merchant of Record. Paddle collects and retains billing information including payment card details, billing address, and transaction history. Paddle's privacy policy governs their use of your payment data; we never see your card details.
• Cloudflare, Inc. — hosts our application installer files. Cloudflare may log download requests, including IP addresses.
• Resend, Inc. — delivers our transactional and product emails, and receives your email address for that purpose only.

As a rule, we keep your data for as long as your account exists, and delete it when the account is deleted. In detail:

• Account data, processing history and IP records — kept while your account exists. Deleting your account removes them.
• Records of billed usage — kept after account deletion, because we need them to account for what was charged. They contain no file names or generated content.
• Submitted images and videos — not kept at all beyond the moment of processing.

You can ask us to delete your account and its data at any time, at support@metabrain.online.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — the right to request a copy of the personal data we hold about you.
• Rectification — the right to request correction of inaccurate personal data.
• Erasure — the right to request deletion of your personal data, subject to our legal retention obligations.
• Portability — the right to receive your data in a structured, machine-readable format.
• Objection — the right to object to processing based on legitimate interests.
• Withdrawal of consent — where processing is based on consent, the right to withdraw it at any time.

To exercise any of these rights, please contact us at support@metabrain.online. We will respond within 30 days. We may require identity verification before processing your request.

All data is encrypted in transit (TLS). Database access is restricted by row-level security so that an account can read only its own records, sessions use tokens that expire and are refreshed automatically, and device identifiers are stored only in hashed form. No system is completely secure, and we cannot guarantee absolute security.

The MetaBrain desktop application does not use browser cookies. The web portal at metabrain.online uses only strictly necessary session cookies required for authentication (managed by Supabase Auth). We do not use advertising cookies, tracking pixels, or third-party analytics services on the public-facing website.

Your data is stored on our servers in Germany. It leaves the EU when it is passed to the providers listed above — the AI providers, Paddle, Cloudflare and Resend — which operate from the United States. For those transfers we rely on the safeguards in their data processing terms, such as Standard Contractual Clauses.

MetaBrain is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately at support@metabrain.online and we will take steps to delete such data promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Effective date" at the top of this page and, where appropriate, by in-app notification. Your continued use of MetaBrain after the updated policy takes effect constitutes acceptance of the changes.

For any privacy-related questions, requests, or complaints, please contact us at support@metabrain.online. If you are located in the EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.