Privacy policy

3 November 2026

This policy covers the website thesecondbraincompany.ai (and secondbraincompany.com, which redirects to it) and the contact details you leave when you ask for a call. Questions go to tim@thesecondbraincompany.ai.

1. Controller

Windrose Space BV is the controller under the General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018. The company has no data protection officer. The law does not require one at its size.

2. Scope

Data handled while building a second brain for a client falls outside this policy. That work is governed by the engagement agreement, with a data processing agreement where the law requires one.

3. The website

The website sets no cookies and runs no analytics or tracking. The hosting provider keeps a technical log of each request (IP address, time, page, browser) for a short period to detect abuse. The legal basis is our legitimate interest in running a secure website (article 6(1)(f) GDPR). We do not use the logs to identify visitors. Typefaces are served from our own domain.

4. Asking for a call

The form asks for your name and either an email address or a phone number. We use them to get back to you and set up the call, and, if you go ahead, to prepare and run the engagement. The legal basis is the steps taken at your request before a contract (article 6(1)(b) GDPR).

If no engagement follows, we delete your details twelve months after our last exchange. If one does, they become part of the client file and are kept for the duration of the engagement and for as long as Belgian accounting and tax law requires afterwards. Emails are handled under the same rules.

5. Processors

Two providers process data on our behalf under contract. Google Ireland Limited (Google Workspace) handles email, calendar, and file storage. Cloudflare, Inc. hosts the website and its DNS. Both process data in the EU and the United States. Transfers to the United States rest on each provider's certification under the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses.

We do not sell personal data or share it with anyone else, unless the law obliges us to.

6. AI tools

Contact details from the form or from email are not fed into any AI service. During an engagement, the AI tools used and where they run are agreed in writing beforehand. The three deployment options on the site describe what each one means for your data.

7. Your rights

Under the GDPR you may ask us to:

• confirm whether we hold data about you, and send you a copy
• correct data that is wrong or incomplete
• delete your data, unless the law requires us to keep it
• restrict its use while a question about it is settled
• hand over the data you gave us in a machine-readable format
• object to processing based on our legitimate interest

Send requests to tim@thesecondbraincompany.ai. We answer within one month and may ask you to confirm your identity first.

Complaints can be lodged with the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be, contact@apd-gba.be.

8. Security

Accounts are protected by hardware security keys and two-factor authentication. Data is encrypted in transit and at rest. One person has access.

9. Changes

New versions of this policy appear on this page with a new date. Changes that affect data you have already given us will be sent to you directly.