Privacy Policy.
This Privacy Policy explains how little big brain UG (haftungsbeschränkt) handles personal data when you visit littlebigbrain.com or docs.littlebigbrain.com, use the cloud console, APIs or hosted agent tools, contact us, or manage an account.
1 Who is responsible
The controller for our website, account administration, billing, business communications and service operations is:
little big brain UG (haftungsbeschränkt)
Löwestraße 13
10249 Berlin, Germany
Managing director: Rino Montiel
Commercial register: Amtsgericht Charlottenburg (Berlin), HRB 289555 B
VAT ID: DE464603741
Privacy contact: [email protected]
When an organization uses little big brain to process personal data for its own purposes, that organization normally acts as the controller and we act as its processor. If the organization itself acts as a processor, we may act as its subprocessor. That processing is governed by the customer's instructions and the applicable data processing agreement. This notice does not replace the customer's own privacy notice.
If your information appears in a customer's graph, document or connected source, contact that customer to exercise your rights. We assist the customer as required. You may also contact us if you need help identifying the responsible customer.
2 Personal data we handle
Website and technical data. Visiting our sites or calling our services makes technical information available, such as your IP address, request time, browser and device information, requested resource, response status and security information. Our hosting and network providers also process information needed to deliver requests.
Account and organization data. We process your email, name when supplied, identity and organization identifiers, organization name, membership, roles, invitations, verification state, authentication and session information, and account preferences. An administrator or identity provider may supply some of this information.
Billing data. This includes billing contact details, address, country, tax information, accepted plan, usage measurements, credits, payment status, invoice identifiers and payment-provider references. Card details are entered with Stripe. Our console does not collect or store the full card number.
Contact and support data. We process the name, email, company, selected plan and message you submit through our contact form, along with information you provide in support correspondence. Please avoid including secrets or personal information unrelated to your request.
Customer content. Content you or your authorized users submit may include records, documents, RDF statements, schemas, linked facts, source identifiers, queries, questions, integration credentials and derived indexes or embeddings. It can contain information about your customers, staff or other people. Connected sources supply the data you authorize us to access.
Model inputs and outputs. Managed AI features process relevant content, questions, schema descriptions, example values, query results, generated answers and evaluation information. We also keep records of model inputs and outputs to support the workspace's quality checks and replay features. These are separate from browser analytics.
Optional analytics. Section 5 describes the limited event and profile information collected through PostHog.
3 Purposes and legal bases
Where we act as controller, we use personal data for the following purposes:
| Purpose | Data involved | GDPR legal basis |
|---|---|---|
| Deliver the website, authenticate users and provide the service | Technical data, identity, sessions, memberships and necessary service data | Article 6(1)(b) where necessary for a contract with you; Article 6(1)(f) for administering an organization's contract and providing secure access to its users |
| Answer an inquiry, arrange a demonstration or provide support | Contact details, correspondence and relevant account information | Article 6(1)(b) for steps you request toward a contract or support under your contract; Article 6(1)(f) for other business correspondence |
| Measure usage, invoice and collect payment | Billing and usage data | Article 6(1)(b) for your contract; Article 6(1)(f) for an organization's contract; Article 6(1)(c) for tax and accounting duties |
| Detect abuse, investigate faults and maintain security | Technical logs, request identifiers and relevant account or service information | Article 6(1)(f), reflecting our interest in protecting users, systems and service reliability; Article 6(1)(c) where a legal duty applies |
| Understand website and product use through optional browser analytics | The analytics data in section 5 | Article 6(1)(a), consent |
| Comply with law and establish, exercise or defend claims | Relevant records | Article 6(1)(c) for legal duties or Article 6(1)(f) for protecting legal rights |
We weigh our legitimate interests against your rights and freedoms. You may object as described in section 10. Processing customer content on a customer's behalf follows the customer's documented instructions and legal basis.
We need certain identity, account and billing information to provide the requested service. Without it, we may be unable to create an account, authenticate you, process a payment or respond to an inquiry. Analytics consent is optional.
4 Managed AI and connected services
Managed embeddings send the selected text and search text to the configured embedding service. Model routes in the platform include OpenAI models accessed through OpenRouter. Reranking and routing use TypeSafe. Question answering and model checks use Anthropic. Other configured model services may apply to a feature you select.
For example, a question answering request can send your question, context, selected record identifiers and labels, schema information, short example values, and relevant query rows to a model provider. Ontology fitting, evaluation and quality checking may send relevant source samples, model inputs and outputs, or retrieved facts. The Models view and feature documentation describe the models in use. Sending a request that uses one of these features causes this processing; a Free workspace's managed embeddings also involve a model provider.
We process customer content to deliver the selected features, maintain its indexes and perform evaluations for that workspace. We do not use customer content to train a general purpose model shared with other customers without a separate, explicit agreement. Training a custom model at your instruction is a distinct use of the training data you select.
This commitment does not mean that every external provider offers zero retention. Provider retention, safety processing, caching and any training restrictions depend on the applicable provider agreement and configuration. The completed provider information in section 7 must identify those arrangements.
If you connect your own agent, model or external application, information that it reads may also be processed by that provider under your arrangements with it. We cannot control copies it receives. Disconnecting a source stops future access through that connection; it does not automatically erase data already imported into a graph.
5 Cookies and optional analytics
We use cookies and similar storage to keep you signed in, protect account actions and remember choices. Storing or reading information strictly necessary for a digital service you request is covered by the exception in section 25(2) TDDDG. The related personal data is processed on the legal bases described in section 3.
We use optional PostHog EU analytics only after you opt in. The preference applies across our website, documentation and console in the same browser. You can refuse or withdraw consent through Cookie settings in the website footer. Withdrawal stops future collection and clears the browser's analytics persistence; it does not itself erase events already held by PostHog. We also respect a browser's Do Not Track setting. Refusing analytics does not remove your contractual entitlement to the core service.
Analytics events record normalized page paths and selected actions, such as choosing a plan, opening documentation or completing a query. They can include pseudonymous browser and session identifiers, account and environment identifiers, timing, a referring domain and limited campaign labels. In the signed-in console, the profile may include your email, name, company and account identifier. Anonymous site activity can be associated with your signed-in profile through the shared browser identifier.
Our event filters exclude query text, query results, API keys, contact form contents, raw URL query strings and arbitrary page or form text. Session replay, automatic interaction recording, heatmaps and browser exception recording are disabled. These restrictions apply to browser analytics; service logs and AI processing have different purposes and data flows.
| Storage | Purpose | Lifetime |
|---|---|---|
lbb_wos_session |
Sealed account session | Up to 7 days from issue or renewal; removed on sign-out |
lbb_csrf |
Protect account actions against forged requests | Up to 7 days from issue or renewal; removed on sign-out |
lbb_analytics_consent_v1 |
Remember your analytics choice across subdomains | 180 days from the saved choice |
| PostHog identifier cookies and browser storage | Recognize analytics activity when enabled | Identifier cookie default up to 365 days; browser storage remains until cleared or analytics is disabled |
Your browser can also remove cookies and site storage. Blocking necessary session cookies can prevent sign-in. An identifier's browser lifetime is separate from the provider's retention of collected events.
6 Who receives user data
We disclose information to providers only as needed for the relevant function, to authorized account users, and where a lawful disclosure is necessary. The implementation uses:
| Provider or recipient | Function and information involved |
|---|---|
| Hetzner | Hosted service infrastructure and object storage for customer graphs and operational records |
| Cloudflare | Website, documentation and console delivery, network protection and processing of website contact requests |
| WorkOS AuthKit | Identity, authentication, invitations, organization membership and related session information |
| Resend | Delivery of website inquiries and other configured email messages |
| Stripe | Payment collection, tax calculation, billing details, receipts and payment management |
| Metronome | Usage rating, billing records and invoice creation |
| PostHog EU | Browser analytics, signed-in analytics profiles and console feature flag processing when enabled |
| Grafana Cloud | Operational metrics and logs, including relevant account, environment and request identifiers |
| OpenRouter and its selected model providers, including OpenAI | Managed embeddings and configured model evaluation requests |
| TypeSafe | Routing, reranking and configured model decisions |
| Anthropic | Question answering, ontology fitting and model quality checks |
| Modal or other model infrastructure selected for a custom feature | The inputs needed to run or train the selected model; provider details must be disclosed before that processing |
External services you authorize, such as a connected source or agent, receive the information required for that integration. Your organization's administrators can manage membership and may access the organization's content and usage information.
7 Locations and international transfers
The standard EU deployment configuration places the hosted service and object storage with Hetzner in Germany. Website delivery uses Cloudflare's network, and the analytics configuration uses PostHog EU. These facts do not mean that every provider's support, account administration, model processing or onward processing stays inside the European Economic Area.
You can contact [email protected] for information about the applicable safeguards and to request a copy, with confidential information redacted where necessary.
8 Retention and deletion
We keep information for the purpose for which it was collected and any applicable legal retention period. The relevant criteria include whether your account is active, whether a request or dispute remains open, whether information is needed for security or service operation, and whether a statutory record must be preserved.
Customer graphs and history. Graphs can retain previous versions of records, derived indexes, embeddings, imported data and model records for replay and quality checks. Removing a record from the current view does not necessarily erase its earlier versions. Whole-graph deletion withdraws access first and physical cleanup follows through background jobs. Contact us if you require erasure of personal data across retained history or related records.
Workspace closure. Deleting a workspace revokes access to its environments, starts or performs the relevant data purge, and removes the WorkOS organization. It does not automatically delete every identity record, invoice, operational record or analytics event. A person who belongs to other workspaces may retain an identity for those workspaces. Erasure requests are reviewed across these separate systems.
Model records. Model inputs, outputs, checks and evaluation traces may remain with the workspace's records. The custom model-run cleanup has separate configured defaults of 7 days for completed run text logs and 90 days for run manifests. Those defaults are not a retention limit for all AI inputs, outputs or evaluation records.
Billing and legal records. We preserve records for the applicable German tax and commercial retention periods. Depending on the record category, these are generally 6, 8 or 10 years from the end of the relevant calendar year, and may extend while a legally relevant matter remains open.
Analytics and external providers. Disabling analytics stops future browser collection. Requests to erase existing PostHog data require separate handling. Account closure does not itself instruct every external provider to erase every record; lawful retention duties and the applicable processing agreements also apply.
When erasure is required, we remove or irreversibly anonymize the relevant information and coordinate with processors as applicable. Information that must be retained is restricted to its lawful purpose.
9 Security and automated processing
We use technical and organizational measures appropriate to the risks, including protected connections, authenticated access, permissions and separation of customer environments. Access is limited to the people and providers who need it for the relevant task. A security measure does not eliminate every risk; please protect your account and integration credentials.
Managed models produce retrieval, ranking, schema and answer suggestions. You and your organization decide how to use those results. Automated billing and plan controls can restrict service access when a payment fails or a configured limit is reached. Contact us if you believe a restriction is incorrect or need a human review. We do not use our analytics profiles to decide employment, creditworthiness or similar matters about you.
10 Your rights
Subject to the conditions in applicable law, you may request access, correction, erasure, restriction, and portability of your personal data. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. You may withdraw consent without affecting earlier lawful processing.
Send requests to [email protected]. We may request proportionate information to verify your identity. We normally respond within one month; where the law allows an extension, we explain it within that month.
You may complain to a supervisory authority, particularly in the country where you live or work or where a suspected infringement occurred. Our local authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin. Its complaint instructions explain the available channels. Contacting us first is optional.
11 Children and changes
The service is intended for adults. If you believe a child has supplied personal information directly to us inappropriately, contact us so we can assess and address it. Organizations remain responsible for the personal data they place in their own workspaces.
We may update this notice when our processing changes. We show the effective date and provide additional notice where required. A policy update does not create consent to a new purpose; where consent is required, we ask for it.