Legal

Privacy policy

Last updated: 25 October 2026

This policy explains what information RealBrain collects, why we collect it, who we share it with, how long we keep it, and how you can have it deleted. We do not sell personal information, and we do not use it for advertising.

1. What this policy covers

This policy applies to:

• the website at realbrain.cc;
• RealBrain accounts at accounts.realbrain.cc;
• the community forum at forum.realbrain.cc;
• DMJar, our Messenger assistant for businesses, at app.dmjar.com;
• any other RealBrain product that links to this policy.

Some RealBrain products, such as BG Remover, publish their own privacy policy. Where a product has its own policy, that policy explains what the product collects, and this one covers your RealBrain account and anything the product's policy does not.

2. Information we collect

When you visit realbrain.cc

• Usage analytics. We use Google Analytics to understand how the website is used: pages viewed, how you arrived, approximate location (city level), device and browser type, and similar usage information. Google Analytics uses cookies to do this.
• Technical data. Our hosting provider, Cloudflare, processes your IP address and browser details to deliver pages and protect the site from abuse.
• Fonts. Our pages load fonts from Google Fonts, so your browser sends your IP address and browser details to Google when a page loads.
• Email. If you email us, we receive your email address and whatever you include in the message.

When you create or use a RealBrain account

• Account details: your name, email address, and password. We store only a salted, one-way hash of your password, never the password itself.
• Approximate sign-up location: when you register, we record the country, region, city, time zone, and continent that our hosting provider, Cloudflare, derives from your connection. We do not store your precise location or your IP address on your account record.
• Sign-in sessions: for each active sign-in we store the IP address and browser user agent it came from, together with a hashed session token, so you stay signed in and we can detect misuse.

When you use the forum

• The thread titles and posts you write, your display name as it was when you posted, and when you posted or edited them.
• Forum threads are public. Anyone can read them without signing in, and search engines and AI services may index them.

3. Data we receive from Meta platforms (DMJar)

DMJar is a RealBrain product that answers customer messages for businesses on their Facebook Page through Messenger, and through a chat widget on the business's own website. Replies are drafted by AI. The business that connects its Page decides to use DMJar for its customers, so for its customers' messages, that business is the data controller and RealBrain processes the data on its behalf. For the business's own DMJar account, RealBrain is the controller.

From the business that connects its Page

• the email address used to sign in to DMJar (sign-in is by a one-time code sent to that email);
• business details the owner enters: business name and type, menu or product list, prices, delivery areas, fees, policies, assistant settings, and optional alert and webhook settings;
• the Facebook Page's ID and a Page access token issued by Meta, which lets DMJar receive and reply to that Page's messages. The token is kept in encrypted secret storage, never in our databases or logs.

From Messenger, when someone messages a Page that uses DMJar

• the Page-scoped ID that Meta assigns to the person for that Page, the message text, the time it was sent, buttons tapped, stickers, and links to any photos or files attached;
• the person's first and last name from their Messenger profile, so the business can see who it is talking to. We do not request profile photos, gender, locale, friends, or any other profile information;
• replies the Page's own staff send from the Page inbox, so DMJar knows to pause and let a person take over;
• details the customer chooses to give in the chat to place an order, such as their name, phone number, delivery address, and the items ordered.

For photos, we store only the link Meta provides. A photo is downloaded only so the AI can read it while drafting a reply, and is then discarded.

From the website chat widget

Before chatting on a business's website, a visitor gives their name and email address. The widget also creates a device identifier in the visitor's browser, using the open-source FingerprintJS library with nothing sent to FingerprintJS, only to limit duplicate sign-ups. It stores a random visitor ID and the name and email in the browser's local storage. Messages are stored like Messenger conversations.

How we use and protect Meta Platform Data

• We use data received through Meta's platforms only to provide DMJar to the business that connected the Page: understanding each message, drafting and sending replies, taking orders, showing conversations in the business's DMJar inbox, and alerting the business when a person needs to step in.
• We do not sell it, use it for advertising, share it with data brokers, combine it across different businesses, or use it to build profiles of people.
• We do not use it to train AI models. Our AI provider, Anthropic, processes it under commercial terms that do not allow Anthropic to train its models on it.
• We handle it in line with Meta's Platform Terms and Developer Policies.
• Anyone who has messaged a Page that uses DMJar can ask us to delete their data. See Data deletion.

4. How we use information

• to provide our services: signing you in, showing your forum posts, and running DMJar for the businesses that use it;
• to keep accounts and services secure, including rate limiting, detecting abuse, and investigating problems;
• to answer your questions and support requests;
• to understand how the website is used so we can improve it, using aggregated analytics;
• to meet legal obligations.

We do not sell personal information, use it for targeted advertising, or share it with data brokers.

Where the law of your country requires a legal basis for processing (for example the GDPR), we rely on: performing our contract with you (providing the account or service you asked for); our legitimate interests in running secure, working services and understanding website use; your consent where we ask for it; and legal obligations.

5. Who we share it with

We share information only with the service providers that run our services, and only as far as they need it to do so:

We may also disclose information if the law requires it, to protect the rights, property, or safety of RealBrain, our users, or the public, or as part of a transfer of the RealBrain business, in which case this policy would continue to apply to your information.

6. Cookies and similar technologies

You can block or delete cookies in your browser settings. Blocking rb_session means you cannot stay signed in. To opt out of Google Analytics on every site, you can use Google's opt-out browser add-on.

7. How long we keep it

• RealBrain account: until you ask us to delete it. Sign-in sessions, with their IP address and browser details, are deleted when you sign out, or automatically within a day after they expire (30 days after your last activity).
• Forum posts: until you delete them or ask us to. A deleted post is hidden from everyone straight away. If you ask us to delete your data, we also permanently erase your posts from our database.
• DMJar business accounts: while the business uses DMJar. When a business asks us to close its account, we delete its account, settings, and its customers' conversations within 30 days.
• DMJar conversations and orders: kept while the business uses DMJar, so the assistant and the business can see the conversation history. A customer can ask us to delete theirs at any time (see Data deletion). Message-deduplication records expire after 24 hours, and cached Messenger names after 30 days.
• Analytics: Google Analytics keeps event data for the retention period set in our account, at most 14 months.
• Server logs: kept by Cloudflare for a few days, then deleted automatically. They contain request identifiers, not message text.
• Emails you send us: as long as needed to deal with your request, and then up to 2 years for our records, unless you ask us to delete them.
• Backups: deleted data can remain in our hosting provider's automatic database backups for up to 30 days before it is overwritten.
• We may keep information for longer where the law requires it, for example payment records for tax purposes.

8. Security

All our services are served only over HTTPS. Passwords are stored as salted PBKDF2 hashes, session tokens are stored only as hashes, secrets and access tokens are kept in encrypted secret storage rather than in code, and access to production data is limited to the operator. No system is perfectly secure, but we work to protect your information and will tell affected users and the authorities about a breach where the law requires it.

9. International transfers

RealBrain is run from Bangladesh, and our service providers (Cloudflare, Google, and the others listed above) process data in data centres in several countries, including the United States and the European Union. When we transfer information across borders, we rely on these providers' contractual safeguards for international transfers.

10. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent you have given. You can use any of these rights, whatever country you live in, by emailing [email protected]. We reply within 30 days. We may need to confirm your identity first, usually by replying from your account's email address.

To delete your account or other data, follow the steps on our Data deletion page.

If you think we have handled your information wrongly, please contact us first so we can fix it. You also have the right to complain to the data protection authority in your country.

11. Children

RealBrain services are not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We will update this policy when our services or practices change, and change the date at the top. For significant changes, we will give notice on the website or by email before the change takes effect.

13. Contact

• Email: [email protected] (or [email protected])
• Phone: +880 1772-352212
• MD. SHARIFUL ISLAM, trading as RealBrain, Cumilla, Bangladesh