Skip to content

Privacy Policy

As of: May 2026

1. General Information and Controller

The protection of your personal data is important to us. This privacy policy informs you about the processing of your data on our website in accordance with GDPR, the Bulgarian Personal Data Protection Act (ZZLD), and the EU AI Act.

Controller:

HyBrayn Ltd. ("ХайБрейн" ООД)

Vladislav Varnenchik Bvld. 112, 5th Floor, 9000 Varna, Bulgaria

Represented by the Managing Directors:

Alexander Vallon

Jonas Lachowitzer

Email: [email protected]

2. Hosting & CDN (Cloudflare)

Our website is delivered via Cloudflare, Inc. (USA) to ensure security, availability, and performance.

  • Purpose: DDoS protection, load balancing, and secure content delivery (CDN).
  • Data Processed: IP address, timestamp, browser configuration, pages accessed.
  • Legal Basis: Art. 6(1)(f) GDPR (Legitimate interest in cybersecurity and site availability).
  • Data Transfer: Cloudflare is certified under the EU-US Data Privacy Framework (DPF).

3. Data Collection on this Website

3.1 Server Log Files

The hosting provider automatically collects and stores information in server log files that your browser transmits automatically:

  • Browser type and version
  • Operating system used
  • Referrer URL (previously visited page)
  • IP address of the accessing device (anonymized)

Legal Basis: Art. 6(1)(f) GDPR (Legitimate interest in the technical provision of the website).

Retention period: Log files are automatically deleted after 14 days.

3.2 Contact (Email / Chatbot)

When you contact us via email or the AI chatbot, the data you provide (e.g., name, email address, message content) is stored for the purpose of processing your inquiry.

Legal Basis: Art. 6(1)(b) GDPR (Pre-contractual measures) or Art. 6(1)(f) GDPR (Legitimate interest in responding to inquiries).

4. Google Analytics 4

We use Google Analytics 4 (GA4) to analyze website usage. Google Analytics is only loaded in your browser after you have given explicit consent via our cookie banner.

Google Consent Mode v2: We use Google Consent Mode v2 to ensure that no analytics data is collected or cookies are set before you give consent. By default, all analytics storage is denied. Only after your explicit opt-in does GA4 begin collecting anonymized usage data.

Cookies: The service uses cookies (text files) and Client-IDs to recognize returning visitors and analyze sessions. GA4 automatically anonymizes IP addresses.

Legal Basis: Art. 6(1)(a) GDPR (Consent). Google Analytics is only activated if you have explicitly agreed via the Cookie Banner.

Data Recipient: Google Ireland Ltd. / Google LLC (USA).

Data Transfer: Google is certified under the EU-US Data Privacy Framework (DPF).

5. AI Chatbot (Google Gemini)

Our website features AI agents ("Discovery Bot", "Site Guide") powered by Google Gemini (Enterprise API).

⚖️ Transparency Notice pursuant to EU AI Act

Please be aware that you are interacting with an automated Artificial Intelligence system. Responses are machine-generated and may be inaccurate or incomplete. For binding information, please contact our team directly.

Data Usage: We have contractually ensured that your inputs (prompts) are NOT used to train Google's AI models. Your data remains confidential.

Storage: Chat logs are retained for 30 days for quality assurance and then deleted.

Legal Basis:

  • General Queries: Art. 6(1)(f) GDPR (Legitimate Interest).
  • Lead Qualification: Art. 6(1)(b) GDPR (Pre-contractual measures).

6. Appointment Scheduling (Cal.com)

We use Cal.com for scheduling discovery calls.

  • Data Collected: Name, email address, phone number, meeting details.
  • Legal Basis: Art. 6(1)(b) GDPR (Performance of steps prior to entering into a contract).

7. Your Rights

Under the GDPR, you have the following rights:

  • Right of access to your stored data (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)

You may withdraw your consent for Analytics at any time via the Cookie Settings on our website.

Supervisory Authority: Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — www.cpdp.bg

8. Funding Check (Initial Funding Assessment)

Via our Funding Check, you can request a non-binding initial assessment of matching funding programs. To do so, you answer a few questions (e.g., on federal state, project, and company size) and provide your email address, to which we send the result. Providing a company name and phone number is optional.

Purposes and legal bases:

  • Creating the initial funding assessment and sending the result by email — legal basis Art. 6(1)(b) GDPR (transactional service requested by you).
  • Only with separate, voluntary consent: typically monthly information about matching funding programs and HyBrayn services by email — legal basis Art. 6(1)(a) GDPR (consent). You can withdraw this consent at any time with effect for the future, via the one-click link in every email or informally to [email protected].

Data collected:

Email address (mandatory), company and phone number (optional), your questionnaire answers, and technical metadata (timestamp, any campaign/UTM parameters, and the page accessed).

Recipients / Processors:

  • Cloudflare, Inc. (USA) — bot protection (Cloudflare Turnstile), secure delivery, and storage on Cloudflare Workers KV: if the evaluation service is temporarily unavailable, your request is buffered as a failover for up to 24 hours so it is not lost; the consent proof log (peppered ipHash/emailHash) is stored for up to 3 years. Certified under the EU-US Data Privacy Framework (DPF).
  • Supabase (data stored in the European Union) — storage of your request as a lead record.
  • Google Ireland Ltd. / Google LLC (Google Workspace / Gmail) — sending the result email and any follow-up emails. Certified under the EU-US Data Privacy Framework (DPF).
  • Cal.com — only if you subsequently book an appointment (see Section 6).
  • Telegram (Telegram FZ-LLC) — internal instant notification of our sales team for particularly relevant (high-scored) inquiries; this may transmit your email address, where applicable your company name, the matched funding programme, and the lead score (incl. tier). A transfer to a third country outside the EU/EEA cannot be ruled out. Legal basis Art. 6(1)(f) GDPR (legitimate interest in timely processing).

⚖️ Profiling notice

From your answers we automatically calculate a lead score (0–100) to prioritize inquiries (profiling within the meaning of Art. 4(4) GDPR). No solely automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

Pseudonymization: To document your consent (Art. 7(1) GDPR), we store your IP address and email address in the proof log exclusively as a peppered SHA-256 hash (ipHash/emailHash), never in clear text.

Retention period:

  • Lead data: until the above purpose is fulfilled or until your withdrawal or erasure request; thereafter your data is deleted.
  • Proof log (audit log): up to 3 years, then automatically deleted.

Withdrawal and further rights: You can withdraw consent given at any time with effect for the future — via the one-click link in every email or informally to [email protected]. The data-subject rights listed in Section 7 also apply.

← Back to Home