Skip to content

Privacy Policy

As of: October 2026

1. General Information and Controller

The protection of your personal data is important to us. This privacy policy informs you about the processing of your data on our website in accordance with GDPR, the Bulgarian Personal Data Protection Act (ZZLD), and the EU AI Act.

Controller:

HyBrayn Ltd. ("ХайБрейн" ООД)

Vladislav Varnenchik Bvld. 112, 5th Floor, 9000 Varna, Bulgaria

Represented by the Managing Directors:

Alexander Vallon

Jonas Lachowitzer

Email: [email protected]

2. Hosting & CDN (Cloudflare)

Our website is delivered via Cloudflare, Inc. (USA) to ensure security, availability, and performance.

  • Purpose: DDoS protection, load balancing, and secure content delivery (CDN).
  • Data Processed: IP address, timestamp, browser configuration, pages accessed.
  • Legal Basis: Art. 6(1)(f) GDPR (Legitimate interest in cybersecurity and site availability).
  • Data Transfer: Cloudflare is certified under the EU-US Data Privacy Framework (DPF).

3. Data Collection on this Website

3.1 Server Log Files

The hosting provider automatically collects and stores information in server log files that your browser transmits automatically:

  • Browser type and version
  • Operating system used
  • Referrer URL (previously visited page)
  • IP address of the accessing device (anonymized)

Legal Basis: Art. 6(1)(f) GDPR (Legitimate interest in the technical provision of the website).

Retention period: Log files are automatically deleted after 14 days.

3.2 Contact (Email / Phone)

When you contact us by email or phone, we process the data you provide (e.g., name, email address, phone number, message content) to handle your inquiry. There is no contact form on this website. Messages in the chat (Section 5) do not reach us; for contact, the chat refers you to appointment booking, email and phone.

Legal Basis: Art. 6(1)(b) GDPR (Pre-contractual measures) or Art. 6(1)(f) GDPR (Legitimate interest in responding to inquiries).

4. Google Analytics 4

We use Google Analytics 4 (GA4) to analyze website usage. Google Analytics is only loaded in your browser after you have given explicit consent via our cookie banner.

Google Consent Mode v2: We use Google Consent Mode v2 to ensure that no analytics data is collected or cookies are set before you give consent. By default, all analytics storage is denied. Only after your explicit opt-in does GA4 begin collecting anonymized usage data.

Cookies: The service uses cookies (text files) and Client-IDs to recognize returning visitors and analyze sessions. GA4 automatically anonymizes IP addresses.

Legal Basis: Art. 6(1)(a) GDPR (Consent). Google Analytics is only activated if you have explicitly agreed via the Cookie Banner.

Data Recipient: Google Ireland Ltd. / Google LLC (USA).

Data Transfer: Google is certified under the EU-US Data Privacy Framework (DPF).

5. AI Chatbot (Google Gemini)

An AI chat is available on our website. It is a demo of our service bot: it answers questions about HyBrayn and, for a conversation with a human, refers you to appointment booking, email and phone. It is set up not to ask for your name, email address, phone number or company details. Responses are generated by Google's Gemini 2.5 Flash language model via the Gemini API.

We do not store conversation content on our servers, and it does not reach our team. We ourselves only count anonymously how often the chat was opened, a message was answered, or a handover to a human was shown (daily totals without personal reference). If you have consented to analytics, these events are additionally sent to Google Analytics, without conversation content (Section 4).

⚖️ Transparency Notice pursuant to EU AI Act

Please be aware that you are interacting with an automated Artificial Intelligence system. Responses are machine-generated and may be inaccurate or incomplete. For binding information, please contact our team directly.

Data Usage: Your message and the previous conversation are sent to Google (Gemini API) so that the answer can be generated. HyBrayn uses the paid Gemini API; under its terms, Google does not use the inputs and answers to improve its products and processes them as a processor under Google's data processing terms. Google processes technical usage data under its own terms.

Recipients:

  • Google (Gemini API): with every request, your message and the previous conversation are transmitted to Google so that the model can respond. Processing outside the EU, in particular in the USA, cannot be ruled out.
  • Cloudflare, Inc. (USA): when you open the chat, Cloudflare Turnstile loads, a protection against automated requests. When the script loads from challenges.cloudflare.com, your browser already transmits your IP address and browser data to Cloudflare. For verification, we additionally transmit the Turnstile token and your IP address to Cloudflare. To limit the number of requests per hour, we store a cryptographic hash of your IP address in Cloudflare Workers KV; the anonymous daily counters are stored there as well.

Storage: We do not store the conversation history on our servers. In your browser, it is kept in session storage (sessionStorage) so that it survives a page reload; it is deleted when you close the tab. For the transmission to Google, see “Recipients”. The hash of your IP address is deleted automatically no later than one hour after your last request, the anonymous daily counters after 400 days.

Legal Basis:

  • General Queries: Art. 6(1)(f) GDPR (Legitimate Interest).
  • Protection against misuse (Turnstile, request limit): Art. 6(1)(f) GDPR (Legitimate interest in the security of the service).

6. Appointment Scheduling (Cal.com)

We use Cal.com for scheduling discovery calls.

  • Provider: Cal.com, Inc. (USA). The booking button opens the booking page directly on Cal.com in a new tab; you enter your details there.
  • Data Collected: Name, email address, phone number, meeting details.
  • Legal Basis: Art. 6(1)(b) GDPR (Performance of steps prior to entering into a contract).

The Cal.com booking calendar can be embedded on the contact page. It only loads once you click “Load calendar”; data is then transferred to Cal.com.

7. Your Rights

Under the GDPR, you have the following rights:

  • Right of access to your stored data (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)

You may withdraw your consent for Analytics at any time via the Cookie Settings on our website.

Supervisory Authority: Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — www.cpdp.bg

8. Funding Check (Initial Funding Assessment)

The Funding Check is currently not available on our website. The following information continues to apply to all data submitted through it.

Via our Funding Check, you can request a non-binding initial assessment of matching funding programs. To do so, you answer a few questions (e.g., on federal state, project, and company size) and provide your email address, to which we send the result. Providing a company name and phone number is optional.

Purposes and legal bases:

  • Creating the initial funding assessment and sending the result by email — legal basis Art. 6(1)(b) GDPR (transactional service requested by you).
  • Only with separate, voluntary consent: typically monthly information about matching funding programs and HyBrayn services by email — legal basis Art. 6(1)(a) GDPR (consent). You can withdraw this consent at any time with effect for the future, via the one-click link in every email or informally to [email protected].

Data collected:

Email address (mandatory), company and phone number (optional), your questionnaire answers, and technical metadata (timestamp, any campaign/UTM parameters, and the page accessed).

Recipients / Processors:

  • Cloudflare, Inc. (USA) — bot protection (Cloudflare Turnstile), secure delivery, and storage on Cloudflare Workers KV: if the evaluation service is temporarily unavailable, your request is buffered as a failover for up to 24 hours so it is not lost; the consent proof log (peppered ipHash/emailHash) is stored for up to 3 years. Certified under the EU-US Data Privacy Framework (DPF).
  • Supabase (data stored in the European Union) — storage of your request as a lead record.
  • Google Ireland Ltd. / Google LLC (Google Workspace / Gmail) — sending the result email and any follow-up emails. Certified under the EU-US Data Privacy Framework (DPF).
  • Cal.com — only if you subsequently book an appointment (see Section 6).
  • Telegram (Telegram FZ-LLC) — internal instant notification of our sales team for particularly relevant (high-scored) inquiries; this may transmit your email address, where applicable your company name, the matched funding programme, and the lead score (incl. tier). A transfer to a third country outside the EU/EEA cannot be ruled out. Legal basis Art. 6(1)(f) GDPR (legitimate interest in timely processing).

⚖️ Profiling notice

From your answers we automatically calculate a lead score (0–100) to prioritize inquiries (profiling within the meaning of Art. 4(4) GDPR). No solely automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

Pseudonymization: To document your consent (Art. 7(1) GDPR), we store your IP address and email address in the proof log exclusively as a peppered SHA-256 hash (ipHash/emailHash), never in clear text.

Retention period:

  • Lead data: until the above purpose is fulfilled or until your withdrawal or erasure request; thereafter your data is deleted.
  • Proof log (audit log): up to 3 years, then automatically deleted.

Withdrawal and further rights: You can withdraw consent given at any time with effect for the future — via the one-click link in every email or informally to [email protected]. The data-subject rights listed in Section 7 also apply.

← Back to Home