Privacy Policy
Last updated: October 2026
Ai-mBrain and mBrain Agency are trading names of HM Optimisation OÜ, registered in Estonia (registration number 14811819, VAT EE102194380).
This policy explains what personal data we collect through ai-mbrain.net and agency.ai-mbrain.com, why we collect it, and what we do with it. We have kept it short and plain.
Who we are
HM Optimisation OÜ is a private limited company registered in Estonia. It is the controller of the personal data described in this policy.
Registry code: 14811819
VAT number: EE102194380
Registered address: Sepapaja tn 6, Tallinn, 15551, Estonia
Contact: legal@hmoptimization.com
We provide marketing services to businesses under the name mBrain Agency. Our services are for businesses. We do not offer them to private consumers.
What this policy covers
This policy covers:
— ai-mbrain.net, our website
— agency.ai-mbrain.com, where the discovery chat, the impact report and the marketing plan are provided
— emails, calls and messages between you and us about mBrain Agency
Our Terms & Conditions describe how we handle the data that clients provide while using our services.
What data we collect and why
VISITING THE WEBSITE
When you visit ai-mbrain.net, our hosting provider processes technical data such as your IP address, browser type and device type. This is needed to deliver the pages and to keep the site secure. The home page includes a video hosted by Vimeo. Our Cookie Policy explains how cookies are used.
WEBSITE ANALYTICS
We use Google Analytics and the statistics built into our website platform to understand how visitors use ai-mbrain.net. These tools record page visits, device type and general location, and use cookies to recognise a returning visitor. Our Cookie Policy lists these cookies.
DISCOVERY CHAT
When you use the discovery chat, we collect the information you enter. This includes your business name, your website address, your answers about your business, and your email address. The discovery chat is an automated assistant. We use what you enter to prepare your impact report and your marketing plan.
IMPACT REPORT, MARKETING PLAN AND YOUR ACCOUNT
To open your report you create an account. You do this with a login link sent to your email address, or with your Google account. If you sign in with Google, we receive basic profile details from Google, such as your name and email address. The report and the plan are generated automatically from your answers and from publicly available information about your business. We send you emails about your report, including the login link.
ENQUIRIES, CALLS AND MESSAGES
When you contact us, book a call or speak with us, we collect your name, business name, email address, phone number and what you tell us. We use this to respond, to prepare for the call and to follow up.
IF WE CONTACTED YOU FIRST
We contact businesses that we believe could benefit from our services. We find business contact details in publicly available sources, such as business websites, public registers and business listings, and in business contact databases. If you ask us to stop, we stop. We then keep only what is needed to make sure we do not contact you again.
CLIENTS AND PAYMENTS
When you become a client, we collect the details needed to provide the service and to invoice you: business name, business address, contact person, and VAT number where you have one. Payments are handled by our payment processor, Stripe. We do not receive your full card number.
Legal basis for processing
We process personal data on the following bases under the GDPR and the UK GDPR:
— Legitimate interest — to respond to business enquiries, to prepare the reports you ask for, to contact businesses about our services, and to keep our systems secure
— Contract — to deliver a service you have engaged us for, and to take the steps you ask for before that
— Consent — for non-essential cookies, where you have agreed
— Legal obligation — to keep accounting records
Who we share data with
We do not sell your data to any third party. We share it only with providers that help us run mBrain Agency:
— Service delivery and sales partners — they operate the discovery chat, the reports and the client area, and may speak with you on our behalf
— Website hosting provider — to deliver ai-mbrain.net
— Email delivery provider — to send report and account emails
— Stripe — payment processing
— Vimeo — video hosting on our website
— Google — only if you choose to sign in with your Google account
— Google Analytics — website analytics
— Telephone and messaging providers — for calls and text messages
Each of these providers processes the data for the purpose described and has its own privacy policy and data processing terms.
Where your data is processed
Some of these providers operate in the United States and in other countries outside the European Union and the United Kingdom. Your data may be stored and processed there.
How long we keep your data
We keep enquiry, chat and contact data for as long as it is relevant to our business relationship. If you ask us to delete your data we will do so within 30 days, subject to any legal obligation to retain records. Accounting records are kept for as long as the law requires.
Your rights
Under the GDPR and the UK GDPR you have the right to access, correct, or delete your personal data. You also have the right to object to processing or to request that we restrict it. Where we rely on your consent, you can withdraw it at any time. To exercise any of these rights, contact us at legal@hmoptimization.com.
If you believe we have handled your data incorrectly, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with the supervisory authority in your country of residence. In the United Kingdom this is the Information Commissioner's Office.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last revised. Continued use of the site after an update constitutes acceptance of the revised policy.