1. How This Works
Every material change to a Brainpercent legal document is recorded on this page with the date, the document affected, the type of change, and a one-paragraph summary. This is an append-only record — historical entries are never edited or removed.
Material changes (changes to fees, dispute resolution, your core rights, or substantive disclosure obligations) trigger a 30-day advance email notice to all registered users plus a persistent dashboard banner. Non-material changes (clarifications, typographical corrections, new optional features) are effective on posting and recorded here without separate notice.
2. 2026 Changes
Initial publication. Disclosed processor categories with link to /legal/subprocessors. GDPR Art. 13 rights enumerated. SCC reliance for cross-border transfers. Retention table. 72-hour breach notification commitment.
Initial publication. 14-day cooling-off refund window. Service-failure 72h pro-rated refund. AI-output ownership flow-through. Acceptable-use list. Delaware governing law + AAA arbitration with class-action waiver. EU/UK/Swiss/CA/AU consumer carve-outs. 12-month liability cap.
Initial publication of the Brainpercent affiliate program terms. 20% recurring commission, 12-month attribution window, monthly Stripe Connect payouts, $50 minimum, 7-day new-account cooldown.
Initial publication. 14 named subprocessors across payments, infrastructure, AI providers, communications, and analytics.
Initial publication. EU AI Act Art. 4 (AI literacy) and Art. 50 (transparency) compliance. List of AI models used, known limitations, verification guidance, prohibited high-risk uses.
Initial publication. GDPR Art. 28 DPA pre-signed by Brainpercent. Annex 1 (processing details + types of data + sub-processors) + Annex 2 (technical and organizational security measures). SCC reliance for cross-border transfers, 72h breach notification, 90-day post-termination deletion, audit rights.
All v2.0 / v1.0 legal documents promoted to production at https://brainpercent.app. Cookie banner now actively gates Google Analytics and Microsoft Clarity via Consent Mode v2 (Clarity loads only on explicit grant). Age + Terms checkboxes enforced in signup. GDPR Art. 15 self-serve data export shipped (7-day signed URL, JSON archive). Daily breach-detection cron live with Discord webhook alerting.
Server-side product analytics instrumented (analytics_events table, append-only, RLS admin-only). Lifecycle events recorded: signup, signin, first_chat_message, project_created, first_article_generated, first_social_generated, first_publish, purchase_completed, subscription_started, subscription_canceled, credit_purchased. GDPR Art. 17 erasure handled by ON DELETE SET NULL on user_id (events survive as anonymous aggregates).
All legal pages now render localized chrome + body content in 12 non-EN locales (he/ar/ru/es/fr/de/pt/it/zh/ja/ko/hi). Middleware rewrites /{locale}/legal/* + /{locale}/privacy + /{locale}/terms transparently. The amber "English version is authoritative" disclaimer banner shows on every non-EN visit. Per-page hreflang alternates + WebPage/BreadcrumbList JSON-LD added for AI engine indexing.
Full rewrite aligned to Terms of Service v2.0: 14-day cooling-off window, 72-hour service-failure pro-rated refund, and removal of the payment processing fee previously deducted from refunds.
Initial publication. Documents every cookie we set, the consent categories, Google Consent Mode v2 defaults (denied until granted), Microsoft Clarity gating on banner consent, and the footer Cookie Preferences control.
Initial publication. Defines prohibited content and behavior for generated and published content, platform-abuse rules, and enforcement steps.
Initial publication. Public overview of security measures: TLS 1.2+, AES-256 at rest, Postgres Row Level Security, Stripe PCI DSS Level 1, least-privilege access, and 72-hour breach notification.
Initial publication. States our accessibility standards target (WCAG), known limitations, and how to report accessibility barriers.
List expanded from 14 to 27 named vendors (Cloudinary, AWS, HeyGen, Shotstack, Vapi, ElevenLabs, Deepgram, Apollo.io, Telegram, Discord, Upstash, Make.com, WordPress). OpenAI entry corrected: the direct OpenAI API integration was removed in June 2026; OpenAI models are reached only indirectly (Sora video via the GoAPI gateway, voice-assistant LLM via Vapi).
Section 8 (Cookies and Tracking) updated to reflect the live consent system: GA4 loads with Consent Mode defaults set to denied, Clarity loads only after banner consent, a Cookie Preferences control is available in the footer, and the section links to the new Cookie Policy. Non-material clarification: no re-acceptance required.
The signup consent checkbox now includes an explicit age affirmation (13+ US / 16+ EEA-UK), matching the age-screening commitment in Privacy Section 10. The About-page Google signup now also requires the Terms checkbox before continuing.
Initial publication of /legal/report-content: our notice-and-action mechanism under Articles 11 and 12 of the EU Digital Services Act (DSA). A single point of contact for authorities and for recipients of the Service, plus the process for reporting illegal or infringing content.
Acceptable Use Policy updated to explicitly prohibit fake consumer reviews and testimonials, aligned with the US FTC Rule on Consumer Reviews (16 CFR Part 465).
Labeling section rewritten for EU AI Act Article 50 accuracy. It now states plainly what we do today (human-readable AI labels in the dashboard, this transparency page, AI assistants that disclose they are AI), what is in progress with a 2 December 2026 target (C2PA Content Credentials embedded into generated images and videos plus a free verification route; outputs carry no machine-readable marking until then), and your own deployer duties under Article 50(4). Unqualified "we comply with Article 50" claims removed.
Section 7 gains a "Your Transparency Obligations" subsection: users are deployers under EU AI Act Article 50(4) and similar laws, must label AI-generated deepfake content, must disclose AI-generated text published to inform the public on matters of public interest unless it underwent human editorial review, and must follow platform AI-labeling rules. Additive clarification only: Terms remain v2.0, no re-acceptance required.
Terms Section 6 and the matching Refund Policy clause are reversed: purchased Credits no longer expire (previously 12 months from the date of purchase). Unused Credits now stay in your account with no time limit, and balances already bought under the old clause are covered too. Applied across all 13 locales of the Refund Policy. The change expands your rights rather than reducing them, so it is non-material and effective on posting; no re-acceptance is required.
Terms Section 7 gains a "Your Brands, Logos, and Trademarks" subsection (7.2), and the Acceptable Use Policy gains a matching carve-out at 2.1. Both state plainly that generating content featuring a brand you own, or a client brand you are authorized to represent, is the ordinary intended use of the Service. You represent that you own or are authorized to use the marks you supply; we do not verify ownership and have no obligation to; we grant you no rights in marks we do not hold; and passing yourself off as a brand you do not represent stays prohibited. Terms Sections 9, 10, and 15 gain matching clarifications. The change states permissions that were previously unstated and clarifies obligations that Sections 9 and 15 already imposed, so it is non-material and effective on posting; no re-acceptance is required.