Last updated: 16 September 2026
This Privacy Policy applies to the following software applications and related websites in the Deepstash Ecosystem:
Deepstash SRL (Operational and Technical Controller)
47 Vespasian Street, Room 3, District 1, 010922, Bucharest, Romania
Contact Email: [email protected]
Brainstash, Inc. (Parent Company, Global Distributor & Billing Controller)
69 Omega Dr, Suite 230, Newark, DE 19713, USA
This Privacy Policy explains how Deepstash SRL and its parent company, Brainstash Inc. (collectively, "we," "us," or "our"), collect, use, and protect your information when you interact with any part of the Deepstash Ecosystem, which includes our software applications Deepstash, Paladin: Learn History, Empirio: Learn Business, Dilemmo: Make Better Decision, and Protocol: Health & Longevity, as well as the related websites.
We understand your concerns about privacy and we want you to understand what types of information we collect and what may happen to that information if you install any application or visit any website from the Deepstash Ecosystem.
Because our ecosystem offers a variety of specialized learning experiences, we use a layered Privacy Policy:
We endeavor to respect all data processing principles provided by EU Regulation no. 679/2016 (“GDPR”), which require that personal data are:
If you have specific questions about your privacy, you can reach our Data Protection team at [email protected].
You are not required to create a user account or provide any personal information in order to visit the websites from the Deepstash Ecosystem. You are required to create a user account, however, to use any of the applications. During registration, you are required to provide a name, password and valid email address.
If you choose to upgrade to a premium subscription (such as a "Pro" tier or a Deepstash Ecosystem "Bundle"), we collect necessary billing and purchase information. For web-based transactions and non-EU sales, this process is managed by Brainstash Inc. Your payments are processed securely by authorized third-party gateways (such as Apple, Google, Stripe, or Paddle). We do not store your full credit card details on our servers; we only retain limited transaction records (such as your subscription status and purchase history) to manage your account and comply with legal tax obligations.
If you choose to upload a profile photo or a custom image to your profile in any of the Deepstash Ecosystem applications, we will ask you to give us access to your phone photos in order to be able to upload your avatar and/or images. In keeping with the data minimization principle, we only access, collect, and process the specific images you select to upload.
We collect information if you contact us for support or help, submit an application or otherwise communicate with us. The information which you supply to us enables us to customize and enhance the services we provide to you. If you explicitly opt-in to our mailing list, we will also use your email to send you news, promotions, and updates and communicate with you about our new products.
To ensure our applications function correctly and to understand how users interact with our Deepstash Ecosystem, we automatically collect certain technical data. This includes your device type, browser type, time zone, language settings, and basic analytics regarding your usage patterns within the app.
To provide the personalized, interactive experiences central to the Deepstash Ecosystem, we use automated algorithms to analyze your User Inputs (as this term is defined in the ToS) and interaction data. For example, we use this data to generate "Psychometric Profiles" in Dilemmo, "Business Intuition Scores" in Empirio, and personalized habit or health insights in Protocol. Under the GDPR, evaluating personal aspects to predict preferences or behavior is considered "profiling." Please be assured that this automated processing is designed strictly to enhance your personal learning and entertainment experience. We do not engage in any automated decision-making or profiling that produces legal effects or similarly significantly affects you.
As such, we may process your personal data as a visitor or a user, for the following reasons and in consideration of the following legal bases provided by the GDPR:
Cookies and other technologies make our Deepstash Ecosystem technologies easier to use and help us customize and personalize the services we provide based on your interests and activities. Therefore, to ensure the Deepstash Ecosystem functions properly and to provide you with the best possible experience, we use cookies and similar tracking technologies. We categorize these into two main types:
Our applications are designed to work together to enhance your learning experience.
To run the Deepstash Ecosystem globally, we rely on a few trusted partners. We do not sell your personal data. We only share information as detailed in the paragraphs below.
We work with trusted third-party companies that help us provide, support, and improve our services. For example, we use a third-party payment processor to securely handle paid subscriptions, and analytics providers to help us understand app performance. These partners are legally bound by strict data processing agreements; they can only use your data based on our explicit instructions and cannot use it for their own independent purposes.
In the event that we or certain of our assets are acquired, user information may be included among the transferred assets.
Although we strive to protect the personal information of our users, we will release personal information if required by law or in the good-faith belief that such action is necessary. We follow the law whenever we receive requests about you from a government or related to a lawsuit. We will notify you when we are asked to hand over your personal data in this way unless we are legally prohibited from doing so. When we receive requests like this, we will only release your personal data if we have a good faith belief that disclosure is necessary or appropriate under applicable law. Nothing in this policy is intended to limit any legal defenses or objections that you may have to a third party's request to disclose your information.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected.
Notwithstanding our standard retention and deletion periods, we reserve the right to securely retain specific personal data if doing so is strictly necessary to comply with a legal obligation, to establish, exercise, or defend against legal claims, or to protect the vital interests of you or another person.
The Deepstash Ecosystem is operated globally. Because Deepstash SRL is headquartered in the European Union (Romania) and our parent company, Brainstash Inc., is located in the United States, your personal data will be transferred to, and processed in, the US and other countries.
To ensure your data receives a level of protection consistent with the GDPR when it leaves the European Economic Area (EEA), we have implemented strict legal safeguards. Specifically, Deepstash SRL and Brainstash Inc. have executed Standard Contractual Clauses (SCCs) approved by the European Commission, legally binding both entities to uphold European data protection standards.
We have agreements with third parties and have adopted other security measures in place to protect against the loss, misuse and/or unauthorized alteration of the information under our control or under the control of our service providers. Your personal data is protected by utilizing both online and offline security methods, including:
While we strive to use commercially acceptable, industry-standard means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.
In the event of a security breach involving your personal information that we determine is likely to result in high risk to your rights and freedoms, we will notify you and the competent data protection authorities in the most expedient time possible and without undue delay, consistent with the legitimate interests of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
We believe that you should have full control over your personal data, regardless of where you live. In accordance with the GDPR and other applicable privacy laws, you have the following rights regarding your information:
To exercise any of the rights listed above (other than automated account deletion), please contact us at [email protected]. For your security, we may need to verify your identity before fulfilling your request. We will respond to all legitimate requests without undue delay and within 30 days.
If you believe we have violated your privacy rights, we encourage you to contact us first so we can resolve the issue. However, you always have the right to lodge a complaint with your local data protection authority. For our lead regulator in Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
The Deepstash Ecosystem contains general audience content that is safe and free from hazardous or violent material. However, our services are not directed at, nor do we knowingly collect personal data from, children under the age of 13 (or a higher age if required by the applicable laws of your country of residence, such as 16 in certain EU Member States).
If we discover that a child under the minimum age of digital consent has created an account and provided us with personal data without verifiable parental consent, we will take immediate steps to purge that information from our databases and delete the account.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] so we can take the necessary actions.
Identity theft and the practice currently known as "phishing" are of great concern to us. Safeguarding your data is a top priority for us. We do not and will not, at any time, request your username, password, credit card information or national identification number in an unsolicited e-mail or telephone communication. If you ever receive a suspicious email claiming to be from Deepstash asking for this information, please do not respond and report it to us immediately at [email protected].
We may update this Privacy Policy from time to time to reflect changes in our technology, legal requirements, or business operations:
Your continued use of the Deepstash Ecosystem after any changes indicates your acknowledgment of the updated Privacy Policy. If you do not agree with the changes, you have the right to delete your account and exercise your data protection rights as outlined in Section 9.
The terms in this annex apply exclusively to your use of our Paladin: Learn History application and related website found at https://learnpaladin.com/.
Paladin is designed to provide a structured, continuous educational environment. To deliver this experience, we collect specific behavioral and interaction data while you use the app. This includes:
We process this specific interaction data to perform our contract with you (allowing you to seamlessly "pick up where you left off" across different devices) and under our Legitimate Interest to understand which historical topics are most engaging so we can improve our content curation and educational programming. This data is securely stored and retained in accordance with Sections 6 and 8 of the Privacy Policy.
As part of the Deepstash Ecosystem, your historical interests and completed topics within Paladin may be used to personalize your experience in our other applications (for example, suggesting history-related articles to you when you log into the Deepstash app). This cross-app processing is conducted under our Legitimate Interests and is subject to the strict data retention limits and safeguards detailed in Sections 4 and 6 of the Privacy Policy.
