Privacy policy
This policy explains what personal data we process in Briefella (briefella.com and app.briefella.com), why, who we share it with, and what rights you have.
1. Data controller
The controller is […], […], tax ID […]. Contact for data protection matters: […].
Content that a team enters into Briefella (for example briefs, drafts, sources, or data about an agency's clients) is processed on behalf of that team. For this content the company that created the team is the controller and we act as a processor. We sign a data processing agreement on request.
2. What data we process
- Account: name, email address, password (hashed only), language settings, two-factor authentication data.
- Sign-in with Google or Microsoft: the provider's account ID, email address and name. We never receive your password.
- Team and content: team name, members and roles, sites, page inventory, briefs, draft versions, sources, claims, quality check results, exports and the archive.
- Payments: plan, payment history and invoice details. We do not store card or bank account data; the payment operator handles it.
- Technical data: IP address, browser type, sign-in times and an audit log needed for security.
- Integrations: AI provider API keys added by the team and Google Drive access tokens, stored encrypted.
3. Purposes and legal bases
- Providing the service, running accounts and teams, handling payments: performance of a contract (Art. 6(1)(b) GDPR).
- Billing and accounting: legal obligation (Art. 6(1)(c) GDPR).
- Security, abuse prevention, audit log, defending claims: legitimate interest (Art. 6(1)(f) GDPR).
- Service messages (for example team invitations and account notices): performance of a contract. We do not send marketing without your consent.
4. Who we share data with
We use providers that process data on our behalf and only as needed to run the service:
- SEOHOST (Poland): server and database hosting.
- Cloudflare: content delivery, attack protection and Turnstile verification on forms.
- PayPro S.A. (Przelewy24): payment processing.
- Google and Microsoft: sign-in if you choose it; Google also for Google Drive export if you connect it.
- Anthropic and OpenAI: only when a team member runs an AI recipe on Briefella's keys or the team's own key. We then send only that recipe and the data the user put into it.
- The email provider we use to send service messages.
Some providers may process data outside the European Economic Area. In those cases we rely on a European Commission adequacy decision (for example the EU-US Data Privacy Framework) or standard contractual clauses.
We do not sell data and do not share it with advertisers.
5. Data from Google (Google Drive and sign-in)
When a team connects Google Drive, Briefella requests only the drive.file permission. It lets Briefella create files that Briefella itself saves to Drive (drafts as Google Docs and ZIP export packages) and manage only those files. Briefella cannot see any other files in your Drive.
We also read the Google account email address to show which account is connected. Access tokens are stored encrypted and used only to upload files when a user asks for it. You can disconnect at any time in Briefella or in your Google account settings.
Briefella's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google for advertising, do not sell it, do not use it to train AI models, and humans do not read it unless you give consent, or it is needed for security or required by law.
6. How long we keep data
- Account data: until the account is deleted.
- Team content and archive: until the team owner deletes the team. The archive is permanent by design because it documents the company's work.
- Audit log and technical data: up to 24 months.
- Billing records: as long as tax law requires (usually 5 years).
7. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. Write to […]. You can also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or the authority in your country.
8. Cookies
We use only cookies that are necessary for the service: the sign-in session, form protection (CSRF) and your language choice. Sign-in and sign-up forms are protected by Cloudflare Turnstile. We use no advertising or analytics cookies.
9. Security
Team data is isolated from other teams. Files, API keys and tokens are stored encrypted, connections use HTTPS, and important actions are recorded in an immutable audit log. The administration panel requires two-factor authentication.
10. Changes
We will announce material changes in the service or by email. The current version is always available at https://app.briefella.com/privacy.