Privacy Policy

1. Who we are

Brefi is operated by:

Name

Olov Bengtsson

Organisation number

0403034432

Contact

olovbngt@gmail.com

2. What data we collect

We collect the following personal data when you use the Service:

• Name and email address (provided during account registration)
• Brief content — text and voice transcriptions you submit as daily updates
• Team affiliation and role within your organisation
• Date and time of submissions
• IP address and browser information (collected automatically for security purposes)

3. Why we collect your data and legal basis

We process your personal data on the following legal bases under GDPR:

• Contract performance (Article 6(1)(b)): to provide, operate, and maintain the Service you signed up for, including delivering daily digests and team summaries.
• Explicit consent (Article 6(1)(a)): you provide explicit consent at signup to allow us to retain your brief content indefinitely for the purpose of training and improving Brefi's AI, building organisational memory, and improving the quality of summaries and insights over time. You may withdraw this consent at any time by deleting your account.
• Legitimate interest (Article 6(1)(f)): to ensure the security of the Service and prevent abuse.
• Legal obligation (Article 6(1)(c)): to comply with applicable laws.

4. Consent at signup

Before creating an account, you are required to actively check a consent checkbox confirming that you have read and agree to this Privacy Policy, including the long-term retention of your brief content for AI improvement purposes. This checkbox is not pre-checked. You cannot create an account without providing this consent.

You may withdraw your consent at any time by deleting your account. Upon deletion, your personal data will be permanently removed from our systems within 30 days. Note that withdrawing consent means you will no longer be able to use the Service.

5. How we use your data

Your data is used to:

• Provide and operate the Brefi service
• Transcribe voice briefs using speech-to-text technology
• Generate AI-powered summaries and digests delivered to your team
• Send email digests to team members
• Build and improve organisational memory and AI output quality over time
• Allow administrators to manage team members
• Improve the accuracy and relevance of AI-generated insights

6. Where your data is stored and processed

Your data is stored and processed in the following locations:

• Primary database: Supabase (North EU — Stockholm, Sweden). Your data at rest is stored within the European Union.
• Application hosting: Vercel. Server-side functions are processed in Washington D.C., USA. Static assets are served via a global CDN.
• AI summarisation: Anthropic PBC (USA). Brief content is sent to Anthropic's API for summarisation and digest generation.
• Voice transcription: OpenAI (USA). Voice briefs are sent to OpenAI's Whisper API for speech-to-text transcription.
• Email delivery: Resend Inc. (USA). Email digests are delivered via Resend's email infrastructure.

For data transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions as required by GDPR Chapter V.

7. How long we keep your data

We retain your data as follows:

• Brief content (text and voice transcriptions): retained indefinitely for the purpose of building organisational memory and improving AI output quality, subject to your consent. You may request deletion at any time by deleting your account.
• Account data (name, email, role): retained for as long as your account is active.
• Upon account deletion: all personal data, including all brief content, is permanently deleted within 30 days.

8. Your rights under GDPR

As a data subject, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can request correction of inaccurate data.
• Right to erasure: you can request deletion of your personal data at any time by deleting your account within the application.
• Right to restriction: you can request that we limit how we process your data.
• Right to data portability: you can request your data in a structured, machine-readable format.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: you may withdraw your consent to long-term data retention at any time by deleting your account.

To exercise any of these rights, contact us at olovbngt@gmail.com. We will respond within 30 days.

9. Data deletion and export

You can delete your account and all associated data directly within the Brefi application. Upon deletion, all your briefs, voice transcriptions, profile data, and team associations are permanently removed from our systems within 30 days. You can also request an export of your data by emailing olovbngt@gmail.com.

10. Cookies and tracking

Brefi uses only strictly necessary cookies required for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics without your explicit consent.

11. Data security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), row-level security in our database, and restricted access to production systems.

12. Data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with GDPR Articles 33 and 34.

13. Third-party processors

We share your data with the following third-party processors, all bound by data processing agreements:

• Supabase Inc. — database storage (EU region)
• Vercel Inc. — application hosting and deployment
• Anthropic PBC — AI processing for brief summarisation
• OpenAI LLC — voice transcription (Whisper API)
• Resend Inc. — email delivery service

14. Children's privacy

Brefi is intended for adults and professional teams. We do not knowingly collect personal data from individuals under the age of 16. If you become aware that a child has provided us with personal data, please contact us immediately.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice within the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

16. Contact and supervisory authority

For questions or concerns about this Privacy Policy or your personal data, contact us at:

Email

olovbngt@gmail.com

You also have the right to lodge a complaint with the Swedish supervisory authority:

Authority

Integritetsskyddsmyndigheten (IMY)

Website

www.imy.se

Phone

+46 8 657 61 00