Privacy Policy
Last updated: September 2026
1. Data Controller
BriefBot / Gabriel Marchesan Almeida / c/o Postflex PFX-690-554, Emsdettener Str. 10, 48268 Greven, Germany / Email: contact@brief-bot.app
2. Data We Collect
| Data Category | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Name, email address | Account creation and sign-in via Google or Sign in with Apple (iOS app) | §1(b) — Contract performance |
| Letter content (text/PDF) | AI analysis | §1(b) — Contract performance |
| Analysis history | Stored results for your reference | §1(b) — Contract performance |
| Consent records + audit log | GDPR compliance documentation | §1(c) — Legal obligation |
| Session tokens | Authentication | §1(b) — Contract performance |
| Contact form messages | Customer support | §1(b) — Contract performance |
| Analytics data (optional) | Product improvement | §1(a) — Consent (device storage: §25(1) TDDDG) |
| PDF documents (uploaded or camera-generated) | Document Vault — secure storage of original letters | §1(b) — Contract performance |
3. Data Retention
- Letter analyses: automatically deleted after 90 days
- Account data: retained while your account is active
- After account deletion: personal data anonymized within 30 days; analysis rows retained (anonymized) for 180 days for legal compliance
- Consent logs: retained for 3 years (legal obligation)
- Session tokens: deleted after 30 days
- Contact form messages: deleted after responding (max 90 days)
- PDF documents (Document Vault): stored compressed in our database (Neon, AWS data centre in Frankfurt, Germany); deleted automatically after 90 days together with the analysis, when you delete the analysis, or when the account is deleted
4. Sub-Processors
We use the following service providers. Providers that process personal data on our behalf do so under a data processing agreement (Art. 28 GDPR). Google and Apple only receive data if you choose to sign in with them.
| Service | Purpose | Location | Privacy |
|---|---|---|---|
Mistral AIAI provider | AI analysis of your letters (text and images) | France (EU)EU | |
Vercel | Hosting of the website and backend (servers, edge network) | USA (Vercel Inc.) — global edge networkThird country | |
Neon (PostgreSQL) | Database (account data, analyses, history, original letter PDFs) | USA (Neon Inc.); database hosted on AWS eu-central-1 (Frankfurt, Germany)Third country | |
Stripe | Web payments and subscription management | USAThird country | |
RevenueCat | Management of in-app subscriptions (App Store / Google Play) in the mobile app | USAThird country | |
Resend | Transactional emails (e.g. reminders, account emails) | USAThird country | |
Sentry | Error and crash monitoring (technical diagnostic data) | USA (Functional Software Inc.); data stored in Sentry's EU region (Germany)Third country | |
Google | Sign in with Google (OAuth) — only if you choose it | USAThird country | |
Apple | Sign in with Apple (iOS app) — only if you choose it | USAThird country |
International data transfers: Mistral AI (France) processes data within the EU. Vercel, Neon, Stripe, RevenueCat, Resend, Sentry, Google and Apple are companies based in the USA, so personal data may be transferred to or accessed from the USA even where it is stored in the EU. Where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR); otherwise it is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
5. Your Rights (GDPR Art. 12–23)
- Art. 15 — Access: Export your data via Account > Privacy > Export Data
- Art. 16 — Rectification: Contact us to correct your data
- Art. 17 — Erasure: Delete your account via Account > Privacy > Delete Account
- Art. 18 — Restriction: Contact us to restrict processing
- Art. 20 — Portability: Export your data in machine-readable format
- Art. 7(3) — Withdrawal of consent: Withdraw your analytics consent at any time in your account settings (Privacy) or via the cookie settings; this does not affect the lawfulness of processing before the withdrawal
- Art. 77 — Complaint: Lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), which is responsible for us, or the authority at your place of residence.
To exercise your rights, contact: contact@brief-bot.app. We respond within 30 days (GDPR Art. 12).
6. Cookies
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| __Secure-authjs.session-token | Essential | Authentication session | 30 days |
| briefbot-cookie-consent | Essential | Records your cookie preferences | 1 year |
| Analytics cookies | Optional (consent) | Usage analytics — not set by default; only after you actively consent (§25(1) TDDDG) | 90 days |
Manage your preferences via the cookie banner or Cookie Settings. Cookie Settings.
7. Contact
Privacy inquiries: contact@brief-bot.app / Legal inquiries: contact@brief-bot.app
We do not currently have a designated Data Protection Officer (DPO) as we do not meet the thresholds of GDPR Art. 37. For DPO-related matters, contact the email above.
8. Changes to This Policy
We may update this policy. Material changes will be communicated via email or an in-app notice at least 14 days before taking effect.
9. Behavioural Analytics
Behavioural analytics is optional and switched off by default. Only if you actively opt in does BriefBot collect pseudonymised data about how you use the application. This includes:
- Pages visited and time spent on each page
- Features used (e.g. camera scanner, chat, reminders, glossary)
- Buttons clicked and actions performed
- Session duration and frequency of use
- Upload types selected (text, PDF, image, camera)
Legal basis: your consent (Art. 6(1)(a) GDPR); any storage of or access to information on your device for this purpose takes place only with your consent (§25(1) TDDDG). Declining has no effect on your use of BriefBot. The data is linked to your account, never shared with third parties, and retained for a maximum of 90 days, after which raw events are automatically deleted. Aggregated, anonymised insights are retained for service improvement purposes.
You can withdraw your consent at any time under Account → Privacy → Advanced Analytics or via the cookie settings. The withdrawal does not affect the lawfulness of processing carried out before it. Once disabled, no behavioural events are collected.