Brifay

GDPR overview

GDPR implementation is documented in unusual detail. The controller is Brifay, 15 place Michelet, 37000 Tours (RCS Tours 105 817 209, VAT FR30105817209), reachable for data protection at privacy@brifay.com, an address the site presents as its DPO. The privacy policy is dated April 10, 2026 and the terms June 18, 2026 (version 1.1). Rights are wired into the product: immediate JSON export (art. 15), profile editing (art. 16), deletion by an admin plus a public account-deletion procedure within 30 days (art. 17), JSON/CSV portability within 7 days (art. 20), AI disabling per role and one-click unsubscribe (art. 21), a shareable processing register within 30 days (art. 30) and CNIL notification within 72 hours (art. 33). Transfers outside the EU rely on the EU-US Data Privacy Framework and standard contractual clauses, and a DPA is signed on request. The supervisory authority named is the CNIL in Paris.

Who owns the data?

Under article 11.1 of the terms, the customer keeps full ownership of its data: "The Customer retains full ownership of the Customer Data. Brifay holds, over this data, only the rights strictly necessary for the performance of the Service." That is a non-exclusive license limited to running the service and ending with the contract. For personal data processed on the customer's behalf, Brifay acts as a processor under article 28 GDPR. Article 11.3 adds portability: export at any time in CSV, JSON or PDF, and a full export on request for 30 days after the contract ends. Tenants are isolated by PostgreSQL Row Level Security.

Reuse rights

Customers can reuse their own data freely, without asking Brifay for permission: ownership stays with them, export in CSV, JSON or PDF is available at any time, and a full export can be obtained for 30 days after the contract ends. Brifay's own use is confined to running the service — account and authentication data, manually entered GPS coordinates, media, in-app messaging, equipment records, notification tokens and technical data. The publisher states that no data is sold to third parties, that no special-category data under article 9 GDPR is collected, and that there is no profiling and no automated decision-making producing legal effects. Legal bases are documented purpose by purpose (contract, legal obligation, legitimate interest); cold B2B prospecting relies on legitimate interest with a documented assessment and a one-click opt-out, and no customer product data feeds it. On the AI side, prompts sent to Brio are, in the publisher's words, never used to train any model, internal or third-party, inference is described as zero-retention, and the assistant can be switched off for an organization or for a given role — a role without AI issues no inference call at all. Card details are handled by Stripe and never stored by Brifay.

Data retention & training

Hosting summary

The primary database is PostgreSQL managed by Supabase in the European Union region, with no primary storage outside the EU; automatic backups and the availability replica sit in the EU as well. Daily snapshots are kept 7 to 30 days depending on the plan, point-in-time recovery goes down to two minutes on Pro and Business, and restores are tested monthly. Data is encrypted with AES-256 at rest and TLS 1.3 in transit with HSTS, keys being held by the hosting provider outside the application instance, while tenants are isolated by PostgreSQL Row Level Security fuzz-tested at each release. Cloudflare provides DDoS filtering and a WAF with EU-first routing. Named EU subprocessors include Supabase, Pennylane in France, Gleap in Austria, EmailIt and Cloudflare; Firebase, Google Maps, Google Workspace, Stripe and Sentry handle some metadata outside the EU under the EU-US Data Privacy Framework and standard contractual clauses. One internal inconsistency is worth noting: the security page places Sentry in the EU region while the privacy policy's subprocessor table places it in the United States. AI inference runs on European Mistral endpoints, and infrastructure logs are kept 30 days.