Briefy

GDPR overview

Implementation is partial but real. The privacy policy, last updated 17 May 2024, carries a dedicated EU and UK section setting out the legal bases relied upon: consent, performance of a contract, legitimate interests, legal obligation and vital interests. Residents of the EEA, the United Kingdom, Switzerland and Canada are granted access, rectification, erasure, restriction, portability, objection and the right not to be subject to automated decision-making, with consent withdrawable at any time. Complaint routes are named: the member state supervisory authority, the UK ICO and the Swiss Federal Data Protection and Information Commissioner. Notable gaps remain: no Article 27 EU representative is designated, no DPO is named, no DPA is published, hosting is United States only, and compliance is never claimed in so many words. Every request goes to a single address, hello@briefy.ai.

Who owns the data?

Briefy's Terms state that private content provided by users stays private: it is neither shared with third parties nor accessed by the vendor without the user's explicit consent. Everything Briefy itself publishes remains the property of the vendor or its licensors, all rights reserved. Personal data collected is limited to email addresses, names, usernames and passwords; no sensitive information is processed and nothing is gathered from third parties. Payment details never reach Briefy, since Lemon Squeezy handles and stores them. Accounts can be terminated on request, after which data is removed from active databases, with limited retention for fraud prevention and legal obligations.

Reuse rights

The Terms reserve all intellectual property in Briefy's own content: users may not copy, download, share beyond the permitted limits, modify, translate, publish, sell, sublicense or create derivative works from it, and reuse is confined to what proper use of the service implies. Content the user provides is treated differently — it stays private unless the user explicitly consents otherwise. On the vendor's side, personal data is processed to create and authenticate accounts, deliver the service, answer enquiries, send administrative messages, manage orders and payments, request feedback, prevent fraud and comply with law, on the GDPR bases of consent, contract, legitimate interests, legal obligation and vital interests. Named recipients include Google Cloud Platform, Amazon Web Services, Google Cloud Storage, Lemon Squeezy, Google Sign-In, Sign in with Apple, Google Analytics, Google AdSense, Sentry and, for AI processing, OpenAI, Anthropic and Google Cloud Platforms. Briefy states it has neither sold nor shared personal data in the preceding twelve months. Data drawn from Google Workspace APIs is explicitly not used to develop, improve or train generalised AI or ML models; no equivalent commitment covers other summarised content.

Data retention & training

Hosting summary

Briefy states plainly that its servers are located in the United States, and acknowledges that users outside the country are transferring data internationally when they use the service. The policy notes that the EEA, the United Kingdom and Switzerland may have more comprehensive data protection laws than the jurisdictions the data reaches, and undertakes to protect it in line with applicable law. Infrastructure is supplied by Google Cloud Platform, Amazon Web Services and Google Cloud Storage. The domain resolves to 3.220.105.9, an Amazon address geolocated to Ashburn, United States, which is consistent with that claim. No alternative region is offered, no EU data residency option exists, and no hosting certification such as SOC 2 or ISO 27001 is claimed anywhere on the site. European users should therefore assume United States hosting with no choice of location, and no published Data Processing Agreement to govern the transfer.