Privacy Notice

Version 1.7 — in effect since 13 October 2026. This notice describes BriefGate's actual data handling as implemented in the product. Every cookie, retention period, and recipient named below was checked against the running code rather than written from intent; where a period or a lawful basis rests on a judgment rather than on a number in the code, the judgment is stated here instead of being left implicit.

This is the notice linked from the Google OAuth consent screen and from your account settings. It is addressed to you, the account holder — the person who signs up for and uses BriefGate — under Article 13 of the GDPR.

If you are looking for how BriefGate handles your own clients' data (the people you send an intake to), that is a separate relationship in which you, not BriefGate, are the controller. It is covered in depth in the GDPR page, which this notice cites rather than repeats in §6 below.

1. Who is the controller

For the personal data described in this notice, the controller is:

Radim Sekera, trading as BriefGate (a Czech sole trader / OSVČ). IČO: 04217764. Registered address: Kostelní 2022/18, 741 01 Nový Jičín, Czech Republic. Contact for data protection matters: privacy@briefgate.dev.

BriefGate has not designated a data protection officer; it does not meet the criteria in Article 37(1) GDPR that would require one.

2. What data we collect about you

Providing your name, email address, and a means of signing in is a contractual requirement: without them there is no account and BriefGate cannot provide the service. Billing details become necessary only if you move to a paid plan. Everything else in the table above is either generated by the product as you use it or optional — declining it costs you the feature it belongs to, nothing more.

This is distinct from the data your own clients submit through an intake (their contact details, files, and any secret credentials) — that data is described in the GDPR page, and BriefGate is your processor for it, not its controller (see the DPA).

3. Why we process it, and the lawful basis

BriefGate does not currently run marketing email campaigns to account holders; if that changes, any marketing communication will be sent only on the basis of your consent (6(1)(a)) or an equivalent narrow legitimate interest with an opt-out, and this notice will be updated to say so before it happens.

4. Cookies

That is the complete list — BriefGate sets no others, on any of its sites. They are strictly necessary or plain preference cookies: they keep you (or your client) authenticated, protect a sign-in in progress, or remember a language. None is used for advertising, analytics, or cross-site tracking (the cookieless page-view measurement on the marketing site is described in §12), there is no tag manager or session recording anywhere in the product, and Czech/EU cookie-consent rules do not require a consent banner for cookies of this kind. bg_portal is listed here for completeness because it is set by BriefGate infrastructure, even though the person it identifies is your client, not you — your clients' use of the portal is covered under your own privacy notice to them, which is your responsibility as controller (see the GDPR page, "Subject rights").

5. How long we keep your account data

• Account and configuration data, including sign-up attribution: for as long as your account is active, plus a period after closure to handle any outstanding billing, dispute, or legal-hold need.
• Billing records (invoices, payment records): kept for the period Czech tax and accounting law requires — in practice at least three years from the end of the tax period concerned, and longer where accounting or VAT rules extend it. This is longer than the life of your account regardless of when you close it, and it is the one category that survives an erasure request.
• Audit log entries: retained as part of the append-only security log described in the GDPR page and the DPA Annex III; it is not deleted on request because its purpose is to provide a reliable record of account activity, including in the period around any dispute.
• Account deletion: on request, BriefGate deletes your account and personal data within 30 days, save for what a legal obligation (billing records) requires it to keep.

This is separate from intake data — the material your clients submit — whose retention you control per-account and per-intake as described in the GDPR page ("Data retention").

6. Who we share it with

• Sub-processors who support the service: netcup GmbH (hosting, Germany), Cloudflare, Inc. (storage/CDN), Plus Five Five, Inc. (Resend, transactional email), Twilio Inc. (SMS), Stripe, LLC (payments), Functional Software, Inc. (Sentry, error monitoring, EU data residency). Their role, location, and transfer basis are detailed in the DPA (Annex IV) and the GDPR page, which this notice incorporates by reference rather than duplicating a table that would then have to be kept in sync in two places.
• Google LLC, if — and only if — you choose to sign in with a Google account. Google then processes that sign-in as its own controller under its own terms, not on BriefGate's behalf; it learns that you signed in to BriefGate. Signing in with an email address and password avoids this entirely. See the DPA Annex IV, "Google sign-in".
• Legal and safety: where required by law, to protect BriefGate's rights, or to investigate abuse of the service (see the Acceptable Use Policy).
• Your own clients, on the Free plan. Without custom branding (Solo plan and up), the invitation and reminder e-mails and the client portal show your account's verified login e-mail address next to the built-in sender name, e.g. "Your developer (you@example.com)" — this happens even if you have set a different Reply-To address. It lets the client tell who is asking, in the absence of a sender name you chose yourself. This stops once the account has custom branding.
• We do not sell your personal data, and we do not share it for third-party advertising.

7. International transfers

Application processing happens in the EU (Germany); some sub-processors are US companies, and transfers to them rest on the EU-U.S. Data Privacy Framework together with the 2021/914 standard contractual clauses as a fallback. The detail — including the pending Court of Justice appeal noted against the adequacy decision — is in the DPA §3, which is the authoritative statement for both this notice and the GDPR page.

8. Your rights

As a data subject, you have the right to:

• Access the personal data BriefGate holds about you.
• Rectify inaccurate or incomplete data — much of this you can do yourself in account settings.
• Erase your data ("right to be forgotten"), subject to the legal-obligation retention in §5.
• Restrict processing in the circumstances set out in Article 18 GDPR.
• Port your account data to yourself or another provider in a structured, machine-readable format.
• Object to processing based on legitimate interest (§3).
• Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before the withdrawal.

To exercise any of these rights, email privacy@briefgate.dev. We will respond within the time limits set by the GDPR (normally one month). We may ask you to verify your identity before acting on a request.

Right to lodge a complaint. If you believe BriefGate has not handled your personal data lawfully, you have the right to complain to the Czech data protection authority:

Úřad pro ochranu osobních údajů (ÚOOÚ) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic www.uoou.cz

or to the supervisory authority of your own EU member state of residence, if different.

9. Automated decision-making

BriefGate does not make any decision about you, based solely on automated processing, that produces legal or similarly significant effects for you within the meaning of Article 22 GDPR, and it does no profiling.

To be precise rather than reassuring: rate limiting is automatic, and a request over the limit is refused by code with no human involved. What it does not do is decide anything about you as a person — it throttles a request, tells you when to retry, and lifts by itself. Closing, suspending, or refusing an account is a decision a human makes, and abuse signals only bring something to that person's attention.

10. Security

The technical and organizational measures protecting your account data — encryption, access control, key isolation, audit logging — are the same ones described in detail in the DPA Annex III, which applies to account data as much as to intake data.

11. Changes to this notice

We will update this notice as the product or our processing changes, and post the new version here with an updated version number. Material changes will be notified to your account's registered email address.

12. If you are not an account holder

Two groups of people reach BriefGate without ever signing up, and this notice covers them too.

Visitors to briefgate.dev. The site measures page views with Cloudflare Web Analytics, which runs without cookies, without any identifier stored in your browser and without cross-site tracking; Cloudflare, Inc. processes the request metadata as our processor and we see only aggregate counts, referrers and pages. There is no advertising pixel and no session recording. The site sets one cookie, bg_lang, to remember which language you are reading in. Server logs at the hosting layer record ordinary request metadata, including IP addresses, and exist to keep the site available and to investigate abuse — legitimate interest, Article 6(1)(f). A link to the sign-up page may carry campaign parameters (such as utm_source or gclid) in its address; nothing is stored from these unless you go on to create an account, as described in §2 and §3.

People who open the public demo. The demo at /v1/demo gives anyone a throwaway client portal without an account. Here BriefGate is the controller, not a processor for somebody else: your IP address is used to rate-limit how many demo portals one visitor can create, a bg_portal cookie keeps the session, and anything you type or upload is stored exactly as a real client's answers would be. The whole demo intake, files included, is deleted within one day, no reminder is ever sent, and no email address is collected. Do not put anything real into it — it is there to show you what your own clients would see.

Clients you send an intake to are a different case again: for their data BriefGate is the processor and the account holder is the controller, so the notice that applies is the account holder's, not this one. See the GDPR page.