Privacy Policy

What we collect

• Account data: email, optional name, timezone, plan, billing status and interval, add-on counts, trial end date, and the identifiers Polar assigns to your customer record and subscription (payment details are held by Polar, never by us).
• Product data: your watchlists, tracked sources, keyword filters, Slack webhook URLs, digest history.
• Signup data: the answers you give when setting up your first brief — your role, and your company name if the brief is for a team or for clients — the campaign parameters the link you arrived on carried (utm_source, utm_campaign, utm_content or ref), and the country your timezone implies. The answers are optional and can be skipped; the parameters come from the link, not from you. All of it is held on your account record.
• Stored in your browser: when you open the homepage, or one of the pages about industries, comparisons, the glossary, industry intelligence, the sample brief or security, through a link that carries campaign parameters (utm_source or ref, utm_campaign, utm_content), the page saves those values and the time in your browser's localStorage under the name bw_utm. It is there so that if you sign up — which goes through a link in an email that opens a new tab — your account can still record which link brought you (the signup data above). The saved copy is not sent to us on its own: it is read once, when you finish the questions that set up your first brief, and sent with your answers. A link without those parameters saves nothing, and a later link that carries them replaces it. The copy is ignored once it is 30 days old and deleted the next time you open one of those pages after that; clearing this site's data in your browser deletes it at any time.
• Analytics data: two page-view counters run on these pages, and both report in aggregate, with the one exception set out at the end of this item. Cloudflare Web Analytics is added by Cloudflare to every page we serve, at the edge — it is their script rather than one we install — and reports the country, host, path, referring link, browser, operating system, device type and navigation type of a page view. Cloudflare states that it uses no client-side state, “like cookies or localStorage”, for analytics, and that it does not track visitors over time by IP address or user-agent string. Vercel Web Analytics is loaded by this site and stores, per page view, the time, the URL and its route pattern, the referring link, filtered query parameters, an approximate location, and the browser, operating system and device type. Vercel states that it uses no third-party cookies — a visitor is identified by a hash derived from the incoming request, discarded after 24 hours — and that it collects no identifier that would follow you to another site. Neither is connected to your account. The one thing we add is a named event when a button on a marketing page is pressed, carrying which button it was and what the link you arrived on already said — the same utm_source and utm_content described above, and the industry beat the link named; no name, email or account identifier is attached to it. The exception: a link we send someone ourselves, in an email or a direct message, can carry a utm_content value unique to that message, so that we can tell which message a visit or a signup came from, and so whom we sent it to. If you arrived through such a link, that value is on the button events above, may be among the query parameters Vercel keeps for the page view, is in your browser as described above, and is saved on your account if you sign up. For you, then, those events are not anonymous to us: the value ties them to the message we sent you, and to your account once you sign up.
• Content data: structured insights derived from the curated library's public sources and any URLs you add — videos, podcasts, blogs, changelogs, and regulator feeds such as Federal Register notices and agency press releases (each ≤2 sentences, with a link to the source). The commitment ledger also keeps the speaker's exact words for each promise it records, with or without a deadline (at most 600 characters), with its link. Raw transcripts are processed transiently and deleted by a daily job once they are more than 7 days old. We never download or store audio or video files ourselves. When a podcast publishes no transcript, the episode is not read: its audio is not transcribed, and its address is sent to no one.

Your email address is required: without it there is no account to sign in to and no brief to deliver. Polar, as merchant of record, needs payment details, including a card, to start the trial. Everything else we ask you for is optional.

How we use it

To operate the service: ingesting the sources you chose, generating digests, sending the emails you double-opted into, and billing. The signup data above is used for a second, separate purpose: understanding who Briefwire is for, and contacting prospective customers about it — your role and company tell us which kind of reader you are, and the campaign parameters tell us which message you arrived on. It changes nothing about the brief you receive. We don't sell personal data or use it for advertising.

Legal basis. Operating the service and billing for it is performance of our contract with you (GDPR Art. 6(1)(b)). Sending digest and brief emails rests on your consent, given by double opt-in and withdrawable at any time (Art. 6(1)(a)). Using signup data to understand who Briefwire is for, and to contact you about it, rests on our legitimate interest in developing the product (Art. 6(1)(f)); you can object to that use at any time by emailing us, and we stop. The two page-view counters rest on the same legitimate interest (Art. 6(1)(f)): knowing which pages are read and which buttons are pressed is how the site gets written, and it is the reason they are the aggregate, no-cross-site-profile kind rather than the kind that follows a reader. The same objection covers them.

Processors

We use Supabase (database & auth), Vercel (hosting, and the second of the two page-view counters above), Cloudflare (the CDN in front of the site, the first of those counters, which it injects itself, and the routing of mail sent to our addresses), Google (Gmail, the mailbox that mail is forwarded to, where it is kept and read), Polar (payments, acting as merchant of record), Resend (the emails we send), transcript providers (Supadata / Apify / TranscriptAPI — they receive only public video identifiers), and an LLM provider (OpenAI, Anthropic, or Google — they receive transcript text, never your personal data). Public data sources we read from (such as SEC EDGAR and the Federal Register) receive our requests, not your data.

Where your data is processed

Your account data is stored in the United States: the database in Supabase's us-east-1 region, and the site and its scheduled jobs on Vercel in Washington, D.C. Emails we send you leave through Resend's sending region in Tokyo, Japan. Mail you send to our addresses is routed by Cloudflare to a Gmail mailbox, which Google operates. And Briefwire is run from Kuala Lumpur, Malaysia: your data is accessed from there to operate the service and to answer you. So if you are in the EU, EEA, UK or Switzerland, your personal data is transferred outside your region. Transfers to Supabase, Vercel, Cloudflare, Polar, Resend and the LLM providers are covered by each one's data processing agreement, which incorporates the EU standard contractual clauses (and the UK addendum where it applies); several of these processors are also certified under the EU–US Data Privacy Framework. Email us for a copy of the clauses that apply to you.

Your rights (GDPR)

• Export: download a JSON export of your account's data from Settings → Data. Two things we hold under your email address rather than your account are not in that file: invitations to join a team that were sent to your address, and a sign-up for the free brief. Email legal@getbriefwire.com and we'll send you those too.
• Deletion: delete your account from Settings → Data. Deleting it first cancels any subscription Polar could still bill you for; if that cannot be confirmed, your account and its data are not deleted and you are told so. It then permanently removes your profile and everything stored under it — watchlists, with the sources, keyword filters and Slack webhook addresses on them; keyword alerts; collections, including any you published as a public brief, whose link stops working; API keys; webhook endpoints and their delivery log; the workspace you own; your memberships in other workspaces; digest history — along with any free Monday brief subscription for your email address and invitations to other people's workspaces sent to your email address. If you own a workspace, it goes with your account: its members keep their own watchlists and lose access to yours. What stays: the records of public sources — each feed, episode, post and filing, and the lines drawn from them — which every account shares, including a source whose address you added yourself; nothing in them points back to your account. Polar keeps its own records of your orders, payments and refunds, as merchant of record. Emails already delivered stay where they were delivered, and mail you sent to our addresses stays in our mailbox unless you ask us to delete it.
• Rectification & objection: email us and we'll handle it within 30 days.

Email consent

Digest emails use double opt-in: nothing is sent until you confirm via the link we email you. Every digest includes a manage-preferences link, and you can pause or stop digests in Settings at any time.

Retention & security

Account and signup data are kept while your account exists. Raw transcripts are deleted by a daily job once they are more than 7 days old. Data is encrypted in transit and at rest; database access is protected by row-level security. Deleting your account does not delete the payment and refund records Polar keeps as merchant of record, and a refund recorded there still counts as your one refund under the Terms.

Contact

Data controller: Briefwire. Privacy requests: legal@getbriefwire.com