1. Introduction

This Privacy Policy explains how Briefer Technologies AB, a Swedish limited liability company with organization number 559540-9144 ("Company", "we", "us", or "our"), collects, uses, processes, and protects your personal data when you use our Briefer platform and services ("Service").

We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Swedish data protection legislation.

2. Who We Are and How to Contact Us

Data Controller: Briefer Technologies AB
Organization Number: 559540-9144
Contact: [email protected]

For all privacy-related inquiries, data subject requests, or concerns about how we handle your personal data, please contact us at [email protected].

3. Data We Process on Behalf of Our Customers

When our customers (companies, funds and investor networks) upload or connect data about their shareholders, investors, board members and contacts, the customer is the data controller and Briefer is the data processor under a Data Processing Agreement (GDPR Article 28). For this data, Briefer:

Processes it only on the customer's instructions, to provide the Service
Never uses it to train AI models
Stores it in the EU
Deletes it when the customer's agreement with us ends

If you are a shareholder, investor, board member or contact of one of our customers, please direct requests about your personal data to the company that holds it. If we receive such a request, we forward it to that customer. For questions, contact [email protected]. Our Data Processing Agreement is published at briefer.vc/dpa.

4. What Personal Data We Collect

4.1 Information You Provide Directly

Account Information: Name, email address, job title, company name, phone number
Profile Data: Professional information, preferences, and settings
Communication Data: Messages, feedback, and correspondence with us
Payment Information: Billing details (processed securely through Stripe)

4.2 Information We Collect Automatically

Usage Data: How you interact with our Service, features used, time spent
Technical Data: IP address, browser type, device information, operating system
Log Data: Access logs, error reports, performance metrics
Analytics Data: User behavior patterns, feature adoption, service performance
Signing Evidence: When you sign a document through Briefer, we record your verified email address, the name you type, your signature, the times the code was sent and verified and the document was signed, your IP address, the country of that IP address and your browser.

4.3 Information from Third Parties

Integration Data: Data from connected services via Composio integrations
Authentication Data: Information from Supabase authentication services
AI Processing Data: Content and data processed through Anthropic's AI services

5. How We Use Your Personal Data

5.1 Legal Bases for Processing

We process your personal data based on:

Contract Performance: To provide and maintain our Service
Legitimate Interests: To improve our Service, ensure security, and conduct business operations
Legal Compliance: To comply with applicable laws and regulations
Consent: Where specifically obtained for certain processing activities

5.2 Purposes of Processing

Service Delivery: Providing, maintaining, and improving our platform
Account Management: Creating and managing user accounts and subscriptions
Communication: Sending service-related notifications, updates, and support
Payment Processing: Managing billing and payments through Stripe
AI Services: Enhancing functionality through AI-powered features via Anthropic
Analytics: Understanding usage patterns to improve our Service
Security: Protecting against fraud, abuse, and security threats
Legal Compliance: Meeting regulatory requirements and legal obligations

6. Third-Party Services and Data Sharing

We work with trusted third-party service providers to deliver our Service. Your data may be processed by:

6.1 Hosting and Infrastructure

Supabase: Database, authentication and file storage. EU (Stockholm).
Railway: Application hosting (API, frontend, AI worker). EU (Amsterdam).
Cloudflare: CDN, DDoS protection and edge cache. EU. Processes request metadata and IP addresses transiently.

6.2 AI and Connector Services

Anthropic: LLM inference. US. Zero data retention, no training on your data.
Cohere: Embeddings and reranking. US. Zero data retention, no training on your data.
Reducto: Document parsing (text, tables and OCR from uploaded files). EU. Zero data retention, no training on your data.
Composio: Connector broker for services such as Slack, Gmail and Drive. US. Holds the OAuth tokens for connected accounts.

6.3 Analytics Services

Mixpanel: Product analytics and usage tracking to understand how our Service is used and improve user experience. Data is processed on EU servers (api-eu.mixpanel.com). Mixpanel receives pseudonymous user IDs; no names or email addresses. Mixpanel is configured to opt users out by default until consent is given or the user registers for an account.

6.4 Communication and Payment

Resend: Email delivery and open/click tracking. EU.
Stripe: Subscription billing (PCI DSS compliant). EU.

Transfers to US providers rely on Standard Contractual Clauses.

6.5 Data Processing Agreements

We have appropriate data processing agreements in place with all third-party processors in accordance with GDPR Article 28. These agreements ensure adequate protection of your personal data.

7. International Data Transfers

Some of our third-party service providers may process data outside the European Economic Area (EEA). When we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place:

Standard Contractual Clauses: EU-approved contractual protections, incorporated in each provider's data processing agreement

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy:

Investor Updates and Attachments: Retained while the workspace is active. Deleted on workspace deletion.
Dataroom Files: Retained while the workspace is active. Deleted on workspace deletion.
Audit Log: Append-only, tamper-resistant at the database privilege level. Retained while the workspace is active and for 12 months after termination, then deleted.
Engagement Events: Same-day events are merged; rows retained while the workspace is active.
Email Tracking (Open/Click): Retained 24 months from send.
Account and Billing Data: Retained while the subscription is active and 7 years thereafter for tax compliance.
AI Providers (Anthropic, Cohere, Reducto): Zero retention. Prompts, completions and parsed documents are not stored by the providers and are not used for training. Calls are made under zero-data-retention agreements.
Signed Documents and Signing Evidence: Retained for 10 years after the document is completed (the Swedish general limitation period), so that the signature can be proven if it is ever disputed. Deleting a signed document in the workspace hides it but does not erase it. During this period we keep the data even after a request for erasure or the deletion of the workspace, because keeping it is a legal obligation and necessary to establish, exercise or defend legal claims (GDPR Article 17(3)(b) and (e)). After 10 years it is deleted.
Backups: Daily snapshots via Supabase, retained 7 days. Restore testing performed quarterly.
Legal Hold: Data may be retained longer if required for legal proceedings

9. Your Rights Under GDPR

As a data subject, you have the following rights:

9.1 Access Rights

Right to access your personal data and obtain information about our processing

9.2 Correction and Deletion

Right to rectify inaccurate personal data
Right to erasure ("right to be forgotten") under certain circumstances

9.3 Processing Rights

Right to restrict processing in certain situations
Right to object to processing based on legitimate interests
Right to data portability for data provided under contract or consent

9.4 Consent Rights

Right to withdraw consent at any time (where processing is based on consent)
Right not to be subject to automated decision-making, including profiling

9.5 Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request. If your request is complex or we receive multiple requests, we may extend this period by two months with notification.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

10.1 Technical Measures

Encryption of data in transit and at rest
Secure authentication and access controls
Regular security assessments and updates
Automated monitoring and threat detection

10.2 Organizational Measures

Staff training on data protection and security
Access controls and need-to-know principles
Regular review of data processing activities
Incident response and breach notification procedures

11. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. In accordance with GDPR and the ePrivacy Directive, we obtain your consent before setting non-essential cookies.

11.1 Types of Cookies

Essential Cookies: Required for basic Service functionality, including authentication, security, and session management. These cookies cannot be disabled as they are necessary for the Service to function.
Analytics Cookies: Help us understand how you use our Service through Mixpanel analytics. These cookies collect information about your interactions with our platform, including pages visited, features used, and session duration. Analytics data is stored on EU servers (api-eu.mixpanel.com). Legal basis: Consent for marketing site visitors; Legitimate Interest for registered users (see Section 11.4).
Functional Cookies: Remember your settings and preferences to enhance your experience

11.2 Cookie Details

Mixpanel (mp_*): Analytics cookies for usage tracking. Provider: Mixpanel Inc. Purpose: Understanding user behavior to improve our Service. Retention: 1 year.
Supabase Authentication: Essential cookies for user authentication and session management. Provider: Supabase Inc. Retention: Session-based.
Cookie Consent (briefer_cookie_consent): Stores your cookie preferences. Provider: Briefer. Retention: 1 year.

11.3 Cookie Consent Management

When you first visit our marketing website, you will be presented with a cookie consent banner that allows you to:

Accept all cookies
Reject all non-essential cookies
Customize your preferences for each cookie category

You can change your cookie preferences at any time by clearing your browser's local storage or contacting us at [email protected]. Additionally, you can manage cookies through your browser settings.

11.4 Analytics for Registered Users

For registered users who have agreed to our Terms of Service, we process analytics data based on Legitimate Interest (GDPR Article 6(1)(f)) and Contract Performance (GDPR Article 6(1)(b)). This allows us to understand how our Service is used and improve it for our customers. This processing is necessary for providing and improving our B2B service, conducting security monitoring, and maintaining service quality. You may object to this processing by contacting us at [email protected], though this may affect our ability to provide certain service improvements.

12. Children's Privacy

Our Service is designed for business use and is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

Posting the updated policy on our website
Sending email notification to registered users
Providing notice through our Service interface

Continued use of our Service after changes constitutes acceptance of the updated Privacy Policy.

14. Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with this Privacy Policy or applicable data protection laws, you have the right to lodge a complaint with:

Swedish Authority for Privacy Protection (IMY)
Website: www.imy.se
Email: [email protected]

You may also contact us directly at [email protected] to resolve any concerns.

15. Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of such transfer and any changes to this Privacy Policy.

16. Contact Information

For questions about this Privacy Policy or our data processing practices, contact us at:

Briefer Technologies AB
Organization Number: 559540-9144
Email: [email protected]