Privacy Policy

Our Core Privacy Principle

Your data belongs to you. We only process what is necessary to turn your chaotic inputs into organized calendar events and tasks. We do not sell your personal information or your family's schedules to third parties, and we never will.

Information We Collect

To provide our services, we collect:

• Communication Data: The messages, PDFs, and screenshots you forward to us for processing.
• Extracted Metadata: The structured details we pull from your inputs—dates, times, locations, and event or task descriptions—that populate your private dashboard.
• Account Information: Your name, email, and authentication details when you sign up.

How We Use Your Data

We use AI to analyze the documents and messages you send us. This analysis is automated and used strictly to extract dates, times, and task details to populate your personal dashboard and calendar. We do not perform any other analysis on your family's information.

Our Two-Tiered Data Lifecycle

We treat the AI processing layer and your personal dashboard as two distinct worlds, with different rules for each.

• Tier 1 — Raw Inputs (Secure, Bound Retention): The raw documents, screenshots, and text you forward are processed using enterprise-grade AI infrastructure under strict privacy commitments. Your raw inputs are never used to train or improve foundation models, and never sold. To keep the platform safe, our AI infrastructure provider may temporarily retain encrypted transaction logs for a maximum of 30 days, used for one purpose only: automated abuse and safety monitoring to prevent Terms-of-Service violations. After that window, the data is permanently deleted.
• Tier 2 — Extracted Metadata (Securely Stored): Once the AI has done its work, the resulting structured metadata—event titles, specific dates, times, and task breakdowns—is stored securely in our own application databases. This is what powers your private dashboard and calendar, so you can return to your organized schedule whenever you need it.

Legal Basis for Processing

Where data protection laws such as the GDPR or Singapore's PDPA apply, we rely on the following lawful bases:

• Performance of a contract: Processing your inputs and storing your calendar so we can provide the service you signed up for.
• Consent: Sending optional product updates, and transmitting your documents to our AI infrastructure providers for extraction.
• Legitimate interests: Keeping the service secure, preventing abuse, and improving reliability—balanced against your privacy.

How We Use Your Email Address

Your email is used for three specific purposes, and nothing else:

• Account Authentication: Securely delivering passwordless magic links and one-time passcodes (OTPs) so you can sign in.
• System & Operational Notifications: Transactional alerts when a high-priority document extraction completes, fails, or requires your manual validation.
• Minimalist Product Communication:Periodic updates about new features. Every one of these emails includes a legally compliant, one-click unsubscribe—opt out any time and we'll honor it immediately.

Third-Party Data Transmission

By using the service, you consent to the secure transmission of your uploaded documents, messages, and screenshots to our verified third-party cloud and enterprise AI model infrastructure providers (such as Google Cloud and Gemini), solely to execute the extraction you requested. These providers act as our processors under strict contractual privacy commitments and do not use your data for their own purposes.

International Data Transfers

Our infrastructure providers may process your data on servers located outside your country of residence. Where this happens, we ensure an adequate level of protection through recognized legal safeguards—such as Standard Contractual Clauses or transfer mechanisms that provide protection comparable to the laws of your home jurisdiction.

Account Deletion & Data Purge

All dashboard data, account metadata, and cached session states persist only as long as your account is active. If you delete your account, all personal data, calendar records, and database states are permanently and irreversibly purged from our live systems immediately, and fully overwritten across all encrypted backup rotations within 30 to 60 days. There is no hidden archive: when it's gone, it's gone.

Your Rights & Choices

You remain in control of your data. Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and all associated data.
• Export your calendar data in a portable format.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with your local data protection authority (for example, the PDPC in Singapore or your EU/UK supervisory authority).

To exercise any of these rights, just email us—we'll respond within the timeframe required by applicable law.

Automated Processing

Our AI reads your inputs to draft calendar events and tasks. This is assistive extraction, not decision-making that produces legal or similarly significant effects about you. You always remain in control: you can review, edit, or discard anything Briefly creates before it lands in your calendar.

Children & Family Data

Briefly is built for parents and is intended for adults aged 18 and over. Children do not hold accounts with us. While your inputs may naturally mention your children's activities and schedules, this information is treated as your personal household data and protected under the same commitments described in this policy.

Your Child's Name and Grade, Specifically

When you add a child profile, we collect their nickname, class/grade code (e.g., "P3A"), and optionally their school name and your own matching keywords. This is separate from the messages, PDFs, and screenshots you forward for extraction, described above. Here is exactly how the child profile fields are used:

• Nickname: used only to display your child in your dashboard and calendar, and to let you assign or route events and tasks to them. It is not used for any automated matching.
• Class/grade:used only for deterministic, rule-based matching—for example, recognizing that a school letter addressed to "P3A" belongs to your child. This matching runs on our own servers using pattern matching, not AI.
• AI models: neither field is sent to Gemini or any other AI model. They never leave our own application database for AI processing.
• Third parties: neither field is shared with any third party or sub-processor.
• Retention & deletion:removing a child profile deletes it from our live systems immediately, and it is fully purged from backups within 60 days—the same window that applies to the rest of your account data.

Enterprise-Grade Data Security

Your family's privacy is our baseline, not an afterthought.

• Encrypted by Default: Your data is protected by industry-standard encryption both in transit and at rest.
• Strict Access Controls: Access to your data is isolated and strictly limited only to what is necessary for the application to function.
• Breach Notification: In the unlikely event of a data breach that affects you, we will notify you and the relevant authorities as required by law.

Changes to This Policy

We may update this policy as our product and the law evolve. When we make material changes, we'll update the date below and, where appropriate, notify you by email or in the app. Your continued use of Briefly after an update means you accept the revised policy.