Privacy Notice

1. Who we are

BriefHQ is operated by NovaPath Studios. NovaPath Studios is the data controller for personal data processed through the service.

2. Data we collect

• Account data: name, email, login credentials, agency name and logo.
• Project data: client names, project types, brief answers and generated briefs you create.
• Communications: support messages and email preferences.
• Usage data: pages viewed, features used, device and browser info, IP address, approximate location.
• Cookies: essential cookies for authentication and session, optional analytics cookies.

3. How we use it

• To create your account and provide the service (legal basis: contract).
• To generate briefs via AI providers on your behalf (legal basis: contract).
• To send transactional emails about your account and briefs (legal basis: contract).
• To secure the service, prevent fraud, and debug issues (legal basis: legitimate interests).
• To improve the product and understand usage in aggregate (legal basis: legitimate interests).
• To comply with legal obligations (legal basis: legal obligation).

4. Who we share data with

• Paddle — our Merchant of Record for sales, subscription management, payments, tax compliance, and invoicing.
• Subprocessors — hosting, database, email delivery, analytics, and AI model providers acting under contract.
• Professional advisers — legal and accounting, as needed.
• Authorities — when required by law or to protect rights and safety.

5. International transfers

Data may be processed outside your country, including in the EEA, UK, and US. Where applicable we rely on safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We keep personal data for as long as your account is active and as needed to provide the service. After account closure we delete or anonymize data within a reasonable period, except where retention is required by law (e.g. tax records).

7. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, or port your personal data, to object to processing, and to withdraw consent. You may also complain to a supervisory authority. We respond to requests within the timeframes required by applicable law (typically one month under GDPR/UK GDPR).

8. Security

We use appropriate technical and organizational measures including encryption in transit, access controls, and least-privilege principles. No system is perfectly secure; please use a strong unique password.

9. Cookies

We use essential cookies required for authentication and session. We may use analytics cookies to understand usage; you can manage cookies through your browser settings.

10. Contact

For privacy questions or to exercise your rights, contact NovaPath Studios at hello@briefhq.net.