Your privacy

1. Who is responsible for your data

Lignologic Solutions LLC, a company formed in Wisconsin, at USA, is the controller of the personal data described on this page. For anything in this policy — including a request to access or delete your data — write to support at briefme.us .

2. What we store

We store only what running the product requires, grouped here by category.

• Agenda content. Whatever you or your assistant send us to build or update the agenda: its title, each block's title, description, duration and type. We store the resulting agenda, not a separate copy of your original meeting prompt. BriefMe does not request your full conversation history. Text included in an agenda title or description is stored as part of that agenda.
• Agenda access tokens. The share_token that opens the read-only view and the edit_token that unlocks the owner page, plus the timer's current position (which block, and since when).
• Web server access logs. IP address, user agent, requested path and timestamp for every request. Paths that carry credentials, such as /edit/*, are redacted in the log.
• Analytics. We run our own, self-hosted Matomo instance, configured to track without cookies and with your IP address anonymised before it is stored. This data never leaves our own server, and no third-party analytics or advertising script runs on any page. Separately from Matomo, we record which page, template or assistant an agenda was created from, together with the campaign parameters in the link that brought you here, the site that link was on, and a two-letter country code. These records hold no IP address, no browser identifier and none of your agenda's contents.
• Accounts. Signing in is optional and goes through Google or Microsoft. We store the provider's name, the stable account id it gives us, your name and email address as the provider reports them, and your avatar URL. No passwords exist anywhere in this system. Authorizing an assistant connector (such as Claude) to act on your account issues it an OAuth access token through our authorization server; disconnecting the connector, or letting the token expire, ends that access.
• Feedback submissions. What you write on the feedback board or send us by email, plus the email address only if you chose to give one, and a one-way keyed hash of the IP address the submission came from, used only to rate-limit abuse — the address itself is never stored.
• Cookies. All of ours are strictly necessary — nothing optional, nothing tracking-related: the per-agenda owner cookie (proves you hold the edit link), the bm_voter cookie (stops one browser voting twice on the feedback board), and Laravel's session and CSRF cookies. The server-side session record behind the session cookie includes your IP address and browser user agent for the session's lifetime.
• Billing. If you subscribe to Plus, we keep your subscription status, current billing period end, the identifiers Stripe gives us for that subscription, and a record of the billing events Stripe notifies us of. Card details are entered on Stripe's own hosted checkout page — BriefMe never sees your card number, only the card's brand and last four digits, which Stripe passes back so you can recognise the card on file.
• Brand logos (Plus). A logo you upload for your agenda pages is stored on Cloudflare R2 and served from a public assets domain. A logo you upload is public by design — anyone with the link to your agenda can load it, the same way they can already see the agenda it brands.

3. Why we process it

We do not rely on consent for any of the processing described on this page — which is also why there is no cookie banner: there is nothing on this site that consent would be the legal basis for. We rely instead on legitimate interest to operate the service, keep it secure, and understand product usage through analytics; and on contract to bill and provide a Plus subscription to the people who buy one.

4. How long we keep it

• An anonymous agenda — one nobody has signed in to claim — is deleted 7 days after it was created, on a schedule, with no manual step and no way to extend it short of signing in and claiming it. Anyone holding its edit link can delete it earlier through a connected assistant (the delete_agenda tool).
• An agenda attached to an account is retained until you delete it through a connected assistant or release it back to anonymous (after which the ordinary 7-day clock applies again).
• OAuth tokens and authorization codes issued to a connected assistant are deleted within about an hour once revoked, and about a week after they expire.
• Web server access logs are kept for 30 days and then rotated out.
• Feedback submissions are kept while open, and for 12 months after the item is closed.
• Billing records are kept for as long as accounting and tax obligations require.
• Matomo's raw visit data is kept for 180 days and purged automatically after that; aggregated reports are retained longer so we can see trends without holding raw request data indefinitely.
• Agenda-creation records (the analytics records above) are kept for as long as we run the product. They are unlinked from your account when you delete it, and from the agenda when the agenda is deleted.

5. Who else sees it

We share data with the infrastructure providers that make the service work, and with nobody else. Those providers are: Hetzner (hosting), Cloudflare (DNS, CDN and proxy, and R2 storage for Plus logo uploads), Stripe (payments), our transactional mail provider, and — only for users who choose to sign in — Google or Microsoft (identity). When you use a connected assistant, such as OpenAI's ChatGPT or Anthropic's Claude, its provider sends tool inputs to BriefMe and receives our tool responses. These responses can include agenda content, share links and, for anonymous agendas, private edit links and tokens. Anyone with a share link can view the agenda; anyone with an edit link can control it. Keep private edit links confidential. If one leaks, you can replace it with a new one from the agenda's owner page or through a connected assistant; the old link then stops working. Your assistant provider handles data under its own terms and privacy policy. BriefMe does not independently call a language model to process your agenda.

6. Where your data lives

Data is stored at rest on servers in Germany. Lignologic Solutions LLC is a United States entity, so personal data is also accessible from the US by the staff who operate the service.

7. Your rights under GDPR

If GDPR applies to you, you have the right to access, correct, erase, restrict or object to our processing of your data, and the right to receive it in a portable format. You also have the right to lodge a complaint with your local data protection supervisory authority. If you have an account, you can download a copy of your account and its agendas from your account settings. In practice, the fastest route for an anonymous agenda is to ask your assistant to delete it (BriefMe's delete_agenda tool, which needs the edit link) or to let it expire; failing that, email us the share token and we will locate and delete it. If your account has a live subscription, it must be canceled before the account itself can be deleted — our billing records are kept linked to an account on purpose, so a subscription in payment cannot be silently orphaned; cancel it from the billing page first and the deletion then proceeds normally.

8. Your rights under CCPA/CPRA

If you are a California resident, you have the right to know what personal information we hold about you, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and to not be discriminated against for exercising any of these rights. We do not sell or share personal information — "sell" and "share" here carry the meaning CCPA gives them, and neither happens: we run no advertising network, no data broker relationship and no third-party analytics or advertising script anywhere on the site. That is also what keeps this sentence true on a free agenda that shows a sponsor screen: the sponsor screen is capped by localStorage on your own device, with no cookie, no ad network, and nothing personalised or shared about you to make it happen.

9. Children

BriefMe is intended for people aged 13 and over, subject to any higher minimum age required by local law. Users under 18 or the age of majority where they live need permission from a parent or legal guardian, as described in our terms. BriefMe is not directed to children under 13. If you believe a child below the applicable minimum age has provided personal data to BriefMe, contact us using the address in section 1 so we can investigate and take appropriate steps to delete it.

10. Changes to this policy

When this policy changes, we update it in place and change the date at the top — we do not keep a separate changelog for legal text. The Last updated date at the top of this page is the record of when it last changed; check back here if you want to know.