Data Processing Agreement. Plainly.

The capitalised terms below carry the meanings set out in the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the Australian Privacy Act 1988 (Cth) ("Privacy Act"), as applicable:

• Customer Data means personal data relating to identified or identifiable natural persons that Briefi processes on Customer's behalf in providing the service — including meeting metadata, contacts, deal records, email threads, AI-generated briefs and drafts, recording transcripts, captions, and notetaker payloads.
• Data Subject means an identified or identifiable natural person to whom Customer Data relates — typically the Customer's team members, prospects, clients, vendors, and anyone whose details appear in calendar invites or email threads they connect to Briefi.
• Sub-processor means any third-party processor engaged by Briefi to process Customer Data.
• Standard Contractual Clauses ("SCCs") means the EU Commission Implementing Decision (EU) 2021/914 module 2 (controller-to-processor) clauses, plus the UK Addendum issued by the Information Commissioner.

For Customer Data, Customer is the data controller (or, in many engagements, an independent controller acting on behalf of its own employees and clients). Briefi is the processor and processes Customer Data only on Customer's documented instructions, which are set out in the Terms of Service, this DPA, and any in-product action you take (connecting a Google account, enabling a CRM, starting a recording, sending an API request through your key).

This DPA applies for the duration of the Terms of Service and survives termination to the extent Briefi retains Customer Data, until that data has been deleted or returned in line with section 12.

• Subject matter: processing required to operate Briefi for Customer — calendar + inbox sync, AI-assisted brief / draft / classification, meeting recording + transcription, CRM push, billing, support.
• Duration: for as long as Customer holds an active Briefi account, plus the post-termination retention windows set out in section 12 and the Privacy Policy.
• Nature: automated and (for support purposes) limited manual processing — collection, storage, organisation, retrieval, transmission to authorised third parties, and erasure.
• Purpose: delivery of the contracted service, billing for it, security and abuse prevention, and statutory obligations (audit logs, NDB compliance, tax records).

Categories of Data Subjects: Customer's personnel (workspace owner, admins, members, viewers); meeting attendees (whether external prospects, clients, suppliers, or internal); senders and recipients of email threads Customer chooses to expose to Briefi; anyone identified in transcripts, recordings, captions, notetaker payloads, or scheduling form responses.

Categories of Personal Data: name, email, phone, role, employer, calendar events (titles, attendees, locations, descriptions), email thread metadata (subject, snippet, participants, timestamps), AI-generated briefs / follow-ups / classifications, voice recordings, transcripts, captions, notetaker summaries, scheduling form responses, contact and deal records, billing identifiers (Stripe customer + subscription ids).

Special Category Data: Briefi is not designed to process special category data (health, biometric, sexual orientation, religion, ethnicity, criminal records, etc.). To the extent such data appears incidentally in transcripts or email threads (for example, a clinic running a healthcare discovery guide whose patient mentions a condition), Customer is responsible for the lawful basis for processing it and for any equivalent special-category obligations under the Privacy Act and APP 3.3.

Briefi will:

• Process Customer Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by Australian, EU, UK or other applicable law (in which case Briefi will inform Customer of that legal requirement before processing, unless prohibited).
• Ensure that personnel authorised to process Customer Data are bound by written confidentiality obligations.
• Implement and maintain the technical and organisational measures set out in the Schedule below ("Security Measures"), and not materially diminish them during the term.
• Engage Sub-processors only in line with section 6.
• Assist Customer, where reasonably possible, in responding to requests from Data Subjects exercising their rights under section 9.
• Assist Customer in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation), and the equivalent NDB scheme obligations under the Privacy Act.
• At Customer's choice on termination, delete or return all Customer Data in line with section 12.
• Make available to Customer the information necessary to demonstrate compliance with this DPA, including by responding to written audit requests in line with section 11.
• Promptly notify Customer if it considers an instruction infringes the Privacy Act, GDPR, or other applicable data protection law.

Customer authorises Briefi to engage Sub-processors to provide the service. The current list, with purpose, region, and the link to each sub-processor's own protections, is published at /security and updated whenever a vendor is added or removed.

Briefi will impose contractual obligations on each Sub-processor that are no less protective than this DPA, including the SCCs where data is transferred outside the EEA / UK / Australia. Briefi remains liable for the acts and omissions of its Sub-processors as if performed by Briefi itself.

Briefi will give Customer at least 30 days written notice of any new or replacement Sub-processor that handles Customer Data, by email to the workspace owner. Customer may object to a new Sub-processor on reasonable, data-protection grounds within that window. If Customer objects and Briefi cannot in good faith offer a non-material workaround, Customer may terminate the workspace's affected service with a pro-rata refund of unused fees.

Customer Data is hosted primarily in Australia (Supabase Postgres + Storage, Vercel edge in syd1 by default). Some Sub-processors operate in the United States (Anthropic, AssemblyAI, Deepgram, Resend, Stripe, the optional notetaker providers Fireflies / Fathom / Read.ai / Grain) and the European Union (Sentry, PostHog).

Where Customer Data is transferred from the EEA, UK or Switzerland to a third country, the SCCs (Module 2) and the UK Addendum apply automatically and are deemed incorporated into this DPA, including the relevant Annexes (description of processing, technical measures, list of sub-processors). Briefi acts as the data exporter for transfers between sub-processors and as data importer for transfers received from Customer.

Where Customer Data is disclosed to overseas recipients within the meaning of APP 8 (Australian Privacy Principle 8), Briefi takes reasonable steps to ensure overseas recipients do not breach the APPs and confirms each recipient is bound by binding obligations no less protective than the APPs.

Briefi maintains the following Security Measures, which form part of this DPA as the Schedule referenced in section 5:

• Encryption in transit: TLS 1.3 with HSTS preload on every endpoint.
• Encryption at rest: AES-256-GCM for sensitive content (briefs, follow-up drafts, AI replies, OAuth tokens, IMAP / SMTP credentials, CRM API keys, recording transcripts, live captions, notetaker payloads). Each workspace has its own data encryption key, wrapped by a global key-encryption key held in environment variables and never sent to the browser.
• Access control: Postgres row-level security gates every read and write at the database engine. Service-role admin clients bypass RLS only inside server-side endpoints that explicitly enforce membership and role; the browser never holds service-role credentials.
• Authentication: bcrypt-hashed passwords, optional TOTP MFA, signed-token invite links, per-tenant API keys (bcrypt-hashed at rest).
• Network: serverless functions on Vercel with a strict Content-Security-Policy, X-Frame-Options DENY, Permissions-Policy locking down camera / geolocation / interest-cohort, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin.
• Monitoring: Sentry for application errors with no PII attached; PostHog for anonymised product analytics; an internal audit-log table for sensitive operations retained for 13 months.
• Personnel: minimum-necessary access (least privilege), background-checked subcontractors, written confidentiality agreements, password manager and SSO across operational accounts.
• Sub-processor due diligence: documented before onboarding (data residency, certifications such as SOC 2 / ISO 27001 / IRAP where applicable, sub-processor list, breach response time).
• Backup + recovery: Supabase point-in-time recovery for the Postgres primary, daily logical backups, and infrastructure-as-code recovery for Vercel. Backups are encrypted with the same KMS posture as live data.
• Vulnerability management: npm audit + Dependabot equivalents on every push, Sentry alerts for unhandled errors, manual review of runtime logs.
• Penetration testing: independent third-party penetration test scheduled annually starting 12 months from public launch (currently planned for May 2027).

Briefi will keep Customer reasonably informed of changes to these measures via the /security page.

Briefi will, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as possible, to fulfil Customer's obligation to respond to requests from Data Subjects exercising their rights of access, rectification, erasure, restriction of processing, data portability, and objection.

Customer can exercise most of these rights directly inside Briefi: every record is editable in product, Settings → Data & Export ships a JSON + CSV bundle on demand, and account deletion (Settings → Data & Export → Delete account) starts a 30-day grace window after which Customer Data is permanently removed.

If a Data Subject contacts Briefi directly with a rights request, Briefi will, unless legally required to act otherwise, redirect them to the responsible Customer and inform Customer at the email on file for the affected workspace.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data.

Briefi will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notification will include, to the extent then known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.

Where Australian law applies and the breach is an "eligible data breach" under Part IIIC of the Privacy Act, Briefi will support Customer's NDB obligations and, where Briefi is responsible for the assessment, will notify the OAIC within 30 days as required.

Briefi will maintain records of processing activities (Article 30 GDPR / equivalent) and, on reasonable written request from Customer (no more than once per twelve-month period unless a Personal Data Breach has occurred), provide Customer with the information necessary to demonstrate compliance with this DPA. Where a written response is insufficient, Briefi and Customer will agree in good faith on a remote audit by an independent third-party auditor bound by confidentiality obligations.

On-site audits are not contemplated for the standard service. Customer must give at least 30 days written notice for any audit, audits must occur during business hours, and Customer bears the auditor's reasonable costs unless the audit reveals a material breach by Briefi, in which case Briefi bears them.

On termination of the Terms of Service or this DPA, Customer may, within 30 days, request a full export of Customer Data (Settings → Data & Export). After that 30-day window, Briefi will permanently delete or de-identify Customer Data from production systems within a further 30 days, subject to:

• Backups, which are overwritten on the standard rotation cycle (90 days for logical backups; PITR retention follows Supabase's plan).
• Audit logs, which are retained for 13 months under section 8.
• Stripe billing records, which are retained for 7 years under Australian Tax Office requirements.
• Any retention required by law, anti-fraud purposes, or to defend or pursue legal claims, in which case Briefi will continue to protect the data under this DPA until that purpose is satisfied.

The liability of each party under or in connection with this DPA is governed by the limitation of liability clause in the Terms of Service. Nothing in this DPA limits or excludes liability for: fraud or wilful misconduct; gross negligence; breaches of confidentiality or intellectual property obligations; or liability that cannot be limited under applicable law.

In the event of a conflict between (i) the SCCs, (ii) this DPA, and (iii) the Terms of Service, the order of precedence is (i) > (ii) > (iii) for matters of personal data processing, and the Terms of Service prevail for everything else. This DPA is governed by the laws of New South Wales, Australia, except where the SCCs or local law require a different governing law for matters of personal data, in which case those rules prevail.

To raise any matter under this DPA, write to privacy@briefi.sh. We respond inside 5 business days. By creating or maintaining a Briefi workspace after the effective date at the top of this page, Customer accepts this DPA as it then reads, in line with the change-management process in the Privacy Policy. Customers requiring a counter-signed copy can request one at the address above.