Privacy Policy

This policy explains what personal information ZKN Consulting LLC (“we”, “us”, “our”), an Iowa, USA limited liability company, collects when you use the Briefworth website and app, how we use it, who we share it with, and the choices you have. We are the data controller for the personal information described here.

Information we collect

Information you give us

• Early-access signups: your name and email address.
• Account details: your name, email address, password (stored in hashed form, never in plain text), business name, logo, and brand colors. On the Agency plan, also the names and email addresses of team members you invite.
• Your content: the briefs, notes, rate cards, templates, and proposals you create. Briefs may include information about your clients, such as names and contact details, if you choose to include it.
• Messages: emails and support requests you send us.

Billing information

When you subscribe to a paid plan, Stripe collects your card details and billing address directly. We never see or store your full card number. Stripe shares limited information with us: your name, email, billing country and postal code, card brand, the last four digits of your card, its expiry date, and your payment history.

Information collected automatically

• Technical data: IP address, browser and device type, pages visited, timestamps, and error logs, recorded by our servers when you use the website or app.
• Cookies: the app uses only essential cookies, which keep you signed in and protect your session. This website doesn’t use advertising or analytics cookies. If we add analytics, we’ll update this policy first.

How we use your information

For people in the European Economic Area, the UK, and Switzerland, we list the legal basis for each use in brackets.

• To provide the Service: create your account, process your briefs, generate and store proposals, make PDFs, and host share links. (Performance of our contract with you.)
• To process payments and manage your subscription, and to keep tax and accounting records. (Contract; legal obligation.)
• To send service emails, such as receipts, security alerts, and notices about changes to our terms. (Contract; legitimate interests.)
• To send early-access and product update emails. You can unsubscribe anytime using the link in any email or by contacting us. (Consent.)
• To answer your questions and support requests. (Contract; legitimate interests.)
• To keep the Service secure, prevent fraud and abuse, and fix errors. (Legitimate interests.)
• To improve the Service using aggregated usage information, such as which features are used most. We don’t use the content of your briefs or proposals to train AI models. (Legitimate interests.)
• To comply with the law and respond to lawful requests. (Legal obligation.)

How AI processes your content

• When you paste a brief or ask Briefworth to draft or revise a proposal, we send the relevant text, such as the brief, your rate card item names, and the draft, to our AI model provider to produce the result.
• Our AI model provider is currently Anthropic, PBC, through the Claude API. If we add other AI model providers, we’ll update the list in How we share information before we use them.
• We use AI providers under commercial terms that don’t allow them to train their models on your content. They may keep it for a limited time to run their service and detect misuse, as described in their own terms.
• AI output is a draft for you to review. We don’t use it to make decisions about you that have legal or similarly significant effects.
• Please don’t paste sensitive information into briefs, such as health details, bank account numbers, or government ID numbers. Briefworth doesn’t need it.

How we share information

We don’t sell your personal information, and we don’t share it for cross-context behavioral advertising. We share it only in these cases:

Service providers (subprocessors)

These companies process personal information on our behalf, under contracts that limit how they can use it:

• Stripe, Inc.: payment processing, subscription billing, and fraud prevention. See Stripe’s Privacy Policy.
• Anthropic, PBC: AI model provider (Claude API). Processes the text of briefs and drafts to produce results. See Anthropic’s Privacy Policy.
• Hostinger International Ltd.: hosts this website and stores early-access signups (name and email). See their Privacy Policy.
• Cloud infrastructure and email providers that host the Briefworth app, store its data, and send account emails for us.

Other cases

• People you share with. Anyone with a proposal’s share link can view that proposal. On the Agency plan, your team members can see your shared workspace.
• Legal reasons. When we need to comply with the law or a lawful request, or to protect the rights, property, or safety of our users, the public, or us.
• Business transfers. If our business is merged, acquired, or sold, your information may transfer to the new owner, who must keep protecting it as this policy describes. We’ll tell you before that happens.

International transfers

We’re based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the European Economic Area, the UK, or Switzerland, we rely on recognized safeguards, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where needed) or the EU-U.S. Data Privacy Framework when the recipient is certified under it.

How long we keep information

• Your account and content: for as long as your account is open.
• When you delete your account, from your settings or by emailing us, we delete your account, your content, and the personal information linked to it within 30 days.
• Records we must keep: invoices and payment records are kept for as long as tax and accounting laws require, by us and by Stripe. We may also keep limited information needed to resolve disputes or prevent fraud.
• Early-access list: until you unsubscribe or ask us to remove you. We delete your details within 30 days of your request.
• Technical logs: up to 30 days, unless we need them longer to investigate a security issue.

Security

We encrypt data in transit with HTTPS, store passwords in hashed form, limit who on our side can access personal information, and leave card handling to Stripe, which is certified to PCI DSS Level 1. No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the authorities as the law requires.

Your rights

Everyone

Wherever you live, you can ask us to show you, correct, export, or delete your personal information, and you can unsubscribe from non-essential emails at any time.

EEA, UK, and Switzerland (GDPR)

You have the right to:

• access your personal information and get a copy of it;
• correct information that’s wrong or incomplete;
• have your information erased;
• restrict how we process it;
• receive it in a portable, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, where we rely on consent;
• complain to your local data protection authority.

California (CCPA / CPRA)

If you live in California, you have the right to:

• know what personal information we collect, use, and disclose, and get a copy of it;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information (we don’t sell or share it);
• limit the use of sensitive personal information (we don’t use it for any purpose that triggers this right);
• not be discriminated against for exercising these rights.

In the past 12 months we have collected these categories of personal information: identifiers (such as name, email, and IP address); commercial information (such as your plan and payment history); internet activity (such as logs of how you use the Service); professional information (such as your business name); and the content you provide. We collect it from you, from your device, and from Stripe, for the purposes described in How we use your information, and we disclose it only to the service providers listed in How we share information. We have not sold or shared personal information.

How to make a request

Email hello@briefworth.com with “Privacy request” in the subject line, from the email address on your account if you have one. We’ll verify your identity and respond within 30 days. If we need more time where the law allows it, we’ll tell you why. Requests are free. You can also use an authorized agent, who must show us your written permission.

Age requirement

Briefworth is only for people aged 18 and over. We don’t knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us their information, contact us and we’ll delete it.

Information about your clients

If your briefs include personal information about your clients or other people, you’re responsible for having a lawful basis to share it with us and for telling them where needed. For that information we act as your service provider (a “processor” under the GDPR) and use it only to provide Briefworth to you. If you need a data processing agreement, email us.

Changes to this policy

We may update this policy. If a change is significant, we’ll tell you by email or in the app before it takes effect. The date at the top of this page shows when it last changed.

Contact

Questions about privacy, or want to make a request? Contact us:

ZKN Consulting LLC
Email: hello@briefworth.com