Data Processing Agreement

This DPA applies automatically to every paid Brieflee workspace and forms part of the Terms of Service. You do not need to negotiate or return a signed copy for it to bind us. If your procurement process requires a counter-signed document, email privacy@brieflee.ai and we will execute yours.

1. What this covers, and who is who

You are the controller of the personal data in your meetings: you decide which calls Brieflee joins, who attends them and what is discussed. We are the processor, acting on your instructions. Where we handle data about you as our own customer (your billing details, your sign-in records) we are the controller of that, and the Privacy Policy governs it instead.

Terms such as personal data, processing, data subject, controller, processor and supervisory authority carry the meanings given in the UK GDPR and Regulation (EU) 2016/679 ("Data Protection Laws").

2. The processing, described

This is the Annex I description that Article 28(3) requires.

• Subject matter. Providing the Brieflee meeting assistant: joining the calls you nominate, transcribing them, and producing live suggestions, summaries and action items from what is said.
• Duration. For as long as your workspace is active, and then for the deletion periods in section 11.
• Nature and purpose. Recording, transcription, automated analysis and summarisation; storage; and transmission to the tools you connect.
• Types of personal data. Names, email addresses and job titles of attendees; calendar event details; the audio of a meeting and the transcript derived from it; pictures of a screen taken during a meeting, by a user or as slides the recording keeps by itself (which a user can switch off), the text read from them, and a user's notes and marks; voice prints of the speakers in a recording, and short samples of their voices (see Special category data below); anything a participant chooses to say during a call; and the CRM records you direct us to write to.
• Categories of data subject. Your personnel, and the external participants on the calls you record, including people who are not your customers and have no relationship with us.
• Special category data. Not requested and not required, with one exception you control. When a recording's speakers are not named by the meeting platform, we keep a numerical print of each speaker's voice with the meeting so the speakers can be told apart, and a user may save a voice under a name so that person is recognised in their later recordings. A voice print used to recognise a person may be biometric data under Data Protection Laws; you are responsible for a lawful basis, and for informing the people concerned, before a voice is saved. A saved voice is kept until the user forgets it or their account is deleted. A conversation may also contain special category data, because we cannot control what is said in a meeting. We do not process Brieflee as a HIPAA business associate and it must not be used for protected health information.

3. Our instructions come from you

We process personal data only on your documented instructions (this DPA, the Terms, and what you do in the product) except where law requires otherwise, in which case we will tell you first unless that law forbids it. We will tell you if we think an instruction breaches Data Protection Laws. We do not sell personal data and we do not use your meeting content to train models.

4. Confidentiality

Everyone we authorise to process customer data is bound by confidentiality obligations and gets access only where their role requires it. Access is granted by role and recorded; see Annex II.

5. Security measures (Annex II)

These are the measures in place today. Where a measure is partial, this section says so rather than rounding up.

• In transit. TLS on every connection, including the meeting audio stream and the WebSocket that carries live suggestions.
• Passwords. Hashed with bcrypt. Never stored or logged in the clear, and never recoverable by us.
• Two-factor authentication. TOTP, available to every account. Once switched on it is required for password sign-in; federated sign-in (Microsoft, Google, Teams SSO, SAML) relies on the identity provider's own authentication instead. Turning it off needs a current code.
• Brute-force protection. Sign-in attempts are throttled per account and per IP address on a rolling window; codes are throttled separately.
• Third-party credentials. OAuth and CRM tokens are encrypted at rest.
• Tenant isolation. Every query is scoped to the requesting workspace, and access is re-checked on the server for each call rather than trusted from the interface.
• Audit trail. Security-relevant actions are recorded with actor, action, resource, IP address and user agent.
• Raw audio. Deleted server-side promptly once transcription completes. Audio waiting to be transcribed is held encrypted on our servers in the meantime and deleted once the transcript is written, and in any case within 24 hours. What persists is the transcript, not the recording, unless you have asked us to keep recordings.
• Voice prints and samples. Encrypted at rest. A sample of up to ten seconds of each unnamed speaker is kept so the meeting's owner can listen and name them, and is deleted after 30 days; none is kept for a meeting recorded to customer-managed storage. Only the meeting's owner can reach a meeting's voices, and only the user who saved a voice can use it.
• Customer-managed storage. Your workspace can point recordings at its own S3, Azure, GCS or SFTP storage, so media goes between the recorder and your bucket without resting on ours.
• Encryption at rest is partial, and we will not claim otherwise. Credentials and third-party tokens are encrypted. Coverage of stored meeting content is incomplete, and we will set out the current scope precisely in a security review rather than in a public document. If at-rest encryption of meeting content is a requirement for you, customer-managed storage is the answer available today.
• Not yet in place. We hold no SOC 2 report and have not completed an independent penetration test. We would rather you know that than discover it in diligence.

6. Assisting you with data subject rights

If a data subject contacts us directly about your data, we will not respond substantively; we will refer them to you and tell you promptly. Account holders can export and permanently erase their own data from Settings, and we will help you answer access, rectification, erasure, portability, restriction and objection requests that need our involvement, at no charge for a reasonable volume.

7. Sub-processors

You give general authorisation for us to engage sub-processors. The current list is published at brieflee.ai/subprocessors, and it is specific rather than a category description, so you can assess each one.

Before a new sub-processor begins handling customer data we will publish the change on that page and email workspace owners. If you object on reasonable data protection grounds within 30 days, we will try to offer an alternative; where we cannot, you may terminate the affected subscription and receive a pro-rata refund of the unused term. Each sub-processor is bound by written terms no less protective than these, and we remain liable to you for their performance.

8. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data. The notice will describe what happened, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we will send it in phases rather than wait.

9. International transfers, stated plainly

Customer data rests in the European Economic Area: the application servers, the database and the stored media are hosted in Frankfurt, Germany. The transfers that leave the EEA are specific, and these are all of them:

Meeting audio is transcribed on RunPod GPU servers running our own speech-to-text, in EU data centres (Sweden, the Netherlands, Iceland and Romania), in Montreal, Canada, or in data centres in the United States, whichever has a free server. Canada is the subject of a European Commission adequacy decision, which is the basis for that transfer; the transfer to the United States is made under the EU Standard Contractual Clauses in RunPod's DPA. RunPod, Inc. is incorporated in the United States; its access to the audio is limited to operating those servers.

The same transcription runs on Modal as RunPod's backup, and takes a meeting only when RunPod refuses the work or has no server free for it. Its containers are pinned to Modal's data centres in the European Economic Area and the United States and run nowhere else; the transfer to the United States is made under the EU Standard Contractual Clauses in Modal's DPA. Modal Labs, Inc. is incorporated in the United States; its access to the audio is limited to operating those servers.

• DeepSeek (China): meeting transcripts and the notes generated from them, for summarisation and live suggestions.
• Stripe and Resend (United States): billing and email data. No meeting content.

The China transfer deserves your attention and we are not going to bury it in a schedule. China is not the subject of a European Commission adequacy decision. The transfer is made under Standard Contractual Clauses with supplementary technical and organisational measures, and it is a restricted transfer that your own transfer impact assessment will need to address. It is inherent to how the product works today: customer-managed storage changes where transcripts rest, but the model still reads them.

If your organisation cannot accept a transfer to China, tell us before you buy. We would rather lose the deal than have you discover this after signing.

10. Audits and information

We will give you the information you reasonably need to demonstrate compliance with Article 28, including answering security questionnaires. Where that is not enough, you may audit us, or appoint an independent auditor who is not our competitor, on 30 days' notice, no more than once a year unless a breach or a supervisory authority requires otherwise, during business hours, and without disrupting the service or exposing another customer's data.

11. Return and deletion

You can delete meetings, and entire accounts, from within the product at any time; deletion removes the stored media as well as the record.

If you connect storage of your own, you can also instruct us to leave a deleted meeting's files there, for example where your own record-keeping policy requires it. A workspace owner or admin gives that instruction in Settings → Storage, and it is off unless you turn it on. With it on, a meeting deleted by any of your users, or with their account, is removed from Brieflee together with every copy we hold, while its files in your storage remain there under your control and your retention policy; we keep no copy and no longer process them. Storage an individual user has connected for their own meetings is not affected.

On termination we delete customer personal data within 30 days, except where law requires us to keep it, and except for routine backups, which age out on their normal cycle and are not restored into live use. Ask before that window closes and we will export your data first.

12. Liability and precedence

This DPA is subject to the limitations of liability in the Terms of Service. Where this DPA and the Terms conflict on the processing of personal data, this DPA governs. Where this DPA conflicts with the Standard Contractual Clauses, the Clauses govern.

13. Changes to this DPA

We may update this DPA where the law, our sub-processors or the product change. Material changes that reduce your protections will be notified to workspace owners at least 30 days before they take effect, and the "Last updated" date above always reflects the current version.

14. Contact

Data protection questions, counter-signature requests and audit requests: privacy@brieflee.ai. Suspected vulnerabilities and breach queries go to security@brieflee.ai, which is monitored separately, because a disclosure should not queue behind a contract review. Brieflee is operated by Xtreme IT Services.