Legal
Sub-processors
Every third party that can reach customer data, what it does, and where it sits. Changes are announced here before they take effect.
These are every third party that can reach customer data in the course of running Brieflee, what each one does, and where it sits. The list is part of the Data Processing Agreement: under section 7 we tell customers before a new sub-processor starts handling their data, and a customer who objects may terminate.
Tools you connect yourself (your CRM, your task list, your own storage bucket) are not sub-processors of ours. You direct data to them, and your agreement with them governs it.
Current sub-processors
| Sub-processor | What it does | Data it can reach | Where |
|---|---|---|---|
| Hostinger International | Cloud infrastructure. The servers the service itself runs on. | All service data, including transcripts and summaries not offloaded to customer storage. | Germany (Frankfurt), inside the EEA |
| Cloudflare | DNS, TLS termination, content delivery, and bot protection. Its bot detection runs a small script in your browser on each page load. | Request metadata, static assets, and the browser signals its bot detection collects. No meeting content, and no profile of you. | Global edge network |
| Google Analytics | Website and product analytics, for visitors who accept Analytics in the cookie banner and for nobody else. It tells us which pages are opened and which features are used. | Page addresses with the search terms dropped and every identifier replaced, device and browser type, approximate location from the IP address, and Google Analytics’ own cookie identifiers. No meeting content, no transcripts, no meeting, client or project names. | United States and Google’s global network |
| OpenAI (advertising) | Measuring the adverts we buy inside ChatGPT, for visitors to our public and sign-in pages and to briefleeone.com unless they switch Advertising off in the cookie settings (in the EU, the EEA, the UK and Switzerland only for visitors who accept it). It tells us that an advert led to somebody leaving their details, creating an account, buying a plan, joining the Brieflee One waitlist or buying from the Brieflee One shop. | The address of our public and sign-in pages without its search terms and of the Brieflee One shop, the pages viewed, the name of the step reached (a sign-up, details left in the website chat, a waitlist entry, or a paid order with its amount and items), an id for that one step, a one-way hash of the email address of an account created with an email address and password (never the address), a plan bought with Advertising on by an account a ChatGPT advert brought (the plan and its amount), a one-way hash of an email address or phone number typed into our sign-up and sign-in forms (OpenAI's automatic advanced matching), OpenAI's click reference from its advert, and OpenAI's own advertising identifiers. No meeting content, no transcripts, no meeting, client or project names, and nothing from inside the app. | United States |
| Google (advertising) | Measuring the adverts we buy on Google, and remarketing (showing our adverts again to people who have visited), for visitors to our public and sign-in pages on brieflee.ai unless they switch Advertising off in the cookie settings. In the EU, the EEA, the UK and Switzerland only for visitors who accept it; until they answer, the tag runs with every consent setting off and Google uses what it receives only to estimate. It tells us that an advert led to somebody creating an account, buying a plan, connecting a calendar or having a report of a third meeting. | The address of our public and sign-in pages without its search terms, that an account was created and an id for that one sign-up, a one-way hash of the email address of an account created with an email address and password (never the address), a plan bought with Advertising on by such an account that came from a Google advert (its amount and that hash), and for the same accounts that a calendar was first connected and that a third meeting had a report (that hash and no amount), Google's click reference from its advert, and Google's own advertising identifiers. No meeting content, no transcripts, no calendar entries, no meeting, client or project names, and nothing else from inside the app. | United States and Google’s global network |
| RunPod | GPU servers that run Brieflee's own speech-to-text (Whisper). Meeting audio is sent for transcription; the transcript comes back to us, and the audio is not kept on the server after the job. | Meeting audio only. | EU data centres (Sweden, the Netherlands, Iceland and Romania), inside the EEA; Montreal, Canada, which has an EU adequacy decision; and data centres in the United States, under the EU Standard Contractual Clauses in RunPod's DPA. RunPod, Inc. is a company incorporated in the United States. |
| Modal | The same GPU transcription as RunPod, as its backup: a meeting's audio goes here only when RunPod refuses the work or has no server free for it. The transcript comes back to us, and the audio is not kept after the job. | Meeting audio only. | Modal's data centres in the European Economic Area or in the United States, and nowhere else (the worker is pinned to those two regions); the transfer to the United States is made under the EU Standard Contractual Clauses in Modal's DPA. Modal Labs, Inc. is a company incorporated in the United States. |
| DeepSeek | The language model behind live suggestions, post-call summaries, and the chat assistant on this website. | Meeting transcripts and the notes generated from them, and messages sent to the chat assistant on this website. | China. No adequacy decision; see section 9 of the DPA. |
| Stripe | Payment processing for plans, credits and Brieflee One orders. | Billing contact, delivery address and payment details. No meeting content. | United States / EU |
| Resend | Transactional email: sign-in codes, resets, notifications. | Email address and the contents of those messages. No meeting content. | United States |
International transfers
Meeting transcripts are sent to DeepSeek, in China, to produce summaries and suggestions. China has no European Commission adequacy decision, so this is a restricted transfer made under Standard Contractual Clauses with supplementary measures rather than on the basis of adequacy.
Customer-managed storage changes where transcripts rest; it does not change which model reads them. Section 9 of the DPA sets out the transfer mechanism, the safeguards and your options in full, and we are glad to discuss it before you buy: privacy@brieflee.ai.
Notice of changes
This page is the notice. Before a new sub-processor begins handling customer data we publish the change here and email workspace owners, so there is time to object under section 7 of the DPA. Email privacy@brieflee.ai to be added to that notice list explicitly.