Privacy Policy

1. Who We Are (Data Controller)

For the purposes of the Brazilian General Data Protection Law (Lei nº 13.709/2018 — LGPD) and other applicable data-protection laws, the Data Controller of your Personal Data is:

For any questions about how we process your Personal Data, or to exercise your rights, use the contact above or the DPO channel described in Section 14.

2. Scope

This Privacy Policy applies to the BriefPanel website, applications, APIs, MCP server, and related services we control (the "Service"). It does not apply to third-party websites, services, or content — including the web pages you choose to monitor — which have their own policies.

3. Data We Collect

(a) Data You Provide

• Account and contact data: such as your email address and, where provided, your name and country, when you:
  • Create an account, sign in, or verify your email — including by signing in with your Google account (in which case we receive your name and email address from Google).
  • Contact us by email, social media, or support channels.
  • Subscribe to marketing communications or participate in promotions and surveys.
• Billing data: purchase history, credit balance, and transaction identifiers. Payment-card data is processed directly by our payment provider; we do not store full card numbers.
• Monitoring configuration: the URLs you add (Sources), monitoring preferences, custom instructions/prompts, language, and notification settings.

We request only the minimum Personal Data necessary for the purpose of each interaction.

(b) Data Collected Automatically

• Log and usage data: IP address, browser type and version, pages visited, dates and times, time on page, and product events (for example: source added, credits purchased) used for security, analytics, and product improvement.
• Cookies and similar technologies: we use cookies and similar technologies for authentication, preferences, analytics, and attribution (for example, advertising click identifiers such as gclid). Where required, we obtain your consent for non-essential cookies.

(c) Content Captured at Your Instruction

To operate the Service, we fetch and store, at your instruction, content from the pages you monitor: captures (markdown/text, and where applicable HTML and screenshots), diffs, extracted entries, AI-generated summaries, and related technical metadata. This content belongs to third parties, may incidentally contain personal data published on those pages, and is processed solely to provide the Service to you.

4. Legal Bases (LGPD art. 7)

We process Personal Data only where a legal basis applies, including:

5. How We Use Data

We use the data described above to:

• Provide and operate the Service: authenticate you, monitor your Sources, generate histories, diffs and AI summaries, deliver notifications, webhooks and API/MCP responses, and provide support.
• Communicate with you: respond to inquiries and send service, security, and transactional notices (for example, changes to these policies).
• Process billing: manage credits, purchases, receipts, fraud prevention, and accounting/tax obligations.
• Analyze and improve: understand usage, measure performance, debug, and improve the Service, using aggregated or de-identified data where possible.
• Marketing (with consent or another valid basis): send promotional communications and measure advertising effectiveness; you can opt out at any time.

We do not sell your Personal Data, and we do not use your content to train our own AI models.

6. Sharing and Subprocessors

We share Personal Data only as needed to operate the Service, with providers acting as operators/subprocessors under contract, including, as applicable:

• Cloud hosting and database: Convex and Google Cloud (storage, compute, AI inference infrastructure).
• Payment processing: Stripe.
• Transactional email and notifications: Resend.
• Product analytics and attribution: PostHog and Google Ads (which may receive hashed email for conversion measurement, per their terms).
• AI processing: OpenRouter and the model providers routed through it (for extraction, classification, and summarization of monitored content and your instructions).
• Web fetching/crawling infrastructure used to capture monitored pages.

We may also disclose data when required by law, court order, or competent authority; to protect our rights, users, or third parties; and in the context of a merger, acquisition, or asset sale, subject to this Policy.

7. International Data Transfers

Some of our providers are located outside Brazil (for example, in the United States), so your Personal Data may be transferred internationally. We carry out such transfers in accordance with the LGPD (arts. 33–36), using contractual safeguards and engaging providers committed to data-protection standards compatible with the LGPD.

8. Retention and Deletion

We keep Personal Data only for as long as necessary for the purposes described in this Policy or as required by law:

• Account data: while your account is active and, after deletion, only as required for legal obligations (for example, fiscal records) and statutory limitation periods.
• Monitored content, snapshots, diffs, and history: retained for limited periods (currently up to 14 days on free usage and up to 90 days with credits) and then deleted, unless you request earlier deletion.
• Application access logs: kept for at least 6 months, as required by the Marco Civil da Internet.
• Marketing data: until you withdraw consent or opt out.

You may request deletion of your account and Personal Data at any time (Section 9). Deletion is performed within a reasonable period, subject to legal retention duties and backup cycles.

9. Your Rights (LGPD art. 18)

As a data subject under the LGPD, you have the right to:

• Confirmation and access: confirm whether we process your Personal Data and obtain a copy.
• Correction: correct incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion: request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD.
• Portability: receive your data in a structured format or request its transfer to another provider, as regulated.
• Information about sharing: know the public and private entities with which we share your data.
• Opposition: object to processing based on legitimate interest or for direct marketing.
• Withdrawal of consent: withdraw consent at any time, without affecting prior lawful processing, and request deletion of consent-based data.
• Review of automated decisions: request review of decisions made solely on automated processing that affect your interests.

To exercise any right, contact us at the address in Section 14. You also have the right to lodge a complaint with the Brazilian data-protection authority (ANPD).

10. Security

We adopt technical and organizational measures appropriate to protect Personal Data against unauthorized access, loss, alteration, disclosure, or destruction — including encryption in transit, hashed credentials and API keys, and access controls. No method of transmission or storage is absolutely secure; if you suspect any incident affecting your account, notify us immediately.

11. Incident Notification

In the event of a security incident that may create relevant risk or harm to data subjects, we will notify the ANPD and affected data subjects within a reasonable period, as required by the LGPD (art. 48).

12. Minors

The Service is directed at businesses and professional users and is not intended for persons under 18. We do not knowingly process Personal Data of minors; if we become aware of such processing, we will delete the data.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated with reasonable advance notice (for example, by email or a prominent notice in the Service), indicating the effective date. Where required by law, we will request a new consent.

14. Contact and DPO Channel

For questions, requests, or complaints about this Policy or the processing of your Personal Data — including exercising your LGPD rights — contact our data-protection channel: