GDPR and Data Privacy

EU data residency

All data is processed exclusively in the EU.

• Application servers: Hetzner Online GmbH, Nuremberg and Falkenstein, Germany
• File storage: Cloudflare R2 with EU jurisdiction policy — files are stored only in EU-region buckets
• No data leaves the EU under any circumstances related to storage or primary processing

What we store

Client IP addresses collected during portal access are stored in a separate table with more restrictive access controls and are used only for deduplication and fraud signals. They are hashed before being included in webhook payloads.

Data retention

• Default: 90 days after intake.completed, then automatic purge of all files and submitted values
• Configurable per account: PATCH /v1/account {"retention_days": N} — valid range is 1 to 3650 days
• Configurable per intake: the retention object on define_intake (below)
• Immediate deletion: DELETE /v1/intakes/:id — removes the intake, all submitted values, all R2 files, and chase history immediately and irreversibly
• Account deletion: removes all intakes, files, and personal data within 30 days of the request

Delete as soon as the agent has the files

Ninety days is a long time to keep a client's photos and admin password after your agent already downloaded them. If an intake holds anything sensitive, set retention to on_delivery:

{
  "project_name": "Web pro Kramolišová Finance",
  "client": { "email": "klient@firma.cz" },
  "retention": { "mode": "on_delivery" },   // + optional "anonymize": false
  "items": [ /* … */ ]
}

The contents are then removed roughly 24 hours after get_intake_results returns a completed intake — the point at which you have the files and a second copy on our server is liability rather than service.

Two guarantees worth knowing:

• An intake you never collect still expires. purge_at is set the moment the client completes, from the day count. Delivery only ever brings that date forward, so on_delivery can never turn into "kept forever" on a project you abandoned.
• There is a grace window (24h by default, DELIVERY_GRACE_HOURS when self-hosting). If your agent crashed between reading the response and writing the files to disk, you can ask again. Without it, one crash would mean asking the client to do the work twice.

What anonymize: true actually removes

What remains is the record you need — "I asked for 7 things on 15 July, all delivered by the 20th" — holding nothing of your client's. Set anonymize: false if you want even that gone.

Subject rights

Under GDPR, your clients (as data subjects) have rights over their personal data. As the data controller, it is your responsibility to honor these requests. BriefGate provides the following API support:

Right to access: GET /v1/audit?client_email=owner@bellacucina.cz returns all interaction records tied to that email address across your account.

Right to erasure: DELETE /v1/intakes/:id removes all data for a specific intake. For complete erasure of a client across all intakes, filter by client_email and delete each intake. Contact support for bulk erasure.

Right to portability: Submitted data is available via GET /v1/intakes/:id/results as structured JSON and signed file URLs. Export as needed before the retention period expires.

BriefGate does not provide a separate "export my data" endpoint for end clients (your clients). Providing data subject access is your responsibility as data controller.

Data controller and processor relationship

A Data Processing Agreement (DPA) template is available for download in your account settings. You should sign this before processing EU personal data on behalf of clients. The DPA documents:

• Categories of data processed
• Processing purposes
• Security measures
• Sub-processor list
• Data subject rights procedures

Subprocessors

SCCs (Standard Contractual Clauses) per EU Commission Decision 2021/914 apply to all US-based subprocessors. The full list is updated in account settings when changes occur.

Security measures

Penetration testing is performed annually by an independent third party. Results are available under NDA on request.