What we keep, and what we don’t.

Who is responsible

HereBriefly, Copenhagen, Denmark, is the data controller for everything described on this page. Write to hello@herebriefly.com with any question about your data. There is no data protection officer, because the law does not require one at our size, and the same address reaches the person who can act.

Creating a brief

You do not need an account. While you answer questions, the draft is kept in your own browser and nowhere else. If you choose “Save and finish later”, the draft is stored on our servers under a random resume key for 14 days, then deleted. The draft holds your answers and nothing about you unless you typed it into an answer.

This is done to provide the service you asked for (GDPR article 6(1)(b)).

Sending a brief

When you send, the brief is stored on our servers under an unguessable address so the link works for the person you send it to. It holds your answers, the project name, the name you type as the sender, and the specifications derived from your answers. If you give your email address, it is used to tell you when the brief is opened, flagged, questioned, replied to, revised or accepted, and for nothing else. If you email the brief from the sent screen, the receiver’s address is stored with the brief so the email can be sent and so you can see that it was.

A free brief is kept for 30 days from sending. If it is accepted within that time it is kept, so both sides can point at it later. If it is not, the link stops working and the brief is deleted from our database 60 days after that, which leaves room for the one free restoration described in the terms. Briefs sent through a paid studio’s intake link, or by a signed-in studio, do not expire while the studio keeps its records; they are deleted when the studio asks, or when the studio account is deleted.

This is done to provide the service you asked for (article 6(1)(b)). Keeping accepted briefs so that both sides have a record is in our legitimate interest and yours (article 6(1)(f)).

Reading a brief

Anyone with the link can read a brief. A receiver who flags a line, asks a question, replies or accepts gives a name, and only a name; it is shown beside what they wrote and stored with the brief. The time the brief was first opened, and the time it was accepted, are recorded with it. We also record, once per brief and with no identity attached, that the link was copied and that a receiver clicked through to the page for studios.

This is done to provide the service (article 6(1)(b)) and, for the two counts, in our legitimate interest in knowing whether the product works (article 6(1)(f)).

Studio accounts

Studios sign in with an email address; there is no password. A link is sent to the address, and opening it creates a session. We store the address, the studio’s name, its intake link, its branding, its custom questions, the email addresses it has given seats to, and the plan it is on. When a studio pays, we keep the customer and subscription identifiers Stripe gives us; card details never reach us. This is done to provide the account (article 6(1)(b)) and, for the payment records, to meet the Danish Bookkeeping Act, which requires them to be kept for five years from the end of the financial year (article 6(1)(c)).

An account and everything in it is deleted when you ask, by email from the signed-in address. Payment records are kept for the five years the law requires and then deleted.

Emails

Every email we send is about a specific brief or a specific sign-in. There is no newsletter and no marketing email, so there is nothing to unsubscribe from. Replies go to hello@herebriefly.com.

What we measure

We count how many briefs are created, sent, opened, pushed back on and accepted. These are counts against briefs, not people, and they carry no names. There is no analytics script on any page, no advertising, and no tracking across other sites. Our hosting provider keeps ordinary request logs, which include IP addresses, for a short time to run and secure the service. To limit abuse, our own code holds each visitor’s IP address in memory for up to an hour and then forgets it; it is never written down.

Cookies and browser storage

HereBriefly sets no cookie unless you sign in, and never sets a cookie from anyone else. That is why there is no cookie banner: everything below is strictly necessary for something you asked for, which the ePrivacy rules and the Danish cookie order exempt from consent. This section is the information those rules ask us to give.

• Sign-in session. When a studio signs in, the sign-in service sets a session cookie so you stay signed in, and we set one small cookie, hb_in, that says only “signed in” so the navigation shows the right button before the page has loaded. Both last 30 days from the last visit and are removed when you sign out.
• Your draft. While you answer questions, your answers are kept in your browser’s local storage so a reload does not lose them. They are removed when the brief is sent.
• Your edit link. After you send, the key that lets you edit the brief is kept in your browser’s local storage so the sent screen can find it again.
• Your name. When you flag, ask or accept on a brief, the name you type is kept in your browser’s local storage so you do not type it again on the next brief.
• One check per tab. A flag in session storage records that this tab has checked whether you are signed in, so it is not asked twice.

Local and session storage stay on your device and are never sent to us. You can clear all of it from your browser’s settings at any time; the only effect is that a draft not yet sent is lost.

Who processes the data

These companies handle data for us under written agreements that cover EU data protection. Where a company is outside the EU, the last column says what makes the transfer lawful under chapter V of the GDPR.

Fonts are served from our own domain, so no request goes to a font provider. No language model or other AI service receives any part of a brief; the specifications are derived by fixed rules that run on our servers.

Your rights

You can ask what we hold about you, have it corrected or deleted, ask us to restrict how it is used, object to use based on legitimate interest, and receive the data you gave us in a form you can take elsewhere. Write to hello@herebriefly.com. To delete a brief, include its link; to delete a studio account, write from the signed-in address. We answer within a month, and we do not charge for it.

If you think we have handled your data wrongly, you can complain to the Danish supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. We would rather hear from you first, so that we can fix it.

What we do not do

We make no decision about you by automated means, we build no profile of you, we do not sell or share data for advertising, and we do not knowingly collect data from anyone under 16. The service is for adults briefing and doing design work.

Changes

If this page changes in substance, the date at the top changes, and studios with an account are told by email. Earlier versions are available on request.

See also the terms of use.