Privacy Policy

This policy explains what personal data DebriefStudio collects, why, on what legal basis, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who is responsible (controller)

Clarity and Confidence Academy Ltd.
Company registration number: 205736702
25 Kniaz Dondukov-Korsakov Street, 5000 Veliko Turnovo, Bulgaria
Contact: privacy@debriefstudio.app

We have not appointed a Data Protection Officer; we are not required to. Privacy questions go to the address above.

2. What we collect, why, and on what legal basis

Account data (email, hashed password or Google identifier, display name) — to create and operate your account. Legal basis: performance of a contract (Art. 6(1)(b)).

Project data (everything you paste into a brief, files you upload, and the generated outputs) — to deliver the core service. Legal basis: performance of a contract (Art. 6(1)(b)).

Billing data (plan, subscription status, invoice details you enter) — to take payment and meet accounting law. Card details are handled directly by Stripe; we never see or store them. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

Security and anti-abuse data (access logs with IP and user-agent, and a normalised form of your email address used to detect one person opening many free accounts) — legal basis: our legitimate interest in preventing fraud and abuse of free quotas (Art. 6(1)(f)). You can object to this processing at any time using the contact address above.

Usage counts (how many projects, regenerations and brief checks your account has used, and when it was last active) — we need these to enforce plan limits and bill correctly, and we review them in aggregate to decide what to improve. They are counts only: we do not read project titles, client names, file names or document content. Legal basis: contract (Art. 6(1)(b)).

Product-update emails (your email address and the date you opted in) — only if you tick the box on the “What’s new” page or in Settings. You can withdraw at any time in Settings or from the unsubscribe link in the email. Withdrawal does not affect service emails such as password resets and receipts. Legal basis: consent (Art. 6(1)(a)).

Consent records (which version of these documents you accepted and when) — legal basis: legal obligation and accountability (Art. 5(2), Art. 7(1)).

We do not collect special-category data, we do not profile you, and we make no automated decisions that produce legal effects.

3. AI processing

Your project inputs are sent to Google's Gemini models through a secure gateway to generate outputs. Your inputs are not used to train models. If you enable Confidential mode, the sensitive terms you list are replaced with placeholders in your browser before anything leaves your device, so names, titles, and client identities never reach the model.

4. Storage, security, and retention

Data is stored on Supabase infrastructure in the European Union. Row-Level Security means only your account can read your rows, and uploaded files sit in a private bucket reachable only by you and our server.

Retention: account and project data are kept for as long as your account is open. When you delete your account, projects, uploaded files, and profile data are erased immediately and backups roll off within 30 days. Billing and invoice records are kept for 10 years to satisfy Bulgarian accounting and tax law. Security logs are kept for 12 months.

5. Who we share it with (sub-processors)

We never sell your data. We use the following processors, each under a data processing agreement:

6. International transfers

Some of the processors above are established outside the European Economic Area, primarily in the United States. Where personal data is transferred there, the transfer is covered by the European Commission's Standard Contractual Clauses together with technical measures (encryption in transit and at rest). Your stored project data and account records remain in the EU.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent where processing rests on it. Withdrawal does not affect processing already carried out.

You can exercise access, portability, and erasure yourself, immediately, from Settings → Account: Download my data produces a machine-readable JSON export, and Delete my account erases your data. For anything else, email privacy@debriefstudio.app and we will respond within one month.

If you believe we have handled your data unlawfully you may lodge a complaint with your local supervisory authority, or with our lead authority, the Commission for Personal Data Protection (CPDP).

8. When you are the controller

Briefs often contain personal data about other people — crew, clients, contacts. For that content you are the controller and we act as your processor. The terms governing that relationship are set out in our Data Processing Agreement, which forms part of our contract with you.

9. Cookies

We use strictly-necessary cookies only: session authentication, CSRF protection, and a short-lived referral cookie. There is no advertising, analytics, or third-party tracking, so no cookie consent banner is required.

10. Changes and contact

Material changes are announced by email and reflected in the version number at the top of this page. Questions: privacy@debriefstudio.app.