LEGAL

PRIVACY POLICY

Last updated: March 2026

This Privacy Policy explains how BRANDBRIEF™ collects, uses, and protects your personal data. As an operator based in Vienna, Austria, we are subject to the GDPR. This policy applies to all visitors and users of brandbrief.io and associated platforms.

1. Data Controller

Roman Hajek, Sole trader, Vienna, Austria, Email: support@brandbrief.io

2. Data We Collect

2.1 Website Visitors — Google Analytics

We use Google Analytics to understand how visitors use brandbrief.io. Google Analytics automatically collects:

IP address (anonymized by Google before storage)
Browser type, device type, and operating system
Pages visited, time on site, and referral source
Approximate geographic location (country/city level)

This data is processed by Google LLC under their own privacy policy (policies.google.com/privacy). No data is collected until you have given consent via our cookie banner. You can opt out at any time by rejecting analytics cookies.

We do not collect, store, or process any personally identifiable information about general website visitors. We cannot identify individual users from analytics data.

2.2 Sponsored Brief Clients

If you book a Sponsored Weekly Brief, we collect:

Your name
Your email address

This data is used exclusively to manage your Sponsored Brief booking — to communicate with you about the brief, coordinate the publication date, and deliver the post-challenge overview. We do not use this data for marketing, profiling, or any other purpose.

Payment data is processed entirely by our Merchant of Record platform (Lemon Squeezy, Gumroad, or Polar.sh). We never receive or store your payment details.

3. Legal Basis for Processing (GDPR)

Analytics (Google Analytics): Consent — Art. 6(1)(a) GDPR. Only active after you accept analytics cookies.
Sponsored Brief client data: Contract performance — Art. 6(1)(b) GDPR. Necessary to deliver the service you have booked.

4. Data Retention

Google Analytics data: Retained for 14 months, then automatically deleted by Google.
Sponsored Brief client data (name + email): Retained for 7 years as required by Austrian commercial and tax law (§ 212 UGB), then securely deleted.

5. Data Sharing

We do not sell your personal data. We share data only as follows:

Google LLC — analytics data, under Standard Contractual Clauses for EU-US data transfers.
Merchant of Record platforms (Lemon Squeezy, Gumroad, Polar.sh) — handle payment processing independently under their own privacy policies.
Legal authorities — only if required by law.

No other third parties receive your personal data.

6. Your Rights Under the GDPR

You have the right to:

Access the personal data we hold about you (Art. 15)
Correct inaccurate data (Art. 16)
Request deletion of your data (Art. 17)
Restrict processing (Art. 18)
Withdraw consent for analytics at any time via the cookie settings on our site
Lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde — dsb.gv.at)

To exercise any of these rights, contact: support@brandbrief.io. We will respond within 30 days.

7. No Accounts, No Tracking Beyond Analytics

brandbrief.io does not use login systems, user profiles, behavioural tracking, retargeting, or any form of persistent user identification beyond standard Google Analytics. You cannot create an account on this platform.