Privacy Policy
Last updated:
This Privacy Policy describes how ReqBrief(“we”, “us”) handles your personal data when you use the ReqBrief service available at https://reqbrief.com. We aim to be transparent: this page lists every category of data we touch and every third party we share it with.
1. Who runs this service
ReqBrief is operated by Danial Pourgolabi Ardakani, based in Lisboa, Portugal. For full contact details see the Imprint.
2. What data we collect
2.1 Account data
When you sign up we collect your email address, a hashed password (if you set one), and any display name you choose. We need this to identify your account and let you log back in. If you arrived through a campaign link, we also record which link it was (its UTM tags) so that we can measure where sign-ups come from.
2.2 Project and interview data
When you create projects we store the project name, company name, contact name, type, and the context you provide. When your clients answer interview questions, we store the full transcript of the conversation.
2.3 Uploaded files
You and your interview participants may upload PDFs and images. PDF text is extracted and stored in our database; images are stored as base64-encoded content. We don't use third-party object storage for file content.
2.4 Generated briefs
The structured briefs the AI produces are stored against your project so you can re-read or download them.
2.5 Technical / log data
Our hosting provider and edge proxy log standard request metadata (IP address, user-agent, URL, timestamp, response status) for security, abuse detection, and debugging.
2.6 Rate-limit data
Our rate-limit service stores short-lived counters keyed by IP address and session identifier (typical TTL: 1 hour).
3. Why we use it (legal basis)
If you're in the EU/UK, we rely on the following GDPR legal bases:
- Performance of a contract (Art. 6(1)(b) GDPR). For delivering the core service: account creation, interviews, brief generation, sending you the brief by email.
- Legitimate interests (Art. 6(1)(f) GDPR). For security logging, abuse prevention, rate limiting, and bot detection. Our interest is keeping the service available and protecting against fraud and AI-cost abuse; this is balanced against your privacy by minimising the data we keep.
- Legal obligation (Art. 6(1)(c) GDPR). Where we're required to retain or disclose data by applicable law.
4. Who we share it with
We do not sell your personal data. We share data only with the third-party services we use to operate ReqBrief(“subprocessors”). Each subprocessor only receives the data it needs to perform its function.
| Provider | Purpose | Region | Privacy policy |
|---|---|---|---|
| Supabase | Database (Postgres), authentication, file content storage | EU or US region depending on project (see Supabase project settings) | View |
| OpenRouter | Routes AI inference requests to the underlying model provider (Anthropic Claude models) | United States | View |
| Anthropic (via OpenRouter) | Generates interview questions and structured briefs | United States | View |
| Vercel | Application hosting, edge proxy, request logs | Global edge network | View |
| Resend | Transactional email delivery (brief-ready notifications, contact form) | United States | View |
| Cloudflare Turnstile | Bot detection on auth and contact forms (CAPTCHA replacement) | Global | View |
| Upstash | Rate limiting (Redis) on AI routes, uploads, and the contact form | Selected during database provisioning (US/EU) | View |
| Polar | Payment processing and subscription billing (merchant of record for paid plans) | United States | View |
| Sentry | Error and crash monitoring (diagnosing failures in production) | EU (Frankfurt / .de ingest) | View |
5. Where data is stored
Your account, project, session, and brief data live in our Supabase Postgres database. File content is stored in the same database (not in third-party blob storage). Email delivery is handled by Resend in the United States. AI inference goes via OpenRouter to Anthropic, both in the United States.
6. How long we keep it
- Account data: until you delete your account.
- Project, session, brief, file data: until you delete the project (soft-deleted projects can be restored within 8 seconds via the undo toast; after that they may be permanently removed).
- Server / proxy logs: retained by our hosting provider per their schedule (typically 30 days for request logs).
- Rate-limit counters: typically 1 hour (sliding window).
- Transactional email metadata: retained by Resend per their schedule.
When you delete your account we cascade-delete projects, sessions, messages, briefs, and uploaded files, and then remove your authentication record.
7. Your rights
If you're in the EU/UK, you have the following rights under the GDPR / UK-GDPR:
- Access (Art. 15): request a copy of your data.
- Rectification (Art. 16): correct inaccurate data via the account settings.
- Erasure (Art. 17): delete your account from the account settings; cascades to all owned data.
- Restriction of processing (Art. 18): contact us.
- Data portability (Art. 20): request a machine-readable export by emailing us.
- Object (Art. 21): to legitimate-interest processing.
- Complaint: lodge a complaint with your local supervisory authority.
To exercise any of these rights, email contact@reqbrief.com or use the contact form on our homepage.
8. Cookies and similar tech
We use a small number of strictly necessary cookies for authentication and locale preference. We do not use advertising or analytics cookies. Because all cookies are strictly necessary for the service to function, we do not display a cookie consent banner. No consent is required under ePrivacy for cookies in this category.
Cloudflare Turnstile may set short-lived tokens to verify your browser; these are scoped to challenge verification and are not used for advertising or tracking.
9. Children
ReqBrief is intended for use by professional users (typically agencies, freelancers, and their clients) aged 18 or older. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
10. International transfers
Some of our subprocessors (notably OpenRouter, Anthropic, Resend, and Cloudflare in some regions) are based in the United States. Where personal data is transferred outside the EU/UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework where applicable, as published by each provider.
11. Business outreach to agencies
This section is for people we have emailed who are not ReqBrief users. It explains where we got your address and what we do with it, as the GDPR (Art. 14) requires when the data does not come from you.
11.1 Who is writing
The emails come from Danial Pourgolabi Ardakani, an individual entrepreneur (Empresário em Nome Individual) based in Lisboa, Portugal, trading as ReqBrief. Full details are in the Imprint. Write to danial@reqbrief.com about these emails. For anything else, contact@reqbrief.com works as it does elsewhere in this policy.
11.2 What we collect and where it comes from
We only use what your agency has published on its own website. From it we record the agency name, website and country, the business email address shown there and, where the site shows them, the name and role of the person it belongs to, the agency's legal form and team size, and the time zone we read from the postal address on your website. We also keep one public detail about your work (a project, a post or a service page, quoted in a few words) so that the email can refer to it, together with the page where we found your address, the pages we read and the date we read them. We do not buy contact lists and we do not take addresses from directories. If your website says it does not want sales or vendor email, we note that and do not write.
11.3 Why we use it and on what basis
We use this data to send you one short business email about ReqBrief, a tool made for agencies, and at most one follow-up if you do not reply. Our legal basis is our legitimate interest in telling agencies about a service built for their work (Art. 6(1)(f) GDPR). We keep this proportionate: we write to businesses only, every email says where we found your address and links to this section, and a single reply ends it. We check the rules of your country before we write, and we do not write where a first business email would need your prior consent. We do not sell or pass this data to anyone else.
11.4 Who processes it
The following services handle this data on our behalf. Each receives only what it needs. GitHub, OpenRouter and Anthropic are in the United States; transfers there rest on the safeguards described in section 10.
| Provider | Purpose | Region | Privacy policy |
|---|---|---|---|
| Zoho Mail | Sends our emails and receives your replies | EU data centre | View |
| Cloudflare (Workers and D1) | Holds the outreach queue, the sending record and the do-not-contact list, and runs the sender | EU (the database is in Western Europe); the sender runs on Cloudflare's global network | View |
| Telegram | Shows each draft to the operator for approval before anything is sent | Global | View |
| OpenRouter | Routes the model requests (and the web search) used to find agencies, read the public detail, draft the email and sort replies | United States | View |
| Anthropic (via OpenRouter) | Claude models that read the public detail, draft the email and sort replies | United States | View |
| GitHub | Runs the weekly research job that reads agency websites | United States | View |
11.5 How long we keep it
We delete your data 12 months after our last contact with you, which is the latest of our last email, your last reply or the research itself, unless you become a customer, in which case the rest of this policy applies. If you ask us not to write again, we keep only your email address or domain, with a short note of why, on a do-not-contact list. That list is kept indefinitely, because it is the only way to make sure we never write to you again.
11.6 Your rights
You can object at any time: reply “no” to any of our emails or write to danial@reqbrief.com, and we stop at once and add you to the do-not-contact list. You also have the rights of access, rectification and erasure, and the right to complain to a supervisory authority, as described in section 7; the same addresses work for those requests.
12. Updates to this policy
We may update this Privacy Policy as we add features or change subprocessors. When we do, we'll update the “Last updated” date at the top of this page. Material changes affecting how we process your data will also be announced in-app or by email.
13. Contact
Questions about this policy or how we handle your data? Email contact@reqbrief.com or use the contact form on our homepage.