Controller

ActBrief is operated as a product at actbrief.com. For privacy requests contact privacy@actbrief.com. A full legal entity name and postal address will be published here before paid packs go live; until then the free scanner is operated under this contact.

This policy explains what data we collect when you use the scan, why, how long we keep it, and which processors may receive it.

What we collect

Scan form inputs: product URL, intended purpose / AI feature description, industry, role, EU market intent, automation answers, and your email.
Your IP address, held in memory only, used to rate-limit form submissions (max 10/minute) and never written to disk.
If analytics is enabled: aggregate, cookieless page-view data via Plausible.
Google Ads receives limited cookieless measurement signals. Advertising, analytics, user-data, and personalisation storage are denied by default.

Why we collect it

To generate and deliver your AI Act readiness report (contract performance — you requested this report).
To email you a copy of your report, if email delivery is enabled (Resend).
To notify our team internally when a new scan is submitted (Telegram), so we can improve the product and follow up if you ask us to.
To prevent abuse of the scan form (legitimate interest).
To measure whether an advertising visit results in a pack request, without enabling Google advertising storage.

How the report is generated

Classification is produced by ActBrief's own rules engine on our servers. We do not send your product description to a third-party LLM to generate the free report. We do not use your submissions to train any AI model.

How long we keep it

Report data (your submitted inputs and generated report) expires after 30 days. It becomes inaccessible at expiry and is removed during automatic report-storage cleanup. Interest emails for pack requests are stored until you ask us to delete them or the relevant outreach is complete.

Processors / subprocessors

Hosting / VPS — application and report files (EU or operator-chosen region; confirm with us if you need the current location).
Resend — transactional email when enabled (report delivery).
Plausible — cookieless analytics when enabled.
Google Ads — limited cookieless advertising measurement with Consent Mode storage categories denied by default.
Telegram Bot API — optional internal lead notification (email + product URL + risk hypothesis).

Some processors may process data outside the EU/EEA. Where that happens we rely on the processor's appropriate transfer mechanisms (e.g. SCCs). We do not sell personal data.

Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, correct, delete, or export the data we hold about you, and to object to our processing. Since reports auto-expire after 30 days, most requests resolve automatically — email privacy@actbrief.com for earlier deletion or questions.

You also have the right to lodge a complaint with your local supervisory authority (for example your national data protection authority in the EU/EEA).

Cookies

Plausible runs without cookies or persistent identifiers. The Google Ads tag is configured with advertising, analytics, user-data, and personalisation storage denied by default. It may send limited cookieless measurement signals, but it is not permitted to store advertising cookies in this state.

Privacy Policy