BriefBuilt Privacy Policy

Last updated: 19 August 2026

BriefBuilt, registered with the Dutch Chamber of Commerce under number 42116865 and established at Schoorlaan 23, 2265 VS Leidschendam, the Netherlands, is the controller for the processing described here. VAT identification number: NL005507419B11. Privacy contact: support@briefbuilt.com. BriefBuilt handles privacy requests by email and aims to acknowledge them within five working days.

1. Scope and roles

This policy covers briefbuilt.com, orders, support, newsletters and the private project workspace. We are controller for our own sales, communication, security and administration. When we handle personal data from a client’s Shopify store or supplied files solely to build that client’s store, we generally act as processor for that client under our Data Processing Addendum.

2. Data, purpose, legal basis and retention

Website and security data: IP address, device/browser data, timestamps and security events. Purpose: deliver and secure the site, prevent fraud and diagnose faults. Basis: legitimate interests and, where applicable, consent for optional analytics/marketing. These data are retained under the relevant provider settings and deleted or anonymised when no longer needed for security, fault investigation or legal obligations.
Contact and pre-contract requests: name, business email, company and message. Purpose: answer requests and prepare a possible agreement. Basis: steps at your request before contract and legitimate interests. Enquiries are reviewed and deleted when they are no longer needed for follow-up, an agreement or a legal claim.
Orders and invoices: business/contact details, order, payment status, tax and transaction data. Purpose: perform the agreement, invoice, prevent fraud and meet tax/accounting duties. Basis: contract and legal obligation. Financial administration is retained for seven years after the relevant financial year.
B2B eligibility and purchase authority: business name, country, registry jurisdiction and number, the purchaser’s authority and business-purpose confirmations, and BriefBuilt’s approve, reject or revoke decision. Purpose: restrict paid services to eligible business customers, prevent fraud and establish who entered into the agreement. Basis: steps at the Customer’s request before contract, performance of the business agreement and BriefBuilt’s legitimate interests in fraud prevention and legal accountability. The identifying acceptance record is kept only under the approved order-evidence retention policy and any legal hold. A minimal decision and evidence digest may be kept only as long as reasonably necessary to establish, exercise or defend legal claims.
Project brief and files: brand, business, product and store information, feedback, uploaded files, project events and access data. Purpose: deliver, secure and support the purchased service. Basis: contract. At project closeout we restrict further use and manually return or delete operational files and access credentials when they are no longer required, subject to the Customer’s choice, an agreed support period, a dispute or a legal duty. A limited project record and final correspondence may be kept only as long as reasonably needed to establish or defend legal claims.
AI assistance and Free Shopify Store Preview generation: the draft field and limited accepted brief context submitted when you actively request an AI suggestion, and limited business context submitted for a Free Shopify Store Preview where preview generation is approved. Purpose: create the requested suggestion or private preview direction. Basis: contract or steps at your request before contract. For the Free Shopify Store Preview, only your business or brand name, business stage, industry, product or service type, target audience, preferred visual direction and primary store goal are sent to OpenAI. Your first name, email address, current website, social media URL, business-purpose confirmation and marketing-consent choice are not sent to OpenAI for preview generation. API data is not used to train OpenAI models unless an account opts in. We call the OpenAI Responses API with storage disabled for model output retention (store: false), but this is not Zero Data Retention and standard abuse-monitoring data may be retained by OpenAI for up to 30 days. The preview remains private and any customer-facing preview or email is reviewed and approved by BriefBuilt before it is shared. Do not enter unnecessary personal, confidential or sensitive data.
Support communication: messages and resolution details. Purpose: support the agreement and manage claims. Basis: contract and legitimate interests. Retained with the relevant enquiry or project only while needed for support, administration or a legal claim.
Shopify Inbox chat: when you use the storefront chat, BriefBuilt and Shopify may process your message and any attachment, the name, email address or Shop account information you choose to provide or share during sign-in, and technical, session and conversation metadata. Purpose: answer a pre-contract, service or support enquiry, preserve conversation continuity and secure the channel. Basis: steps at your request before contract, performance of the business agreement and BriefBuilt's legitimate interests in support, security and legal accountability. The current Shopify Inbox AI agent may generate an automated answer and Shopify may also generate an AI-assisted reply suggestion. The interface identifies automated responses and warns that AI may make mistakes. BriefBuilt does not use the chat to make a decision with legal or similarly significant effect. Do not send passwords, login codes, payment-card data, special-category data or unrelated customer records. Chat data is kept only while needed for the enquiry, support, security, an agreement or a legal claim; the exact provider retention and deletion settings remain under verification.
Newsletter: email address, subscription source and version, send history needed to administer the mailing, unsubscribe status, and restricted consent, send, withdrawal and suppression evidence. Purpose: send and administer Shopify Storefront Notes and honour an unsubscribe or objection. Basis: consent for marketing and legitimate interests and legal accountability for the minimal evidence needed to prove consent and prevent re-contact. Subscription is optional. Every marketing message identifies BriefBuilt and provides a free, easy way to unsubscribe. Marketing stops immediately after you withdraw consent or object. We remove the usable address from active marketing and reconcile the selected mailing provider through a controlled process; automated provider deletion is not claimed until it has been verified in production. We retain only restricted minimal proof of consent, sends, withdrawal and suppression for up to 60 months after the last marketing message where needed to demonstrate compliance or prevent re-contact. That proof is not used for marketing and does not justify keeping a marketable plaintext address, campaign profile, engagement history or message content for 60 months. A profile for which no marketing message was sent may be deleted sooner after provider and history verification. Effectively anonymised statistics may be retained where they no longer identify a person.

3. Required and optional data

Fields marked required are needed to answer the request or perform the agreement. Without them we may not be able to accept or deliver the project. Newsletter subscription and optional AI assistance are voluntary and do not affect the core service.

4. Recipients, service providers and current activation status

BriefBuilt shares personal data only where necessary for the interaction described in this policy. A provider listed here is not automatically used for every visitor, lead or customer. Some providers support the public website now, while other processing remains disabled until the relevant legal, security and release checks are complete.

Shopify: Shopify provides the storefront, forms, privacy controls, Shopify Inbox chat, checkout and order administration, and may process visitor, consent, contact, chat, account, order, device and transaction data under the applicable merchant, privacy and Enhanced Services terms. Shopify may process messages and related data to provide and improve the chat service. An active Shopify Inbox AI agent can produce automated responses, and Shopify can generate AI-assisted suggestions; neither authorises an order, project, legal commitment or publication. Shopify Network Intelligence is currently enabled as an Enhanced Service and is described in the Cookie Policy.
Payment and fraud providers: when paid ordering is enabled, Shopify Payments or another provider displayed at checkout may process payer, transaction, device, fraud-prevention, refund and dispute data under its applicable terms and privacy role. BriefBuilt’s application does not receive or store full payment-card credentials. Paid ordering remains disabled until the selected provider, tax, invoice, retention and transfer evidence has passed the launch gate.
Fly.io: Fly.io hosts the BriefBuilt application in the Amsterdam region and processes the limited request, security and application data needed for the routes a visitor or authorised user uses.
Zoho: Zoho provides the BriefBuilt support mailbox and processes email addresses, message content, attachments and support metadata when you contact BriefBuilt by email.
Google & YouTube integration and Google Analytics 4: Shopify’s official Google & YouTube pixel is active and connected to Google Analytics 4. Shopify currently reports that this pixel’s permission is “Not required” and that it will always run, with “Optimized” data access. Depending on Shopify’s and Google’s regional consent handling, the integration may therefore load and may transmit limited technical or consent-state signals, including advanced-consent cookieless measurement pings where supported, before or without analytics consent. This does not establish that full cookie-based analytics, personalised advertising or other consent-dependent uses operate before consent. BriefBuilt has tested the EEA public-storefront consent choices for accept all, decline all, analytics-only consent and withdrawal. Checkout and customer-account consent propagation, and the exact content of any cookieless measurement pings sent while analytics consent is denied, remain under verification. Paid advertising and reliance on consent-dependent campaign measurement remain disabled until those checks are complete. See the Cookie Policy.
Resend: Resend is the configured transactional-email provider for approved application messages; the Free Shopify Store Preview flow does not automatically send a generated preview or customer email.
GitHub: GitHub supports private build automation for paid storefront production and is not used to process the Free Shopify Store Preview form merely because that form is submitted.
OpenAI: OpenAI is used only for an expressly described AI-assisted function after the relevant processing and generation controls are enabled. Ongoing Free Shopify Store Preview generation through OpenAI is currently disabled. If approved preview generation is later enabled, only the limited business fields identified in section 2 are sent; first name, email address, website and social links and the marketing choice are excluded.
Professional advisers and public authorities: Professional advisers and public authorities receive information only where necessary for accounting, legal advice, claims or a legal obligation.

BriefBuilt’s own application does not receive or store full payment-card credentials. BriefBuilt maintains an internal provider register recording purpose, data, activation status and outstanding contract, transfer, retention and deletion evidence. Where required evidence is incomplete, BriefBuilt does not describe that provider as fully verified. Paid project processing that depends on an unverified provider remains disabled or restricted until the relevant release gate is closed.

We do not sell personal data. Provider names can change; we update this policy when a change materially affects the processing.

5. International transfers

Some providers or their subprocessors may process personal data outside the EEA. BriefBuilt records the intended transfer location and applicable transfer mechanism in its provider register before approving a provider for the relevant paid customer processing. Depending on the provider and destination, that mechanism may be an adequacy decision or another lawful Chapter V GDPR safeguard. Where the required contract or transfer evidence is still pending, BriefBuilt does not represent that the provider has been fully approved for paid Client Personal Data. You may contact support@briefbuilt.com to request information about the safeguard recorded for an enabled provider.

6. Cookies and similar technologies

Necessary technologies support checkout, security, privacy choices, chat and core site functions. Optional cookies or browser storage and consent-dependent analytics or marketing uses are used only where permitted and, where required, after consent. The active Google & YouTube integration may still load and may send limited technical, consent-state or cookieless measurement signals without placing optional cookies, depending on Shopify’s and Google’s settings and the visitor’s region. This does not mean that full cookie-based analytics or personalised advertising is active before consent. Details, providers, purposes and durations are in the Cookie Policy. You can change your choice through “Cookie preferences” in the footer.

7. Marketing

We send promotional email only with valid consent or where a legal existing-customer exception applies. Every message identifies BriefBuilt and includes a free, easy unsubscribe method. Withdrawing consent does not affect earlier lawful processing.

8. Security

We use access controls, private project links, encryption for Shopify Theme Access credentials, restricted file permissions, signed callbacks and reasonable organisational safeguards. No method is completely secure. Do not send passwords, payment-card data, special-category data or unrelated customer databases through forms or uploads.

9. Automated decisions

BriefBuilt does not make decisions with legal or similarly significant effects solely by automated means. AI suggestions do not become part of the approved brief until the customer actively accepts or edits them.

10. Your rights

Subject to the AVG/GDPR and applicable exceptions, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent at any time. Email support@briefbuilt.com. We may ask for proportionate identity verification and normally respond within one month. You may complain to the Dutch Data Protection Authority or your local EEA authority.

11. Children

The service is B2B and not directed to children. Do not submit children’s personal data unless necessary for a lawful client project and covered by written instructions and safeguards.

12. Changes

We may update this policy when our processing or the law changes. We publish the current version and date here and provide additional notice where required.