This policy explains which personal data BrefAI processes, why, and what your rights are, in accordance with the General Data Protection Regulation (GDPR).
Data controller
The data controller is the site's publisher, a private individual acting on a non-professional basis (see the legal notice). For any question about your data or to exercise your rights, write to contact@brefai.fr: you will receive an answer within one month at most.
Data collected
Newsletter: your email address, the date of your subscription request and the date you confirmed it, when you subscribe to the Morning Brief.
User account: your email address, your name if you provide it, your password (stored only in hashed form by our authentication provider), the account creation date, your list of favourite articles and the industries you choose to follow.
Preferences: display language and theme, and your cookie choice. This information stays in your browser.
Technical logs: our host keeps connection logs (IP address, date, requested page) to keep the site secure and running.
No personal data is sent to the artificial intelligence services used to summarize articles: they only receive the public content of the articles.
No tracking pixel is inserted in our emails (no open tracking and no click tracking).
How we collect your data
What you give us: your email address in the newsletter signup form, your email and password when you create an account, your name if you add it to your profile, the articles you save as favorites, the sectors you follow, the newsletter plan you choose, and the messages you send to contact@brefai.fr.
What is recorded automatically: the date of your signup, of its confirmation and, where applicable, of your unsubscription, random tokens that make the confirmation and unsubscribe links work, the host's technical logs, the site's technical errors (without email addresses), and, only if you accept, anonymous visit statistics.
What we do not do: we do not buy or receive data from other companies, we do not link your data to social networks, we do not place any tracking pixel in emails and we do no advertising profiling.
Messages you send us
When you write to contact@brefai.fr, we process your email address, the content of your message and its date, in order to answer you and handle your requests, including unsubscribe requests sent with the subject "Unsubscribe". Legal basis: our legitimate interest in answering the messages we receive and, for an unsubscribe request, the withdrawal of your consent.
Messages sent to contact@brefai.fr are received by OVH, which manages this mailbox, then forwarded to the publisher's inbox. Every message is also forwarded to Resend, our email receiving provider, so that unsubscribe requests are recognized automatically. A message with any other subject triggers no automatic action.
These messages are kept for 12 months after the last exchange, then deleted.
Purposes and legal bases
Sending the newsletter: based on your consent, confirmed by a click in the confirmation email (double opt-in), which you can withdraw at any time via the unsubscribe link in every email, or by writing to contact@brefai.fr from the subscribed address with the subject "Unsubscribe".
Managing your account and favourites: based on the performance of the service you request by creating an account (terms of use).
Personalizing the Brief: if you follow industries and subscribe to the newsletter with the same email address, articles from those industries come first in your Brief. This matching is based on the performance of the service you request by following an industry; it stops as soon as you no longer follow any industry.
Site security and operation: based on our legitimate interest in providing a reliable service.
Retention periods
Newsletter email address: for as long as you are subscribed, then 30 days after you unsubscribe. An unconfirmed subscription is erased 30 days after the confirmation email is sent.
User account, favourites and followed industries: until the account is deleted, which you can do at any time from My account, Data section, where you can also download your data. Deletion also erases your favourites, your followed industries and your newsletter subscription. You can stop following an industry at any time from My account, Preferences section.
Cookie choice: 6 months, after which you are asked again.
Messages sent to contact@brefai.fr: 12 months after the last exchange.
Technical logs: according to the host's policy, for a limited time.
Backups: the database is backed up in encrypted form, and backups are kept for 90 days. Erased data may therefore remain in them for up to 90 days before being permanently destroyed.
Recipients and processors
Your data is never sold or rented. It is only processed by our technical providers: Vercel (site hosting and, with your consent, audience measurement), Supabase (database), Render (automated jobs), Resend (sending and receiving emails), OVH (domain name and the contact@brefai.fr mailbox, in France), Sentry (tracking of the site's technical errors, without cookies or email addresses), GitHub (running the weekly backup) Amazon Web Services (storage of backups, encrypted before upload, in Paris) and Cloudflare (Turnstile anti-bot check on forms).
Cloudflare Turnstile: when you use the newsletter, login, sign-up or forgotten password form, an anti-bot check provided by Cloudflare runs in your browser. Cloudflare then receives your device's IP address and technical information about your browser to tell a human from a bot, and processes only the data strictly necessary for this security function. It only loads on these forms (for the newsletter form, on your first interaction). Legal basis: legitimate interest in protecting the service against abuse (Article 6(1)(f) GDPR).
The events map loads its base maps from OpenFreeMap, which then receives your device's IP address, as with any web resource. When you create an account or change your password, the Have I Been Pwned service checks that the password does not appear in a known breach: only the first 5 characters of its fingerprint (SHA-1 hash) are sent, never the password or your email.
Some of these providers are based in the United States. These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the EU-US Data Privacy Framework.
How your data is processed and protected
Storage: accounts, subscriptions, favorites and followed sectors are stored in a Supabase database in Paris (France). Emails are sent by Resend, automated jobs (collecting articles, sending the newsletter, purging subscribers) run on Render in Frankfurt, and the site is served by Vercel.
Access: each account can only read and change its own data, through access rules enforced by the database itself. Sensitive operations (newsletter signup, account deletion, sending) only go through the server, with an administration key never sent to your browser. Only the publisher has access to the administration tools.
Security: all connections are encrypted (HTTPS). Your password is never stored in plain text: our authentication provider only keeps a fingerprint of it (bcrypt hash), and it is checked against known breaches when the account is created. Backups are encrypted (AES-256) before leaving the server. Forms are protected against mass submissions.
Automated processing: the only personalization is placing articles from the sectors you follow at the top of your Brief. It is a simple sort, with no decision producing legal effects or significantly affecting you (article 22 of the GDPR). Artificial intelligence services never receive your personal data.
Minimum age
User accounts and the newsletter are reserved for people aged 15 and over. Below that age, signing up is only possible with the consent of a holder of parental authority (article 45 of French law no. 78-17 of 6 January 1978, known as the Informatique et Libertés law).
Your rights: retrieve, correct or erase your data
You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time.
With an account, you act yourself from My account: the Data section to download your data as a file (JSON format: profile, account creation date, status and dates of your subscription, chosen plan, followed sectors and favorites) or to permanently delete your account, the Profile section to correct your name or email address, the Newsletter section to subscribe, change plan or unsubscribe.
Without an account, you can unsubscribe at any time through the link in every email or by writing to contact@brefai.fr with the subject “Unsubscribe”. For any other request (copy of your data, erasure, objection), write to contact@brefai.fr from the address concerned: we reply within one month at most, and may ask you to confirm that the address belongs to you.
You can also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.