Privacy Policy

1. Who We Are

Sendabrief ("we", "us", "our") operates the sendabrief.com service and is based in Jordan. Contact us at support@sendabrief.com.

For personal data that you upload about other people (teammates, guests, or people appearing in a recording or screenshot), you are the controller of that data and we act as a processor on your behalf.

2. Information We Collect

We collect the following categories of information:

• Account data: your email address and a hashed password, managed by Supabase Auth. If you sign in with Google, we receive your email address and basic profile information from Google instead of a password
• Workspace data: workspace name, your role, team memberships, per-SOP access grants, and branding you upload (logo, colour, display name)
• Content you submit: documents you upload (PDF, Word, PowerPoint), meeting recordings and transcripts, voice notes, click-by-click screenshots and narration audio captured by our browser extension, and any text you type, plus the SOPs, drafts, versions, and translations generated from them
• People you tell us about: the names and email addresses of teammates you invite and of guests you assign a SOP task to, and any personal data contained in the material you upload
• Usage data: library search queries (including searches that returned no results), step-level progress when someone runs through a SOP, SOP views and read confirmations, webhook delivery logs, and API key usage metadata, all associated with the acting workspace member
• Billing data: subscription status, plan, and a Lemon Squeezy customer and subscription identifier. We never receive or store card numbers
• Browsing data on our public pages: pages viewed, links and buttons clicked, scroll depth, referring site and campaign parameters, browser, operating system, device type, approximate location derived from your IP address, and a session replay. We set a persistent identifier in your browser so repeat visits are recognised. This is collected by default rather than on request. Anything you type is masked, and this does not run on your dashboard, on SOPs shared with you, or on sign-in pages. See section 10

3. How We Use Your Information

• To provide the Service: generating, storing, versioning, exporting, translating, and sharing your SOPs
• To authenticate your account, enforce access controls, and protect against fraud and abuse
• To show your workspace its own usage analytics (what people search for, which SOPs get read and completed)
• To process payments and manage subscriptions via our merchant of record, Lemon Squeezy
• To send account and workflow email: sign-up confirmation, password reset, workspace and team invitations, guest task links, trial and billing notices, and review reminders an owner or manager chooses to send
• To respond to support requests

We do not use your submitted content to train AI models, sell your data, or share it with third parties for marketing purposes. We do not run advertising, and we do not track you across other websites.

We also record how our public pages are used, including session replays, to find where the site is confusing. This runs by default and is described in section 10. Your SOP library is never recorded, and neither is any SOP shared with you by someone else.

4. AI and Transcription Processing

Text, documents, transcripts, and step content you submit are sent to Anthropic's Claude API to generate and translate SOPs, to detect conflicts with existing SOPs, and to draft titles and step text. Audio and video you submit (meeting recordings, voice notes, and extension narration) are sent to Groq's Whisper API for transcription. Both are used only to produce the output you asked for, and their API terms prohibit training on your content.

Our browser extension captures screenshots, never video. Before a screenshot leaves your browser, visible email addresses, phone numbers, national identifiers, and payment card numbers are detected and masked client-side. This is an automated pattern-matching safeguard, not a guarantee, so review captured screenshots before sharing a SOP.

5. Data Storage and Security

Your data is stored in Supabase (Postgres, Auth, and Storage, hosted on AWS in Frankfurt, Germany) and encrypted at rest and in transit. Uploaded documents, audio, extension screenshots, and brand logos are held in Supabase Storage. Workspace data is isolated by Postgres row-level security, and access within a workspace is further restricted by role, team membership, and per-SOP grants. API keys are stored only as SHA-256 hashes.

Share links, embeds, and client portals are secured by an unguessable URL token rather than a login. Anyone with the link can view that content until the token is revoked from your dashboard.

6. Third-Party Services and Subprocessors

• Supabase: database, authentication, and file storage (on AWS, Frankfurt)
• Vercel: application hosting, edge delivery, and aggregate web analytics
• PostHog (EU region): product analytics and session replay on our public pages. Not used on your dashboard or on shared SOPs
• Anthropic: AI generation, extraction, translation, and conflict detection
• Groq: speech-to-text transcription of audio and video you submit
• Resend: transactional and workflow email delivery
• Lemon Squeezy: payment processing and merchant of record
• Google: optional sign-in, if you choose Google OAuth

If you configure webhooks or use our public API, data about your SOPs is sent to the endpoints and integrations you choose. Those destinations are outside our control and are your responsibility.

We will give notice before adding or replacing a subprocessor that processes your content. If you need a data processing agreement covering our handling of personal data on your behalf, email support@sendabrief.com and we will provide one.

7. International Transfers

Your account data, SOPs, and uploaded files are stored in the European Union (Frankfurt). Some of the subprocessors listed above operate outside the EU, primarily in the United States: content is transmitted to Anthropic and Groq for generation and transcription, to Resend for email delivery, and to Lemon Squeezy for payment processing. Those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism in each provider's terms.

We operate from Jordan, so our own staff access to the systems described above takes place from outside the European Economic Area. Jordan is not currently the subject of an EU adequacy decision, and we rely on Standard Contractual Clauses and appropriate technical and organisational safeguards for that access. You may request details of the safeguards in place at support@sendabrief.com.

8. Data Retention and Deletion

We retain your data for as long as your account is active. Deleting your account from Settings immediately and permanently deletes your workspace and everything scoped to it: SOPs, versions, drafts, translations, teams, grants, guest records, invitations, analytics events, API keys, and webhooks. Files you uploaded to storage (documents, recordings, screenshots, logos) are purged in the same operation, which also invalidates any signed URLs pointing at them. Backups held by our infrastructure providers roll off on their own schedules.

Guest access links and invitations expire on their own (guest access defaults to 14 days) and can be revoked at any time. Records we are required to keep for legal or accounting purposes, such as billing records held by our merchant of record, are retained for the period required by law.

The browsing data described in sections 2 and 10 is held separately by PostHog and is not removed when you delete your account, because it is tied to a browser identifier rather than to your account and is also collected from visitors who never create one. It is retained for as long as PostHog's retention settings for our project allow. To have it deleted, email us using the address in section 13 and we will remove the records associated with your browser identifier.

9. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Export your SOPs as PDF or Word documents, or retrieve them through our API
• Object to or restrict certain processing, and withdraw consent where processing is based on it
• Lodge a complaint with your local data protection authority

To exercise these rights, email support@sendabrief.com. If you are a member of someone else's workspace, or a guest who received a task link, we may need to direct your request to the workspace owner, who controls that data.

10. Cookies, local storage, and session replay

Essential. Cookies required for authentication and session management. These cannot be turned off without breaking sign-in.

Aggregate analytics. Vercel Web Analytics counts page views without cookies and without identifying you.

Product analytics and session replay. PostHog (EU region) records how you move through our public pages, which elements you click, and a replay of the session, so we can find where the site is confusing. This runs by default and sets an identifier in your browser. Specifically:

• Anything you type is hidden. All form fields and text inputs are masked before a recording leaves your browser, so we never see what you wrote.
• Your dashboard is never recorded. Recording is switched off entirely on your SOP library and settings, so your own operational documents are never captured.
• Shared SOPs are never recorded. If someone sent you a share link, an embed, a client portal, or a task link, none of it is recorded. You have no account with us and we do not collect behavioural data from you.
• Sign-in pages are never recorded.
• Content you generate at /try is hidden, even though it is not a form field.

To stop this, block eu.i.posthog.com in your browser or use an ad blocker or tracker blocker; most block it by default. Clearing this site's data removes the identifier, though a new one is set on your next visit. If you would like us to stop collecting this and delete what we hold about your visits, email us using the address in section 13.

11. Children

Sendabrief is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

12. Changes to This Policy

We may update this Privacy Policy. We will notify you by email of material changes. Continued use of the Service after changes constitutes acceptance.

13. Contact

Privacy questions or requests: support@sendabrief.com