Privacy Policy

Who is responsible

BriefBasket, operated under the ITworks business name, is responsible for the account and service information described in this policy. Privacy questions and requests can be sent to support@briefbasket.com.

Information we collect

We process account information such as your name, email address, Google sign-in details where you choose that option, authentication records, subscription status, and support communications.

When you use BriefBasket, we store the projects and request lists you create, client or project names you enter, answers and links submitted through client pages, uploaded files and file details, completion status, and relevant dates.

We also receive limited device, log, security, and usage information needed to operate, protect, and improve the service.

Client information you collect

BriefBasket account owners decide what information and files to request from their clients. The account owner remains responsible for having a lawful reason to collect and use that information, giving any notices required by law, limiting requests to what is necessary, and responding to their client's privacy requests. We process client submissions on the account owner's instructions to provide the service.

Private links and uploads

Each client project has a private capability link. Anyone who has that link may be able to view the request list and submit answers or files, so account owners must share it only with intended recipients and ask us to replace it if it may have been exposed.

Files are stored in private storage and are made available to the relevant account owner through time-limited access links. Clients should not upload information that the account owner did not request.

How we use information

We use information to create and secure accounts, provide project checklists and private client pages, store and deliver submissions, show progress, support subscriptions, respond to requests, diagnose problems, prevent misuse, understand aggregated service usage, enforce our terms, and comply with legal obligations.

Payments

Paid BriefBasket purchases are processed by Paddle as merchant of record. BriefBasket does not receive or store full card numbers. Paddle may provide transaction and subscription details such as customer email, amount, currency, payment status, customer ID, and subscription status. Paddle's processing is also subject to Paddle's privacy policy.

Service providers

We use service providers where needed to operate BriefBasket:

• Supabase for authentication, database services, and private file storage.
• Vercel for website hosting, related infrastructure, and Web Analytics.
• Google when an account owner chooses Google sign-in.
• Paddle for payment, tax, refund, and subscription processing when paid billing is enabled.

These providers may process information in other countries under their own safeguards and applicable data-protection requirements.

Sharing and disclosure

We do not sell personal information. We may disclose information to the providers above, when required by law or valid legal process, where reasonably necessary to protect users and the service, or as part of a legitimate business transfer subject to appropriate protections.

Retention and security

We retain account, project, submission, upload, and billing information while it is needed to provide the service and for reasonable legal, security, fraud-prevention, backup, and accounting purposes. We use reasonable technical and organisational safeguards, including access controls and private storage, but no online system can promise absolute security.

Your choices and rights

Account owners may ask to access, correct, export, or delete personal information associated with their account, object to or restrict certain processing, or raise a privacy complaint, subject to applicable law and necessary record-keeping. Clients should normally contact the account owner who sent the BriefBasket link first. Requests to BriefBasket can be sent to support@briefbasket.com.

Cookies and similar storage

BriefBasket uses essential cookies and similar browser storage to keep users signed in, protect authentication flows, remember necessary choices, and operate the service. We do not use this information to sell advertising profiles.

Children and policy changes

BriefBasket is a business service and is not intended for children. We may update this policy as the service, providers, or legal requirements change. Material updates will be communicated where reasonably required, and the date at the top will be revised.