How BriefAI handles your data

The only thing BriefAI stores on your behalf is the one-sentence product description you type at generator time, plus the brief itself — the hooks, the script outline, the call-to-action, and the objection handler. There’s nothing else to store: no brand-guide uploads, no asset libraries, no scraped URLs, no first-party cookies tracking you across sites.

If you sign up, we additionally store the email you used to create your account and a session token used to keep you signed in — nothing else from the sign-up form is held.

That same one-sentence product description is what’s sent to the model each time you regenerate. The brief is regenerated end-to-end on each request; a new generation is a fresh draft, never an edit on top of the previous one — we do not feed your last output back into the prompt.

Your data is yours alone. We do not aggregate your brand description with data from other users, and nothing you type is used to train a model outside of your own regenerations. The model provider sees only the prompts for the briefs you ran.

Every brief you generate is persisted so you can reopen it later. The list query is scoped to your account — the database call that retrieves them filters on where: { userId: user.id } — so no other session, including other BriefAI accounts, can read your briefs. The brand description stays inside the briefs themselves; it is not echoed back into any cross-user aggregation.

Authentication is handled by the better-auth module, which manages a session-only cookie in your browser. We do not store your raw password — better-auth stores only a hash, and the session cookie itself expires when you sign out.

All payments run through Stripe hosted checkout, wired up by the stripe-billing module. Stripe collects your card details directly on Stripe’s own hosted page — BriefAI never sees, stores, or transmits your card number, expiry, or CVV.

What lands in our database is the surface metadata Stripe sends back: the plan you chose, your customer email as registered with Stripe, and the last four digits of the card on file — nothing more. Refunds are handled the same way: BriefAI asks Stripe to refund the charge, and Stripe executes it against the original card. We never see your card at any point in the refund flow either.

BriefAI itself uses no advertising cookies, no Google Analytics, no Meta Pixel, and no third-party retargeting scripts. We also don’t run cookie-based language detection (the kind that would write a cookie to switch your locale) — the regional hint you may see on the pricing page reads the accept-language request header only and does not write anything to your browser.

The only analytics beacon on the site is the Polsia platform analytics script (loaded as PolsiaAnalytics), which counts page views so the team can see which pages get read. The only authentication cookie set is the session cookie managed by better-auth. Those are the two cookies a visit ever produces.

Every model call goes through Polsia’s OpenAI proxy. The proxy holds the actual API key; BriefAI itself has no direct provider key to leak. Auditing the supply chain therefore reduces to a single question — what does the OpenAI-compatible endpoint log — and that question can be answered without looking at our codebase.

We do not call multiple model providers per brief. There is exactly one model call per regenerate, going to exactly one provider, through one proxy.

Your briefs persist for as long as your account exists, so you can reopen them later. If you delete a brief from the dashboard, it is removed immediately & — deleted, not soft-deleted, not tombstoned.

If you delete your account, every row scoped to your userId goes with it: briefs, libraries, VA-seat grants, and the Stripe customer mapping we hold for billing. The Stripe subscription itself is cancelled at the same time, so no further charges happen after account deletion. We do not export your data to any third party — the brief you wrote stays inside BriefAI; we never resell or transfer it to anyone outside the platform.

BriefAI is not directed at children under 13, and we do not knowingly collect information from anyone under 13. If you believe an account has been created by a child under 13, email hello@em.briefaihq.com and the account will be deleted.

Last updated · August 8, 2026. We will update this page with a new date (and a note at the top of the section that changed) if anything material changes — for example, if a new category of data is collected, if a new third party starts receiving brand descriptions, or if the data-retention window shifts. Continuing to use BriefAI after a posted update means you accept the new terms.

The one address for every privacy question, deletion request, or data report is hello@em.briefaihq.com — one email, no support ticket, no flow to click through. We reply within one business day.