Privacy Policy

BriefBridge · briefbridge.ai · Last updated 19 July 2026

BriefBridge is built for lawyers. We know the material you work with — client information, matter details, litigation strategy — is among the most sensitive information there is, and may be subject to strict duties of confidentiality and legal professional privilege. We designed BriefBridge, and this policy, on that assumption: your content is treated with the same gravity as health information, and this document sets out — completely and specifically — what we collect, why, where it goes, how it is protected, and the rights and choices you have.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme.

1. Who we are and how this policy applies

BriefBridge (“BriefBridge”, “we”, “us”, “our”) operates the BriefBridge platform at briefbridge.ai (the “Platform”) — an AI-assisted legal research and matter workspace for Australian legal practitioners. This policy applies to all personal information we handle in connection with the Platform, our website, and our communications with you. It applies whether you use an individual account or a firm workspace. Where you use the Platform through a firm, your firm may have its own privacy obligations to its clients; this policy governs our handling, not theirs.

2. Definitions

• Personal information — information or an opinion about an identified or reasonably identifiable individual, as defined in the Privacy Act.
• Your Content — the matters, documents, files, research questions, conversations, notes and other material you upload to or create on the Platform. Your Content may include personal information about you and about third parties (for example, parties to a matter), and may be confidential or privileged.
• Usage Data — technical and event information generated by your use of the Platform (described in §4).
• Service Providers — the third-party infrastructure providers listed in §7 that we use to operate the Platform.

3. Our commitments at a glance

4. Information we collect

4.1 Account information

Name, email address, password hash (never your plaintext password), and — if you sign in with Google — your name, email and Google profile identifier as provided by Google. If you join or create a firm workspace: your firm name and role within it.

4.2 Your Content

The matters you create, documents and files you upload, research questions you ask, AI conversations you conduct, and notes you keep. You control what you put into the Platform. Your Content may include third-party personal information (for example, names of parties, witnesses or practitioners in matter documents); you are responsible for ensuring you are entitled to handle that information, and we handle it strictly as your service provider under this policy.

4.3 Usage Data

Event records such as: feature used, timestamps, counts of sources retrieved, retrieval quality scores, session and device information (browser type, operating system, approximate region derived from IP), and error logs. Usage Data is engineered to exclude the substantive content of your research: our analytics events record, for example, that a research query was run and how many sources it returned — never the text of the query or the response.

4.4 Billing information

If you purchase a subscription, payment is processed by our payment provider. We receive and store your plan, billing status, and partial card details (such as last four digits and expiry) for account management. We never store full card numbers.

4.5 Communications

Support requests, feedback, and correspondence you send us, including the contact details you use to send them.

5. How we use your information

We do not use your information for any purpose not listed above without telling you first. In particular: we do not use Your Content to train, fine-tune or evaluate AI models; we do not sell personal information; and we do not share Your Content with other users except within a firm workspace you have expressly joined and only for matters you or your colleagues have shared.

6. Confidentiality and legal professional privilege

The Platform is designed as a confidential working tool, and we treat Your Content as confidential information — not merely as personal information. Specifically:

• Access isolation. Your Content is accessible only to your account and, where you use firm features, to colleagues with whom a matter is expressly shared. Access controls are enforced at the database layer (row-level security), not just in application code.
• Personnel access. Our personnel do not view Your Content except: (a) where strictly necessary to provide support you have requested; (b) to investigate suspected abuse, fraud or a security incident; or (c) where required by law. Any such access is limited to the minimum necessary and is logged.
• Privilege. Nothing about the Platform is intended to affect the confidential or privileged status of your material. Our systems and contracts with Service Providers are structured to maintain confidentiality. You remain responsible for your own professional obligations, including judgements about what material is appropriate to process through any third-party tool, and for compliance with any court orders (including suppression and non-publication orders) applying to material in your possession.
• Legal demands. If we receive a subpoena, warrant or other compulsory process seeking Your Content, we will — unless legally prohibited — notify you promptly so that you may raise any claim of privilege or objection before we respond, and we will disclose only what we are legally compelled to disclose.

7. Who we share information with (service providers)

We use a small number of infrastructure providers to operate the Platform. Each receives only the information necessary to perform its function, under contractual terms consistent with this policy:

We may also disclose information: where required by law, court order or compulsory process (subject to §6); to our professional advisers under confidentiality; or as part of a bona fide sale or restructure of our business, in which case the recipient will be bound by this policy and you will be notified. We do not disclose personal information to any other third parties.

8. Where your information is stored and processed

Our primary database is hosted with Supabase in Singapore (AWS ap-southeast-1). AI processing occurs in the United States (Anthropic and Voyage AI), and application hosting (Vercel) may process requests in multiple regions. This is cross-border disclosure for the purposes of APP 8, and by using the Platform you consent to it. We choose providers with strong, audited security practices and contractual protections consistent with the APPs. We are working towards Australian-region data hosting; this policy will be updated when that changes.

9. How we protect your information

• Encryption — TLS for all data in transit; encryption at rest for stored data and backups.
• Row-level security — database-enforced access isolation between accounts and firms, so a request can only ever reach the rows it is entitled to.
• Least-privilege architecture — the application operates under a restricted database role; administrative credentials are separated, and privileged operations are confined to controlled tooling.
• Authentication — passwords are hashed (never stored in plaintext); OAuth sign-in is supported; sessions are managed with industry-standard tokens.
• Content-free analytics — internal analytics are structurally incapable of capturing your research content, because only event metadata is transmitted to them.
• Provider security — our Service Providers maintain independent security programs and certifications (e.g. SOC 2-audited infrastructure).

No system is perfectly secure, and we do not promise that security incidents can never occur — but we design so that the impact of any single failure is contained, and we respond as set out in §14.

10. Data retention and deletion

• Your Content — retained while your account is active. You can delete matters, files and conversations at any time within the Platform; deletion removes the content from live systems promptly and from backups in the ordinary backup rotation cycle.
• Account deletion — you may request deletion of your entire account and its content at any time (§18). We action account deletion within 30 days, subject to any legal retention obligations, and confirm when complete.
• Usage Data — retained in identifiable form only as long as needed for the purposes in §5, then deleted or aggregated.
• Billing records — retained as required by Australian tax and corporations law (generally 7 years).

11. Cookies and website analytics

The Platform uses strictly necessary cookies for authentication and session management. We do not use third-party advertising cookies or cross-site tracking. Any website analytics we operate are first-party and measure aggregate page usage only.

12. Direct marketing

We send product and feature communications only where you have opted in or would reasonably expect them, and every such message contains a working unsubscribe. We never use Your Content for marketing, never disclose your details to third-party marketers, and honour opt-outs immediately (APP 7).

13. Anonymity and pseudonymity

You may browse our public pages without identifying yourself. Because the Platform stores confidential working material against authenticated accounts, we cannot provide the logged-in service anonymously — identification is required to secure your data to you (APP 2).

14. Data breach response

If a data breach occurs that is likely to result in serious harm to any individual, we will: contain and investigate the incident; notify affected users promptly with a description of the breach, the information involved, and the steps we recommend; and notify the Office of the Australian Information Commissioner, all in accordance with the Notifiable Data Breaches scheme. Given the professional sensitivity of Your Content, our notification to you will be specific enough for you to assess any obligations you may have to your own clients.

15. Your rights: access, correction and complaints

• Access — you may request a copy of the personal information we hold about you. We respond within 30 days.
• Correction — you may ask us to correct inaccurate information; most account information can be corrected directly in the Platform.
• Export — you can export Your Content from the Platform, and may request an export as part of account closure.
• Complaints — contact us first (§18); we acknowledge complaints within 7 days and aim to resolve them within 30. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, GPO Box 5288 Sydney NSW 2001.

16. Users outside Australia

The Platform is designed for Australian legal practice. If you access it from outside Australia, you do so on the basis that your information will be handled in accordance with this policy and Australian law. Where overseas privacy laws grant you additional rights, we will honour reasonable requests to exercise them.

17. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the Platform or by email before they take effect. The “last updated” date at the top reflects the current version, and prior versions are available on request.

18. Contact us

Privacy questions, access or correction requests, deletion requests, and complaints: privacy@briefbridge.com.au.

See also our Terms of Service.