Privacy Policy

Last updated: August 27, 2026

The short version. If you're a guest at a restaurant using Brief First: you can use the page without an account, nothing about you is recorded unless you deliberately send or save something, the restaurant sees exactly what you wrote and nothing more, and being remembered only ever happens because you chose it. If you run a business on Brief First: we keep what's needed to run your account, billing lives with Stripe, and your guests' words belong to your relationship with them — we never sell anyone's data, and we never send marketing to your guests.

1 · If you're a guest or visitor

No account, no tracking wall. You can open a venue's page, read the menu, and chat without signing up or identifying yourself.

Conversations. What you type is processed to generate the answer — including by our AI provider (Anthropic) — and conversations are kept for 30 days for continuity and troubleshooting, then deleted. Conversations are not used to build a profile of you and are not sold or shared for advertising.

Records you choose to send. A message reaches the venue only when you deliberately send one — the private line, the praise line, an event enquiry, a service request, an order. What arrives is what you wrote, verbatim: nothing is scored, summarized, or filtered, and the venue is told only what you sent.

Being remembered — the guest book. A venue's guest book stores your name, your email, and the specific lines you marked to be remembered — only when you explicitly choose to join, and only the items you chose. Nothing is inferred or added behind your back. Recognition works through a token stored on your own device: the page greets you on that device, and tapping "Not you?" clears it immediately. To be removed from a venue's guest book, ask the venue — or ask us (hello@brieffirst.com) and we'll handle it.

Service-business intake pages. On a first-contact page (for example, a service business using Brief First for intake), what you write in the conversation — including contact details you provide — is gathered into a written brief and delivered to that business. The same rules apply: verbatim delivery, no profiles, no resale.

What we never do with guest data. We don't sell it, share it for advertising, combine it across venues, or email you — the platform sends no marketing to guests, full stop. If a venue wants to invite you to something, they send it themselves, from their own email, to an address you chose to give them.

2 · If you run a venue on Brief First

Account data: your name, email, and sign-in method (Google sign-in shares your name and email with us; we don't see your Google password). Venue data: the content you publish and your venue's public listing details (looked up via Google Places when you pick your venue). Billing: handled by Stripe — your card details go to Stripe, not to us; we hold the subscription state and invoices. Usage: we meter host use to run the credit and plans, and keep operational logs to run the service.

3 · Who processes data for us

We use a small set of providers, each doing one job: Supabase (database and authentication; hosted in the United States), Anthropic (generates the AI host's responses), Stripe (payments), Vercel (hosting), Resend (transactional email — sign-in links and account notices, never marketing to guests), Google (sign-in for venue owners; Places for venue lookup). Each receives only what its job requires.

4 · Cookies and device storage

We use no advertising or analytics trackers on guest pages. What exists: a session cookie for signed-in venue owners; a short-lived referral cookie (30 days) that records which invitation brought a new venue to us, so we know which of our own outreach worked; and the recognition token described above, stored on a guest's device only after they chose to be remembered, removable with one tap.

5 · Retention

Guest conversations: 30 days, then deleted. Records a guest chose to send, and guest-book entries: kept for the venue until the venue or the guest deletes them. Venue account data: while the account is active, then deleted on request per Terms §13. Billing records: retained as required by law.

6 · Sensitive information

Don't tell the host things it doesn't need. By design, the platform composes no health information about anyone: if a guest shares a dietary restriction or allergy, it's used to answer them in the moment, and stored only if the guest explicitly marked it to be remembered — in the guest's own words, never as our characterization.

7 · Your rights

Wherever you are, we honor the substance of data rights: to know what we hold about you, to get a copy, to correct it, and to have it deleted. Guests: the fastest path for venue-held records is the venue itself; for anything else, or if you'd rather not go through the venue, email hello@brieffirst.com and we'll act on it. California residents: we don't sell or share personal information as the CCPA defines those terms, and we honor access and deletion requests as above. We don't discriminate against anyone for exercising a right.

8 · Children

Brief First is not directed at children under 13, and we don't knowingly collect their personal information. A child at a restaurant table can read a menu page; accounts and the guest book are for adults.

9 · Changes

We'll post changes here with a new date; material changes get notice to venue accounts by email.

10 · Contact

hello@brieffirst.com — privacy questions, access or deletion requests, or anything this page didn't answer.