Privacy Policy

1. Introduction

FlashBrief ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our personalized audio news briefing service at flashbrief.app (the "Service").

This policy is designed to comply with the European Union General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.

By using FlashBrief, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Service.

2. Data Controller

The data controller responsible for your personal information is:

For the purposes of data protection law, we are the "controller" of the personal information we process, meaning we determine the purposes and means of processing your personal data.

3. Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information from Third Parties

We may receive information about you from third-party services you connect to FlashBrief, such as authentication providers.

4. Legal Basis for Processing (GDPR Article 6)

Under GDPR, we must have a valid legal basis to process your personal data. We rely on the following bases:

4.1 Performance of Contract (Article 6(1)(b))

We process the following data because it is necessary to fulfill our contract with you (providing the FlashBrief service):

• Account information (to create and manage your account)
• Preferences (to generate personalized briefings)
• Payment information (to process subscriptions)

4.2 Legitimate Interests (Article 6(1)(f))

We process the following data based on our legitimate interests, balanced against your rights:

You have the right to object to processing based on legitimate interests (see Section 8).

4.3 Consent (Article 6(1)(a))

We rely on your consent for:

• Marketing communications: Promotional emails about new features (you can opt out at any time)
• Episode transcript emails: Optional email delivery of episode content

You may withdraw consent at any time by updating your preferences in the dashboard or contacting us at privacy@flashbrief.app. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

4.4 Legal Obligation (Article 6(1)(c))

We may process data to comply with legal obligations, such as:

• Tax and accounting requirements for payment records
• Responding to valid legal requests from authorities

5. How We Use Your Information

We use the information we collect to:

• Generate and deliver personalized audio news briefings based on your preferences
• Send episode notifications and transcripts via email (when enabled)
• Process subscription payments and manage your account
• Provide customer support and respond to your inquiries
• Improve our Service, including content quality and user experience
• Send important service announcements (e.g., changes to terms, security alerts)
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations

We will not use your personal data for purposes incompatible with those listed above without notifying you and, where required, obtaining your consent.

6. Third-Party Processors (Sub-processors)

We share your data with the following third-party service providers who process data on our behalf. Each processor is contractually bound to protect your data and process it only as we instruct.

6.1 Infrastructure and Hosting

6.2 Payment Processing

6.3 AI Content Generation

6.4 Processor List Updates

We may update our list of processors from time to time. Material changes will be reflected in this policy with an updated date.

7. International Data Transfers

FlashBrief is operated from the United States, and our primary data storage is on servers located in the United States (AWS us-east-1 region).

7.1 Transfer Mechanisms for EU/UK Data

When we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries not deemed to provide an adequate level of data protection, we use the following safeguards:

1. EU-US Data Privacy Framework: Where our processors are certified under the DPF (e.g., AWS, Stripe)
2. Standard Contractual Clauses (SCCs): We enter into EU Commission-approved SCCs with processors not covered by adequacy decisions or the DPF
3. Supplementary Measures: Where necessary, we implement additional technical and organizational measures to ensure adequate protection

7.2 Your Rights Regarding Transfers

You have the right to request information about the safeguards we have in place for international transfers. Contact privacy@flashbrief.app for details.

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights. We will respond to valid requests within one month.

9. Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority.

For EU Residents

You may complain to the supervisory authority in your EU member state of residence, place of work, or where the alleged infringement occurred.

List of EU supervisory authorities →

For UK Residents

For Other Jurisdictions

Contact your local data protection authority.

We encourage you to contact us first at privacy@flashbrief.app so we can attempt to resolve your concern directly.

10. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy or as required by law.

After the retention period, data is securely deleted or anonymized.

Data After Account Deletion

When you delete your account:

• Account data is deleted within 90 days
• Audio files and transcripts are deleted immediately
• Payment records are retained as required by law (anonymized where possible)
• Backup copies are purged within 30 days of deletion from primary systems

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Technical Measures

• Encryption in transit: All data transmitted using TLS 1.2+
• Encryption at rest: Database encryption using AES-256
• Secure authentication: AWS Cognito with secure password policies
• Access controls: Principle of least privilege for system access
• Regular updates: Security patches applied promptly

Organizational Measures

• Access to personal data limited to personnel who need it
• Confidentiality obligations for anyone accessing data
• Regular security assessments
• Incident response procedures

Security Incident Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

1. Notify the relevant supervisory authority within 72 hours
2. Notify you without undue delay if the breach is likely to result in high risk to you

12. Cookies and Tracking Technologies

12.1 Cookies We Use

FlashBrief uses the following cookies:

12.2 What We Do NOT Use

We do not use:

• Third-party advertising cookies
• Cross-site tracking
• Social media tracking pixels

12.3 Your Cookie Choices

Strictly necessary cookies cannot be disabled as they are essential for the Service to function. You can configure your browser to block cookies, but this may prevent you from using FlashBrief.

13. Children's Privacy

FlashBrief is not intended for children under 16 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@flashbrief.app. We will delete such information promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

How We Notify You

• Minor changes: Updated policy posted with new "Last updated" date
• Material changes: Email notification to your registered address at least 14 days before changes take effect

Your Continued Use

Your continued use of FlashBrief after changes take effect constitutes acceptance of the updated policy. If you do not agree with changes, you may delete your account before they take effect.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about our data practices, please contact us:

We aim to respond to all inquiries within 30 days. For data subject requests under GDPR, we will respond within one month as required by law.

Summary of Your Key Rights