BRIEFMADE / INFORMATION

Privacy notice

This notice explains what happens to information when you visit BriefMade, prepare a launch brief, contact us or pay for an agreed project. Last updated 21 September 2026.

Who is responsible?

BriefMade is a trading name of John Bruce Consulting Ltd, company number 17450810, registered in England and Wales. Our registered office is 60 Humberston Avenue, Humberston, Grimsby, England, DN36 4SS. The company is the controller for personal information it receives for its business purposes. Contact us at john@bruceltd.com. Further business details appear on the Contact page.

The launch planner and submitted briefs

Before submission, entries are held in the current page. When you submit, we receive your name, email, project description, package and service choices, including any Care plan, preferred domain and alternatives, content readiness, preferred date and your terms/early-start choices. We save these privately in the website’s platform-managed database to handle your enquiry, quote and order. No brief is published in the template catalogue.

We record a project reference, submission time, the applicable terms version, payment stage and verification status. We use a short-lived hashed network identifier and request counters to limit abusive submissions; rate-limit records expire after two hours. Our legitimate interest is operating a secure enquiry service.

A random private access token allows access to your project space, uploaded files, answers, plan approvals and payment summary. Its hash is stored in the database. Your browser’s session storage keeps the token during checkout; a private confirmation link can also be saved. Treat that link as confidential: anyone with it can view your project and approve its plan. Private links expire after 7 days. The original welcome link expires 7 days after your brief is created; each new project-update link expires 7 days after it is created. Reply to your BriefMade email if you need a new link. Link expiry does not delete your project records; the retention periods below still apply. We do not store the brief itself in browser storage. Downloading a copy alone does not submit it.

We use submitted information to take steps at your request before a contract, perform your contract, or, for business representatives, pursue our legitimate interest in managing the business enquiry. Do not include passwords, payment-card details or sensitive personal information.

Your project space and files

We store follow-up questions, your answers, file names and notes, readiness confirmations, plan versions, approval names and times, and project activity in the platform-managed database. Uploaded photos, logos and PDFs are stored separately in private platform-managed object storage. Files are retrieved through the project’s access checks; we do not publish an open file directory. The owner’s project desk requires sign-in and an owner account check.

Before an uploaded file is stored, it is sent securely to Scanii, a service from Uva Software LLC, for automated malware scanning in its London processing region. A file that produces a security finding or an unverifiable result is rejected and is not saved by BriefMade. Scanii processes file contents transiently for analysis, deletes the contents when analysis completes, and retains a result record under its service arrangements. See Scanii’s privacy information and security overview.

We use this information to understand your requirements, agree a build and deliver the requested work. Removing a file from your current selection does not remove it from an earlier published plan: we retain that version and its files as a record of the agreement. Contact us if you need information corrected or deleted. Project records and files follow the project correspondence retention periods below.

Visiting the site

Hosting and network providers necessarily process request information such as IP address, requested pages, timestamps and browser information to deliver and secure the site. BriefMade is published through ChatGPT Sites, a service provided by OpenAI. OpenAI and its listed subprocessors, including Cloudflare, Ltd. for content delivery and web hosting, may process technical logs to host, deliver, secure and support the site. See OpenAI’s current sub-processor list. We do not add advertising trackers or social-media embeds. We use limited cookieless analytics to understand whether the website is working: page views, broad traffic source category, template preview clicks and clicks to start the brief. Analytics does not set cookies or local storage, does not store URL queries or fragments, does not record form text, names or email addresses, and does not store raw IP addresses. A temporary in-memory visit reference is created while a page is open so the owner dashboard can count visits. Traffic measurements are retained for up to 90 days. Our owner dashboard also summarises operational brief and verified initial-payment records. Read our cookie notice for the distinction between analytics, the planner and hosting technologies.

Our purpose in using hosting is to provide a working, secure website; our lawful basis for any related personal data processing under our control is our legitimate interest in doing so. Service-provider logging and retention are subject to their arrangements; we have not set a separate application log-retention period.

If you send us an enquiry

If you use the BriefMade contact form, we receive your name, email, message and response preference, plus your phone number and preferred contact time if you request a call. We send a copy to our support mailbox and an acknowledgement to you through Resend.

We use the contact details and project information you choose to send to respond, assess the work and prepare a quote. Where you are the prospective contracting person, the basis is taking steps at your request before a contract. Where you represent a business, our basis is the legitimate interest of handling that business enquiry.

We do not use an enquiry as automatic permission for marketing. We do not sell personal information or make solely automated decisions with legal or similarly significant effects.

Email correspondence

You can submit your brief without using an email application. Our support mailbox is john@bruceltd.com and uses Namecheap Private Email. Namecheap processes message content, addresses, attachments and technical mail data to provide the mailbox. Its arrangements are described in Namecheap’s privacy policy. We may reply to your enquiry using this mailbox. We use Resend to send your brief confirmation, project updates and private project links, and to notify our team about your brief and key review or approval steps. Resend processes the recipient address, message content and delivery information for this purpose. See Resend’s privacy policy. We have not enabled email open or click tracking. Submission is not permission for marketing.

Project payments through Stripe

When an eligible standard Website Launch continues to checkout, or you use our payment page for an existing quote, we send your project reference, email, amount and any selected Care billing interval to Stripe to prepare and match checkout. Do not put personal or confidential information in a payment reference. Stripe hosts the checkout and collects your name, email, project reference, billing information and payment-method details. If you select Care, Stripe also creates and manages the recurring annual or monthly payment instruction. Stripe processes technical and transaction information for security and fraud prevention.

We receive the information needed to manage the payment, Care subscription and project, including customer contact details, the amount, currency, payment or subscription status, reference, receipt and limited payment-method information. We do not receive your full card number or security code. Information required at checkout is needed to process the payment; without it you cannot complete that checkout.

We use these records to perform your contract, handle refunds and support, meet accounting obligations and prevent fraud or resolve disputes. Our lawful bases are performance of a contract where you are the contracting person, our legitimate interests in managing business-customer relationships and protecting transactions, and compliance with applicable legal obligations for financial records. Payment is not consent to marketing.

Stripe may act as a processor for payment services and as a controller for its own purposes. Its processing may involve countries outside the UK, using the applicable transfer arrangements described in Stripe’s privacy policy ↗. That policy explains its data use, safeguards and contact routes. We use Stripe for hosted checkout; we do not embed Stripe tracking scripts in our website pages.

Sharing and retention

Enquiries sent through an external email or messaging service are handled by that service as well as us. Access within our business is limited to what is needed to answer and manage the enquiry. Stripe receives payment information as described above. We may also share relevant records with professional advisers or public authorities where needed for accounting, legal obligations or resolving a claim. Any additional hosting, email or project-delivery providers needed for a customer project will be identified before those services are connected.

Unsuccessful enquiries are normally deleted or anonymised within 12 months of the last substantive contact unless a longer period is necessary for an active dispute or another legal obligation. Project correspondence is retained for the agreed work and normally for up to six years after completion to handle contract queries and claims. Company accounting and payment records are normally kept for six years from the end of the financial year they relate to, and longer where a legal requirement or unresolved claim applies. Technical hosting records follow the hosting provider’s retention arrangements. Where providers transfer personal information internationally on our behalf, applicable transfer safeguards must be in place; project-specific arrangements are confirmed before confidential or customer data is shared.

Your choices and rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. Some rights have legal exceptions. Email john@bruceltd.com or use the contact route already provided in your business correspondence.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint ↗. You do not need to contact us first to exercise that right.

Changes

We will update this notice when our services or uses of personal information change, including before introducing additional uses of your information or non-essential tracking.