Skip to content
Brevity

Privacy Policy

Last updated:

This Privacy Policy explains how Brevity AI("we", "us", "our") processes personal data when you visit usebrevity.co, create an account, or use Brevity AI (the "Service"). We operate from Belgium and design the Service with EU data protection in mind.

1. Data controller

Brevity AI
Belgium
Privacy enquiries: privacy@usebrevity.co

2. Personal data we collect

Account & identity

  • Name and email address when you register or sign in
  • Authentication data (hashed password, session tokens, optional two-factor settings)
  • Email verification and password-reset tokens

Studio & content

  • Prompts, scripts, brand-kit details, and files you upload
  • Generated images, videos, and related metadata (format, status, timestamps)
  • For videos you choose to publish to Explore: publication status, category, and aggregate Explore play count
  • AI character definitions and generation history
  • Usage and credit-consumption records

Billing

  • Payment and invoice status, subscription status, plan, credit balances, and Stripe customer/subscription/payment identifiers
  • Payment card and invoice details are collected and processed by Stripe Managed Payments as Merchant of Record — we do not store full card numbers

Technical & usage

  • IP address, browser type, and device signals stored with your session
  • Server and application logs, error reports, and security events
  • Aggregated analytics (e.g. page views) where enabled — see Cookies & analytics

3. Why we process your data (legal bases)

Under the GDPR we rely on the following bases:

  • Contract — to provide the Service, manage your account, generate content, and fulfil purchases and subscriptions
  • Legitimate interests — to secure the Service, prevent abuse, improve reliability, and understand aggregate usage (balanced against your rights)
  • Legal obligation — tax, accounting, and compliance records where applicable
  • Consent — where required for non-essential cookies, optional marketing communications, or publishing one of your videos to the public Explore gallery

4. How we use your data

  • Create and authenticate your account and studio workspace
  • Run AI generation workflows (script, voice, image, and video pipelines)
  • Store and deliver your media assets
  • Display videos you explicitly publish to Explore and count aggregate Explore plays so visitors can sort the gallery by popularity
  • Process subscriptions, one-time credit-pack purchases, credit balances, and support requests
  • Send transactional email (verification, security, billing confirmations)
  • Detect fraud, enforce our Terms, and protect the Service

We do not sell your personal data.

Public Explore gallery

Your generated videos remain private unless you explicitly publish a finished video to Explore. A published video can be viewed by anyone and may be indexed by search engines. The public listing does not expose your account identity, prompt, script, uploads, or private project data. You can unpublish at any time from the video workspace; this removes it from new Explore requests, subject to short-lived caches.

5. Processors & third parties

We use carefully selected providers that process data on our instructions. Depending on the features you use, data may be shared with:

  • Stripe — subscription and one-time purchase billing, invoicing, EU VAT (Merchant of Record)
  • Cloudflare R2 — EU-resident media storage for uploads and generated assets
  • AI providers — e.g. fal.ai (image/video), ElevenLabs (voice), OpenRouter (text) — prompt and asset data needed to fulfil your generation request
  • Firecrawl — website scraping during onboarding when you submit a brand URL
  • Resend — transactional email delivery
  • Trigger.dev — background job orchestration for long-running generation tasks
  • Hosting & infrastructure — application hosting, databases, and content delivery

Each provider is bound by a data-processing agreement or equivalent contractual safeguards where required. Sub-processors may change as we improve the Service; we will update this policy when materially different providers are introduced.

6. Cookies & similar technologies

We use cookies and local storage for essential operation of the Service:

  • Session cookies — keep you signed in (Better Auth session)
  • Security cookies — CSRF and abuse protection where enabled
  • Preference cookies — e.g. theme selection

Where we enable privacy-friendly analytics (such as Vercel Analytics), those tools may set additional cookies or use similar technologies. Non-essential tracking will only run with your consent where required by law.

You can control cookies through your browser settings. Blocking essential cookies may prevent you from using the Service.

7. Retention

  • Account data — kept while your account is active; deleted or anonymised within a reasonable period after you delete your account, subject to legal retention needs
  • Generated media — kept until you delete it or close your account, unless we must retain copies for legal or security reasons
  • Billing records — retained as required by tax and accounting law (typically up to 7 years in Belgium)
  • Logs — rotated on a short rolling basis unless needed for incident investigation

8. International transfers

We prioritise EU/EEA hosting and storage. Where a provider processes data outside the EEA, we implement appropriate safeguards — such as the EU Standard Contractual Clauses — and limit transfers to what is necessary to deliver the Service.

9. Your rights

If you are in the EEA, UK, or another jurisdiction with similar laws, you may have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Erase data ("right to be forgotten") in certain circumstances
  • Restrict or object to processing in certain circumstances
  • Data portability for data you provided, where technically feasible
  • Withdraw consent where processing is consent-based
  • Lodge a complaint with your local supervisory authority

In Belgium, the lead authority is the Data Protection Authority (APD/GBA). To exercise your rights, email privacy@usebrevity.co. We may need to verify your identity before responding.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children. Contact us if you believe a child has provided personal data.

11. Security

We apply technical and organisational measures appropriate to the risk — including encryption in transit, access controls, and isolated storage for user media. No method of transmission or storage is 100% secure; please use a strong, unique password and enable two-factor authentication where available.

12. Changes

We may update this policy from time to time. Material changes will be posted on this page with a revised "Last updated" date. Continued use after changes take effect constitutes acceptance where permitted by law.

13. Contact

Questions about this policy or our data practices: privacy@usebrevity.co
General enquiries: hello@usebrevity.co

See also our Terms of Service.