PREVIEW — not the final published text. The following entity details are still unset:

ADDRESS, ANSCHRIFT, COMPANY, COMPETENT GERMAN STATE DATA PROTECTION AUTHORITY, DATE, DATENSCHUTZ-E-MAIL, DATUM, Impressum: URL, JURISDICTION, Managing director(s): NAME, POSTCODE, CITY, PRIVACY EMAIL, STREET, NO., SUPPORT EMAIL, SUPPORT-E-MAIL, URL, legal form

. Complete docs/legal/site/entity.json, rebuild and redeploy before submitting the app to App Review.

Privacy Policy

Effective date: [DATE]

App: Brief — understand official letters ("the App")

Applies to: the iOS application distributed via the Apple App Store in Germany.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

[COMPANY] ([legal form])

[STREET, NO.]

[POSTCODE, CITY], Germany

E-mail: [PRIVACY EMAIL]

[Managing director(s): NAME]

[If applicable: Data Protection Officer contact — [DPO NAME / EMAIL], or note that no DPO is required under Art. 37 GDPR / § 38 BDSG]

2. Our privacy approach in one paragraph

Brief is designed to be privacy-first. Text recognition (OCR) of your document photos happens entirely on your device. Only when you request an AI analysis is a sanitized text excerpt of the recognized text sent — through our own secure backend proxy — to an AI service for processing. Your documents are never stored on our servers after processing, we run no advertising SDKs, no third-party tracking, and document content never appears in our logs.

3. What data is processed, where, and why

3.1 Document photos and OCR text — on your device only

When you photograph or import an official letter, the image and the OCR text extracted from it are processed and stored locally on your device (in the App's protected storage, covered by iOS data protection/encryption).
Photos and OCR text are not uploaded to us or anyone else as part of scanning. OCR runs fully on-device using Apple's on-device frameworks.
Locally stored documents remain under your control: you can delete individual documents or all App data at any time inside the App (see Section 9).

3.2 Text excerpts sent for AI analysis — via our backend proxy

When you actively request an analysis, the App sends the recognized text (and, where necessary for quality, limited structural metadata such as document type hints and your selected UI language) to our backend.
Before sending, the App applies sanitization measures [DESCRIBE FINAL SANITIZATION SCOPE — e.g. removal/reduction of certain identifiers where feasible]. Note: because the purpose of the service is to explain your letter, the transmitted text can inherently contain personal data (e.g. your name, address, file numbers).
Our backend acts as a proxy: it forwards the text to our AI provider (Section 6), returns the result to your device, and does not persist document content. Document text is processed transiently in memory and is not written to server-side logs or analytics.
Transmission is encrypted in transit (TLS).

3.3 Anonymous install identifier

The App uses a randomly generated, anonymous install identifier (not linked to your name, email, Apple ID, or device serial). Purposes: enforcing the free tier and the Pro fair-use limit (50 AI analyses per month), abuse prevention, and technical troubleshooting.
The identifier is reset if you delete and reinstall the App [CONFIRM IMPLEMENTATION].

3.4 Subscription status via Apple

Purchases are handled entirely by Apple (App Store / StoreKit 2). We do not receive your name, address, or payment details from Apple. We receive/verify only subscription entitlement information (e.g. signed transaction/renewal info, product ID, expiry, original transaction ID) to unlock Pro features and prevent fraud.
Apple's own processing is governed by Apple's privacy policy.

3.5 Technical data strictly necessary for operation

When the App communicates with our backend, standard connection data is processed (IP address, timestamps, request status). IP addresses are used only for connection handling and security and are [not stored / stored for max. [X] days in security logs — CONFIRM]. Document content never appears in logs.

3.6 What we do NOT do

No advertising, no ad SDKs, no third-party tracking or analytics SDKs, no fingerprinting, no sale or sharing of personal data for marketing, no profiling for advertising purposes, no use of your documents to train AI models [CONFIRM CONTRACTUALLY WITH AI PROVIDER — see Section 6].

4. Legal bases (Art. 6 GDPR)

Processing	Legal basis
Providing the core service you request (OCR on device; AI analysis of text you submit; returning results; free-tier/fair-use accounting; subscription entitlement checks)	Art. 6(1)(b) GDPR — performance of a contract / steps at your request
Security, abuse prevention, ensuring technical stability, defense of legal claims	Art. 6(1)(f) GDPR — legitimate interests (secure and reliable operation of the App; interests balanced against your rights, given the minimal data involved)

[If ever introduced: optional features requiring consent, e.g. optional cloud backup]	[Art. 6(1)(a) GDPR — consent; NOT currently used]

5. Special categories of data (Art. 9 GDPR) — important notice

Official letters you choose to scan may contain special categories of personal data within the meaning of Art. 9(1) GDPR — for example health information (medical or insurance letters), data revealing legal proceedings, or other sensitive content.

Such data is processed only at your own initiative: you decide which document to photograph and whether to request an AI analysis. [COUNSEL TO CONFIRM the Art. 9(2) basis relied upon — e.g. Art. 9(2)(a) explicit consent obtained in-app before first analysis, and/or Art. 9(2)(e) where applicable; recommend implementing an explicit in-app consent step before the first AI analysis.]
Sensitive content is used exclusively to generate the analysis you requested. It is never used for advertising, profiling, model training, or any other purpose, and is not retained server-side after processing (Section 7).

6. Recipients and processors

We use a small number of service providers as processors under Art. 28 GDPR, bound by data processing agreements:

Processor	Purpose	Location / transfer safeguard
[AI PROVIDER — NAME, ENTITY, ADDRESS]	Generating AI analyses from the text excerpts you submit	[EU region / third country — specify. If outside EU/EEA: transfer mechanism per Section 6.1] · [CONFIRM: zero data retention / no-training terms in the DPA]
[HOSTING PROVIDER — NAME, ENTITY, ADDRESS]	Hosting our backend proxy	[EU region preferred — specify]

Apple Inc. / Apple Distribution International Ltd.	App distribution, in-app purchases, subscription management	Apple acts largely as an independent controller for App Store transactions

We do not share personal data with any other third parties, except where required by law or to establish, exercise, or defend legal claims.

6.1 International transfers

Where a processor processes data outside the EU/EEA, we ensure an adequate level of protection via: an adequacy decision of the European Commission (Art. 45 GDPR — including, for certified US providers, the EU-U.S. Data Privacy Framework), or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures where needed. [SPECIFY per provider once contracts are final. Preference: EU-region processing endpoints for the AI provider where available.]

7. Retention

Server-side: document text is processed transiently and never stored after processing completes. No copies, no backups of document content. [Security/connection logs without content: max. [X] days — CONFIRM.]
On your device: scanned documents, OCR text, analyses, and drafted replies are stored locally until you delete them (per document, or via "Delete all data" in Settings). Deleting the App removes all local App data.
Subscription/entitlement records: minimal entitlement data is kept for as long as needed to provide Pro and to meet statutory retention duties (e.g. tax/commercial law, §§ 147 AO, 257 HGB, where applicable to transaction records) [COUNSEL TO CONFIRM scope — payment records live with Apple].
Anonymous install identifier and fair-use counters: kept while the App is installed; counters cover rolling monthly windows.

8. No advertising, no tracking

The App contains no advertising SDKs and no third-party tracking. We do not track you across apps or websites. Accordingly, the App does not request App Tracking Transparency permission, and the App Store privacy label reflects "Data Not Linked to You" categories only [ALIGN FINAL PRIVACY LABEL WITH IMPLEMENTATION].

9. Your rights — and how the App maps to them

You have the following rights under GDPR:

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21), and the right not to be subject to automated decision-making with legal effects (Art. 22 — the App's analyses are informational only and produce no legal effects; a human — you — always decides what to do).
In-app self-service: the App includes an Export function (export your documents, analyses, and drafts in a portable format — supports Art. 15/20) and a Delete all data function (removes all local data; since we store no document content server-side, this effectively erases your content — supports Art. 17).
For anything else (e.g. questions about backend-side data such as entitlement records), contact us at [PRIVACY EMAIL]. We answer within one month (Art. 12(3) GDPR).
Where processing is based on consent, you may withdraw it at any time with effect for the future.

10. Children

The App is not directed at children. It is intended for persons who receive official correspondence, i.e. generally 16 years or older [COUNSEL TO CONFIRM age threshold / App Store age rating alignment]. We do not knowingly process children's data.

11. Data security

We use appropriate technical and organizational measures (Art. 32 GDPR): TLS encryption in transit, iOS on-device encryption at rest, minimal-data architecture (on-device OCR, transient server processing), access controls, and no content logging. No method of transmission is 100% secure; we continuously review our measures.

12. Changes to this policy

We may update this policy when the App or legal requirements change. The current version is always available in the App and at [URL]. For material changes we will inform you in the App. The "Effective date" above shows the latest revision.

13. Contact and supervisory authority

Privacy questions and rights requests: [PRIVACY EMAIL]
You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. The supervisory authority competent for [COMPANY] is: [COMPETENT GERMAN STATE DATA PROTECTION AUTHORITY — e.g. depends on the federal state of the company seat], [ADDRESS, WEBSITE].