Data Processing Schedule

Roles

The customer decides what documents are uploaded and why. For the tender documents and any personal information in them, the customer is the entity with the primary obligations under the Privacy Act 1988 (Cth). In the language used by customers subject to equivalent overseas law, the customer is the controller. SpecBrief processes that material as a processor, on the customer's documented instructions.

SpecBrief is a controller in its own right for the narrow set of records it needs to run a business: account identifiers, authentication records, usage counters, billing records and security logs. Those are described in the Privacy & Data Handling notice.

Documented instructions

The customer's instruction is to host, extract, analyse and return the requested brief, and to provide support for it. SpecBrief processes customer documents for no other purpose. In particular, SpecBrief does not use customer documents to train SpecBrief models, does not use customer documents, briefs or information extracted from them to improve SpecBrief or any AI model, and does not sell them, license them onward or use them for marketing. Any future improvement use would apply only to an account whose administrator chooses to opt in.

If an instruction appears to require SpecBrief to break the law, SpecBrief will say so rather than carry it out quietly.

Particulars of processing

Subject matter	Reading an uploaded tender pack and producing a source-cited brief of what one trade must price and comply with.
Duration	For as long as the account is open, subject to the retention periods in section 8. Deletion follows termination.
Nature and purpose	Storage, text extraction, analysis by a paid commercial AI service, generation and delivery of the brief, and support and security work on the account.
Types of personal information	Account identifiers and authentication records for the customer's users; usage and billing records; and any personal information the customer's own documents happen to contain, such as the names, roles and contact details of people involved in a project.
Categories of individuals	The customer's personnel and invited users, and individuals named in documents the customer uploads.
Sensitive information	Not requested and not required for the service. Do not upload health, biometric or other sensitive information, or government identity documents.

Customer obligations

The customer is responsible for ensuring that personal information in the documents it uploads was lawfully collected, that any notice or consent those individuals are owed has been given, that it is authorised to have SpecBrief process the documents as described here, and that it uploads no more personal information than the tender requires. The customer is responsible for its own obligations to regulators and to the individuals concerned.

Confidentiality and access

Customer documents are treated as confidential. Access by SpecBrief personnel is limited to what support, security, deletion and legal obligations actually require, and the reason for administrative access is recorded. SpecBrief personnel do not read customer documents or briefs for any other purpose.

Separation between customer organisations is enforced by the application and by database row-level security policies tied to the organisation context of each request. Production uses a non-bypass database role, and the database service key is not present in the production service. Administrative access remains restricted and recorded as above.

SpecBrief may retain or disclose customer data where required by law, court order or a regulator, and will tell the customer where that is lawful and practicable. A retention period in this schedule does not override such a requirement.

Security

The controls and providers in use are described on the Security & Data Processing page. That page is an operational summary, not a certification statement, and SpecBrief holds no security certification today. The customer is responsible for the security of its own devices, user accounts and API keys.

Subprocessors

The current subprocessors, what each one does and where it does it are listed in one place: the Security & Data Processing page. They are deliberately not repeated here, so there is only ever one list to keep correct. SpecBrief uses subprocessors that provide published data-protection terms for the service they supply.

Before a new subprocessor begins processing customer documents, SpecBrief will give the account's administrators at least 14 days' notice by email and publish the change on that page. A customer that objects on reasonable data-protection grounds may raise it at hello@specbrief.com.au. SpecBrief will try to resolve it, which may include not using that subprocessor for that customer's data. If it cannot be resolved, the customer may stop uploading and terminate in accordance with the Terms, with a refund of the unused portion of prepaid fees, including unused purchased Credits. This right also applies to a partly used purchase or one older than 30 days and is handled through support. Where a subprocessor must be replaced urgently for security or availability, SpecBrief may give shorter notice and will explain why.

Retention, deletion and return

The detailed position is in the Privacy & Data Handling notice. In summary:

• Raw uploads are deleted when a read ends. A held pack expires after 30 minutes.
• A generated brief expires 30 days after it is made, unless it is attached to a pack the customer has deliberately chosen to retain for longer.
• Pack retention is off by default. An administrator can turn it on and set a period of up to 365 days. Any pack can be deleted from its brief at any time.
• Database backup artifacts are encrypted and age out after 30 days.

Before termination, the customer should download any brief still available within its retention period. SpecBrief deletes customer documents and briefs as described in the Privacy notice. Termination does not extend retention or recover an expired or lost copy. One limit is worth stating plainly rather than burying: deleting a record from the live database does not remove it from an encrypted backup that already exists. It leaves when that backup ages out, within 30 days. Copies held by the AI model provider under its own logging terms follow that provider's retention, as described in the privacy notice.

Assistance with individuals' requests

If an individual asks the customer for access to, correction of, or deletion of personal information held in the service, SpecBrief will help the customer respond. Email hello@specbrief.com.au. SpecBrief acknowledges promptly, investigates, and aims to respond in writing within 30 days. Ordinary assistance is included; assistance that requires substantial work beyond the service may be charged at a reasonable rate agreed in advance.

Security incidents

Report a suspected issue to security@specbrief.com.au. Do not include passwords, access tokens or tender documents in the first message.

If SpecBrief becomes aware of a security incident affecting a customer's data, it will notify the account's administrators without undue delay, and will provide what it knows: what happened, which data and accounts are affected so far as that is known, what has been done to contain it, and what the customer may need to do. SpecBrief will assist the customer with any assessment or notification the customer is required to make, including under the Notifiable Data Breaches scheme. Notifying or assisting a customer about an incident is not an admission of fault or liability.

Information about compliance

On reasonable written request, and not more than once in any 12-month period unless an incident or regulator requires it, SpecBrief will answer written questions about its compliance with this schedule within 30 days. SpecBrief will not provide access to other customers' data, security-sensitive detail that would weaken the service, or its providers' confidential material.

Liability and order of documents

Liability arising under or in connection with this schedule is subject to the limits of liability in the Terms, which apply to this schedule as if set out in it, except where those limits cannot lawfully apply.

Order of documents. The order of documents in clause 4 of the Terms applies: a written agreement signed by both parties, then this schedule on a data-processing question, then the Terms, then the Privacy & Data Handling notice, then other published pages.

Changes

SpecBrief will publish a changed schedule here with a new effective date, and will notify account administrators of a material change before it takes effect. A change never applies retroactively to documents already uploaded.