Privacy & Data Handling Notice

Who we are and how to contact us

SpecBrief Pty Ltd operates SpecBrief. For privacy questions, access, correction, deletion requests or complaints, email hello@specbrief.com.au. For a security issue, use security@specbrief.com.au.

SpecBrief aims to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Recipients and locations

SpecBrief information is handled in the following places:

• The app runs at app.specbrief.com.au, hosted on Render. That service sits in Render's Oregon region, in the United States. Anything the app processes is processed there.
• Your account (the firm, its seats, its plan and its usage counters) lives in a Postgres database hosted by Supabase in Sydney, Australia (ap-southeast-2). That is the primary database region. Supabase and its subprocessors can still process data elsewhere where needed to provide their service. The app refuses to serve without the database rather than fall back to a copy that a restart would wipe.
• Your finished brief is written to that same Sydney database. If the database is unavailable, SpecBrief fails the request rather than write customer content to temporary local storage outside the database's organisation controls.
• This page and the marketing site are static files on Vercel. They hold no tender documents, set no SpecBrief cookies, and run no SpecBrief analytics. Vercel necessarily receives the technical request information needed to deliver a web page.

Processing happens in the United States and the primary brief store is in Australia. If Australian-only processing is a condition of your work, contact SpecBrief before uploading a pack.

Information we collect

Tender packs can contain names, signatures, work emails and phone numbers. Do not add personal information that the pack does not need. The site has no SpecBrief advertising cookie or analytics tracker. The app sets a session cookie after sign-in to keep the session secure and protect forms. For each signed-in device we keep a short record (the browser and operating system, such as "Chrome on Windows", when you signed in and when you were last active) so you can see and sign out your devices. We don't keep your IP address or full browser details for this, and old records are deleted automatically after 30 days.

How we collect and use information

Most information comes directly from you: when you send an enquiry, create an account, invite a colleague, upload a pack or ask for support. Tender documents can contain personal information about other people. SpecBrief does not collect it from data brokers or use it for advertising.

SpecBrief uses this information to answer enquiries, provide and secure the service, manage accounts and billing, support customers, meet legal obligations and improve reliability and security. It does not sell personal information or use tender documents to train SpecBrief models.

How documents are read

SpecBrief extracts the text of every document. Word and Excel files are sent to the AI model as that extracted text. A PDF may be sent as the pages themselves, and the model then reads each page as an image together with the text embedded in it. This lets it read scanned pages and drawing sheets inside a PDF. SpecBrief keeps the extracted text of every PDF as well, and uses it to run its own checks and to find the passage behind each line of a brief. Page images go only to Google, and no other company receives them. Every calculated figure in a brief, including carbon-cap feasibility, volumes and conflict checks, is calculated in SpecBrief's own code rather than by the AI model.

When SpecBrief sends the pages of a PDF, it holds the original file on its application server until the read ends, even if your firm has not chosen to keep its packs. It deletes the original when the read ends or when the quote expires, unless your firm chose to keep its packs.

Document text and PDF pages are sent to the Gemini API. SpecBrief uses the API on a billed account, not a consumer chat app. Google's terms differ materially between its paid and unpaid tiers. Google's published terms state:

• On the paid tier, "Google doesn't use your prompts…or responses to improve our products" (Gemini API Additional Terms of Service, version last modified 28 April 2026, checked 13 September 2026).
• Google logs prompts and responses "for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy", and for any required legal or regulatory disclosure. Google does not publish a maximum number of days for that logging, so SpecBrief cannot quote one (same source).
• Google states that data "may be stored transiently or cached in any country". SpecBrief's own database and brief storage are in Sydney, but the model call is not, and a pack under an NDA should be assessed on that basis (same source).
• On the unpaid tier Google does the opposite: it uses submissions to improve its products, human reviewers may read them, and Google says plainly "do not submit sensitive, confidential, or personal information to the Unpaid Services". SpecBrief must therefore stay on a billed account for the paragraph above to hold. If billing lapsed and the key fell back to free quota, the no-training position would stop being true (same source).

That is Google's contractual commitment, not something SpecBrief's code can enforce. The current provider is listed on the Security & Data Processing page.

Dealing with us anonymously

You can read the website, view the sample brief and ask general questions without telling us who you are, or by using a different name. To create an account, use the service or buy credits, SpecBrief needs a verified email address for the account, because the account holds your firm's documents and briefs and must be secured to a person. An enquiry needs a name and an email address so we can reply.

Sensitive information

SpecBrief does not ask for sensitive information, such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal records. Please do not include it in an enquiry. If a tender document you upload happens to contain it, SpecBrief handles it only as part of reading that document for your brief, under the same controls as the rest of the pack, and does not use it for anything else.

Who can see your content

• People on your account. Anyone holding a seat on your account can open its briefs and kept packs (see Retention below).
• SpecBrief personnel. Only for support you ask for, security investigation, deletion or a legal requirement. Each administrative access records who, when, why, what was accessed and the outcome. Nobody at SpecBrief reads customer documents or briefs for any other reason.
• The AI model provider. Google's paid Gemini API terms describe logging for a limited period, solely for detecting and preventing violations of the Prohibited Use Policy and for required legal or regulatory disclosure. Those paid terms do not describe human review of paid-tier prompts; the unpaid tier, which SpecBrief does not use, says human reviewers may read submissions.
• Other providers listed below handle only what their role needs.

No product improvement from your content

SpecBrief does not use your documents, briefs or information extracted from them to improve SpecBrief or any AI model, and does not use them to build datasets, benchmarks or examples. To run and improve the service, SpecBrief uses operational measurements that contain no document content, such as page and credit counts, processing times and error rates. If SpecBrief ever offers to use customer content for improvement, it will apply only to an account whose administrator chooses to opt in, and never by default.

People named in tender documents

Tender packs usually name people who are not SpecBrief customers, such as consultants, site contacts and superintendents, often with work contact details. SpecBrief processes that information only because it is in a document the customer chose to upload, and only to produce the brief. The customer that uploads a pack is responsible for having collected that information lawfully and for any notice those people are owed. SpecBrief does not contact the people named in packs or use their details for any other purpose. A person named in a pack can contact SpecBrief using the details below.

Automated decisions

SpecBrief uses a computer program and an AI model to read documents and compile a brief for a business. It does not make, or substantially assist in making, decisions about individuals. The brief informs a firm's own tender; a person at that firm checks it and makes every decision. If that changes, this notice will describe the decisions and the kinds of personal information used before the change applies.

Marketing

SpecBrief does not sell, rent or trade personal information. It does not currently send marketing emails. If it starts to, it will only send them to business contacts where the law allows, every message will include a simple way to unsubscribe, and unsubscribing will not affect service emails such as sign-in links and receipts. SpecBrief never uses people named in tender documents, or their contact details, for marketing.

Overseas recipients

Personal information in your documents and account records may be disclosed to recipients in the United States (application hosting, email service records, error reporting and backups), Japan (sign-in email sending) and Australia (the primary database). The AI model provider may store or cache data transiently in any country where it or its agents have facilities. The providers and regions are listed below and on the Security & Data Processing page. When checkout is available, Stripe handles payments and may process payment information outside Australia, including in the United States and India, as described in its Privacy Policy.

Cookies

The app sets strictly necessary cookies only: a session cookie that keeps you signed in and protects forms from cross-site requests. It sets no advertising or analytics cookies. The marketing and legal pages set no SpecBrief cookies.

Keeping information secure

SpecBrief takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. The controls in use today are described on the Security page, including firm-by-firm separation in the database, HTTPS, two-factor sign-in, restricted document parsing and encrypted backups. No system is completely secure. If a data breach is likely to result in serious harm, SpecBrief will tell the affected account administrators without undue delay and, where the Notifiable Data Breaches scheme applies, will also notify the affected individuals and the Office of the Australian Information Commissioner as that scheme requires. Personal information that is no longer needed is deleted or de-identified on the schedule in the retention section below.

Retention and deletion

• The raw file you upload sits in a temporary folder while SpecBrief processes it. That folder is deleted the moment the read finishes, and that is the default for every account.
• Every signed-in upload is quoted before it is read, so the pack waits on the server for your answer. The wait is capped at 30 minutes and applies to every account, including accounts that keep nothing. SpecBrief deletes the held copy when you cancel and when the 30 minutes run out. When you continue, the read starts, and SpecBrief deletes what it held when the read ends.
• An account can choose to keep its packs, so a revised drawing can be run against the documents it supersedes. An admin turns that on and sets the period, up to 365 days. Any pack can be deleted from its brief at any time, and SpecBrief deletes it automatically at the end of the period. The switch sits on the Team page and starts off.
• Keeping your pack for questions (optional). If your firm turns on 'Keep pack for questions', SpecBrief keeps the text it read from your tender documents for 7 days after a read, so your team can ask questions about the pack. Only people in your firm can use it. It is deleted after 7 days, or sooner if you delete the brief or turn the option off. It is not used for anything else. The switch sits on the Team page and starts off.
• Your generated brief stays up for 30 days, so it is still there when an addendum arrives or you need to check it again. After that it will not open, and the stored copy is deleted. Expiry is checked whenever a brief is requested, so an expired brief cannot be opened even before scheduled deletion runs. A brief attached to a kept pack stays for as long as that pack. Earlier deletion can be requested at any time.
• Your brief opens through the private link made for it, and through the tender register belonging to your account. Anyone holding a seat on your account can open every brief and every kept pack on it, because an estimating desk shares its work. Nothing is listed publicly, indexed, or browsable by anyone outside the account.

Important retention limit. Retained packs are written to temporary application storage. A restart or redeploy can remove them. Retention is off by default. Treat a kept pack as a convenience, not as an archive.

Confidentiality and current providers

SpecBrief does not sell your documents. These are the current services that receive customer or account information to operate the service:

• Render runs the app in Oregon and processes the upload, extracted text and requests, and holds the original files while a read runs. Temporary working files and extraction-cache entries exist only for the bounded processing and retention paths described above; a database outage does not activate an emergency local brief store.
• Google Gemini, on the paid API terms described above, receives the text of your documents and, for PDF files, the pages as images together with their text.
• Supabase stores accounts, pending extracted text and generated briefs in the Sydney database.
• Sentry may receive scrubbed error reports if SpecBrief enables its error-reporting connection. Before an event leaves SpecBrief, the code removes request bodies, query strings, cookies, headers, environment values, user details, breadcrumbs, extra context and stack-frame local variables.
• Stripe handles checkout, payment confirmation, receipts, refunds and payment disputes when checkout is available. SpecBrief sends the payer's email, organisation and order identifiers, the pack description, amount and currency. Payment details are entered on Stripe's hosted checkout; SpecBrief does not store full card numbers or card security codes. SpecBrief keeps transaction identifiers, amounts, payment and refund status and credit-ledger records to provide the service, reconcile payments and meet recordkeeping duties. Stripe also processes information for fraud prevention and its own legal obligations under its Privacy Policy. Tender documents and Briefs are not sent to Stripe.
• GitHub Actions makes the daily database backup on a temporary hosted runner. The database includes every unexpired brief present at that time. The dump is encrypted before upload; only the encrypted artifact is kept, for 30 days.
• Resend receives an account email address and one-time sign-in link when email sign-in is requested, and the name, email address, company and message of an enquiry sent through the website form, which it delivers to SpecBrief's inbox. SpecBrief does not store website enquiries in its database. Email is sent from Resend's Tokyo region (ap-northeast-1). Resend says its account data, email metadata, logs and API records are stored in the United States regardless of that sending region. It does not receive tender documents through the SpecBrief workflow.
• Google sign-in receives an optional sign-in request and returns a verified email address and basic profile claims. It does not receive tender documents.
• Microsoft sign-in, provided through Microsoft Entra ID, receives an optional work-account sign-in request and returns an email address, basic profile claims and tenant metadata. It does not receive tender documents.
• Vercel delivers the marketing and legal pages. It does not receive tender uploads through the SpecBrief workflow.
• Gmail receives enquiries and support correspondence sent to the published contact address. SpecBrief does not accept tender packs by email. Gmail is not an upload channel for tender packs.
• Cloudflare Email Routing routes mail sent to the published contact address on to that mailbox. It handles enquiry correspondence only, and is not an upload channel for tender packs.

Information is also handed over where the law requires it. The current providers, processing regions and official provider documents are listed on the Security & Data Processing page.

Your choices, access and complaints

You can ask for access to, or correction of, personal information SpecBrief holds about you. You can also ask for deletion of information that SpecBrief no longer needs. Email the address below with enough detail to identify the account or request. SpecBrief may need to verify your identity before acting.

If you have a privacy concern, email us first so we can investigate it. We will acknowledge the complaint promptly, investigate it and aim to provide a written response within 30 days. If you remain unhappy, you may complain to the Office of the Australian Information Commissioner. You can also ask for this notice in another reasonable format.

Access and correction requests are free. SpecBrief aims to respond within 30 days. If it declines a request, in whole or in part, it will tell you why in writing and how to complain. If it declines to correct information you believe is wrong, you can ask it to attach a statement saying you believe the information is inaccurate, out of date, incomplete, irrelevant or misleading. Much of an account's information, such as its users and retention settings, can also be seen and changed directly on the Team page.

Legal requirements and deletion

The retention periods above apply unless SpecBrief is required by law, court order or a regulator to keep or disclose information. Where that happens, SpecBrief keeps only what is required, for as long as required, and tells the affected customer where that is lawful and practicable.

When an account asks for deletion, SpecBrief deletes, in this order: briefs, kept packs and pending jobs in the database; the account and its users, except records SpecBrief must keep by law, such as tax records; and then waits for encrypted backups to age out within 30 days. Copies held by the AI model provider under its logging terms follow that provider's retention. SpecBrief confirms when the live deletion is complete.

Changes to this notice

We update this notice when the data path or this policy changes. The effective date at the top tells you when the current version began. Before a material change applies, SpecBrief posts it here and emails account administrators, and each account is asked to accept the changed notice before its next upload or payment. SpecBrief never applies a change retroactively to documents already uploaded.

Order of documents. Where this notice, the Terms of Service and the Data Processing Schedule differ, the order set out in the Terms applies, and the Data Processing Schedule governs data-processing questions.