Privacy policy

Brif is a business counterparty intelligence and due diligence service operated by COLLECTIVE WISDOM PTE. LTD., 201901723M, 33A PAGODA STREET, SINGAPORE 059192 (Brif, we, us or our). This policy explains how we collect, use, disclose and protect personal data in connection with Brif websites, accounts, company and individual research, reports, support and enabled integrations, including AI assistant and Model Context Protocol (MCP) connections.

It covers visitors, account users, business contacts and individuals mentioned in searches, source materials or reports, including individuals who have never created a Brif account. Personal data means information about an identifiable individual; company information can also contain personal data about directors, shareholders and other people.

We determine the purposes of processing account, website, security, billing and business-contact information. Where we determine how personal data is collected and used to provide our research and intelligence service, we are responsible for that processing under applicable law.

Where we process personal data solely on behalf of a business customer under its instructions, we act as its data intermediary or processor, as applicable. The relevant customer agreement and data processing agreement govern that processing. Our role depends on the activity, not simply on what an agreement calls us. Customers remain responsible for their own lawful searches, notices, instructions, disclosures and decisions.

This policy provides notice of our practices. It does not itself establish consent from every individual mentioned in a search, and accepting our Terms does not waive anyone’s privacy rights.

Account and contact data

Name, work email, organisation, role, account identifiers, authentication information and communications provided when registering, contacting us or using support. The website offers email registration and Google and GitHub sign-in. If you use a third-party sign-in option, we receive the information authorised through that provider, such as your name, email and account identifier.

Research inputs and outputs

Search subjects, names, company identifiers, prompts, queries, supplied context, feedback and generated reports. Where a feature allows documents to be submitted, the documents may contain personal data. Only submit information needed for an authorised business purpose.

Research subject data

Depending on the enabled service and available records, this may include names and aliases, professional roles, employment and directorship history, business connections, disclosed shareholdings, relevant biographical information and published media. Where screening is enabled, it may include potential sanctions, politically exposed person (PEP), watchlist or adverse-media matches. Allegations and possible matches are not established facts. Collecting disclosed shareholder information does not mean that we provide UBO tracing or verification.

These research data may come from customers, connected tools, publicly accessible records, company registries, filings, published media and third-party information providers, where available and lawfully usable. The sources used differ by query, market and feature; this description is not a promise of access to any particular source. Public accessibility does not automatically remove applicable privacy obligations.

Technical and transaction data

IP address, device and browser information, session and usage records, request timestamps, error and security logs, integration identifiers, access credentials or tokens where required for a connection, subscription details and billing records where a paid service is used.

Payments are processed through Stripe, our payment provider. Relevant payment and billing information is shared with Stripe to process payments and administer paid services.

We use relevant personal data to create and administer accounts; authenticate users; operate enabled searches and integrations; retrieve and organise information; generate and deliver reports; maintain appropriate records of service activity; provide support; manage subscriptions and payments; detect misuse and security incidents; investigate inaccuracies and complaints; comply with legal requirements; and establish, exercise or defend legal claims.

We may use relevant usage information and feedback to diagnose problems and improve service quality, subject to applicable law and the restrictions described below. We use business-contact information to respond to enquiries and provide requested product information. Promotional communications are subject to applicable consent and marketing rules, with an unsubscribe or other opt-out method. Opting out of promotions does not stop necessary account or security notices.

Where consent is required, we obtain it before the relevant processing. Where applicable law permits processing without consent, we rely on the relevant exception only if its conditions are met. We do not treat a customer’s submission or a public source as blanket permission for unrelated processing. We provide further notice and obtain additional consent where legally required before using data for a new purpose.

Brif may use automated processing to retrieve, organise, match, translate or summarise information in enabled features. This can produce incomplete, inaccurate or misleading results. Customers must review outputs before using them to make decisions about individuals. Brif outputs do not themselves constitute a final compliance, eligibility, credit, employment or other decision.

When you connect Brif to an external AI assistant or another application, that application may send selected prompts and identifiers to Brif and receive results containing personal data. Your organisation’s settings, the integration permissions and the external provider’s terms and privacy practices affect what it receives and retains. Disconnecting Brif does not necessarily delete information already held by that provider.

We share relevant data with third-party AI providers, including large language model (LLM) providers, to process queries and generate responses. Depending on the workflow, this may include query text, supplied context and relevant source information containing personal data. These providers are distinct from an assistant independently selected by a customer. Before using an integration, review its permissions and the connected provider’s settings.

We disclose relevant information to the customer or authorised user requesting a search and to connected applications as directed by the customer. Reports about individuals may therefore be provided to business customers for their authorised research and due diligence purposes.

We may also disclose information to providers supporting hosting, storage, authentication, information retrieval, AI processing, communications, customer support, security and payments, as applicable; professional advisers subject to confidentiality; authorities where legally required or permitted; and parties involved in a proposed corporate transaction, subject to appropriate safeguards.

Queries sent to an information provider may disclose the identity of the research subject and the search parameters. We limit service-provider access to the purposes for which the provider is engaged and require appropriate contractual and security protections. Customers and independently selected applications may have their own obligations and privacy notices for subsequent use.

We use data to provide query responses and for service and usage-behaviour analytics, alongside the operational purposes described in this policy. We share relevant data with service providers, including third-party LLM providers, to support those purposes.

Cookies or similar technologies may be needed to maintain sessions, authenticate users, remember settings and protect the service. If optional analytics, advertising or other non-essential technologies are used, the accompanying cookie notice or preference interface will identify their purposes and available controls, and consent will be obtained where required. You can also manage cookies through your browser; disabling necessary technologies may affect functionality.

Our service and providers may process personal data outside the country where it was collected. Where Singapore’s Personal Data Protection Act 2012 (PDPA) applies, we take appropriate steps to ensure transferred personal data receives a standard of protection comparable to that required under the PDPA, using legally recognised safeguards as applicable. Other applicable transfer requirements will also be addressed.

We make reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. No system or transmission method can be guaranteed completely secure. Where a breach occurs, we assess it and notify relevant authorities, affected individuals or customers as required by applicable law and our contractual obligations.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for relevant legal or business needs. We consider account status, service delivery, security investigations, disputes and legal recordkeeping requirements, subject to lawful preservation requirements and managed backup cycles.

Contact our Data Protection Officer using the details below to request access to your personal data and information about its use and disclosure, request correction, withdraw consent on reasonable notice, or raise a concern. Where another applicable law grants additional rights, such as deletion or objection, you may also contact us to exercise them. These rights are subject to applicable conditions, exceptions and identity verification.

We respond as soon as reasonably possible. For Singapore access and correction requests, if we cannot respond within 30 days, we will inform you in writing within that period of when we expect to respond. We may charge a reasonable access fee where permitted and will tell you in advance. Withdrawing consent may affect services that depend on the processing; we will explain the likely consequences. Processing that is otherwise lawfully permitted may continue.

If you believe a report contains incorrect information about you, identify the report or statement and provide relevant supporting details. We will assess the request and take steps required by law, including correction or appropriate handling of disputed information. We cannot directly amend an independent source’s records, but that does not remove our own obligations concerning data we hold or disclose.

Nothing in our Terms’ accuracy disclaimers limits our obligation to make reasonable efforts to ensure personal data is accurate and complete where applicable law requires this. You may raise unresolved concerns with the Singapore Personal Data Protection Commission or another competent authority.

We may update this policy to reflect changes in processing or law, indicate the effective date and provide additional notice of material changes where appropriate. Where required, we will obtain consent before new processing begins. Continued use alone does not supply consent for every new purpose.