Privacy Policy

Effective date: October 12, 2026. Last updated: October 12, 2026.

BriefLasso is operated by The Weird Canadian (operated by Cody Johnston), Box 74, Lewisporte, NL A0G 3A0, Canada ("we"). We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles. Our privacy contact (the person accountable for privacy) is Cody Johnston: hello@brieflasso.com.

What we collect

• Designers (account holders): name, studio, email, hashed password, plan and billing status. Payments are processed by Stripe (stripe.com/privacy), which receives your name, email, billing address and card details. Card details go directly to Stripe and never reach our servers; we store only your Stripe customer and subscription IDs and plan status.
• Clients of designers: name and email entered by the designer, and the content they choose to provide (text, files, and secure notes such as logins). We process this on behalf of the designer, who is responsible for having consent or another lawful basis to collect it.
• Problem reports: if you use “Report a problem”, we store the report type, summary, details, the page you came from (with private link codes removed), your browser’s user-agent string, an optional screenshot, your account ID if you were logged in, and your email only if you choose to give it. The email is used only to acknowledge and follow up on that report. A copy of the report (ticket number, type, summary, details and page, but never your email, user agent or screenshot) is filed in our private issue tracker on GitHub so we can fix the problem.
• Business outreach and unsubscribes: we occasionally send a single introductory email (and at most one follow-up) to web designers whose business email address is conspicuously published on their own website, in line with CASL’s implied-consent rules. We record the name, business, email, where we found it and the date. Every email identifies us, includes our postal address, and has a one-click unsubscribe link. If you unsubscribe (via a link, the form at /unsubscribe, or by replying), we add your email address to a suppression list with the date, reason and how you unsubscribed. We keep that list indefinitely and use it only to make sure we never email you again, including reminders a designer sends through the Service; we don’t use it for anything else.
• Demo: the public demo at /demo uses sample data only. Anything you type or upload there is discarded and never stored; a session cookie keeps your demo state for up to an hour.
• Technical: a session cookie needed to keep you signed in (no advertising or tracking cookies); server logs (IP, time, page) kept for up to 30 days for security.

Why we use it (purposes and consent)

Only to provide, secure and support the Service: show checklists, store uploads, send the project emails and reminders the designer has switched on, process payments, and meet legal obligations. By using the Service you consent to these purposes. We don't sell personal information or use client content for advertising or AI training. We collect only what we need for these purposes.

Secure notes and safeguards

Data is encrypted in transit (HTTPS); secure-note fields are also encrypted at rest and visible only to the designer's account. Access is limited to what is needed to run the Service. No system is perfectly secure; we recommend clients share temporary or limited-access logins and change them after launch. If a breach creates a real risk of significant harm, we will notify affected people and the Privacy Commissioner as PIPEDA requires.

Service providers (subprocessors) and where data is stored

• Render — application hosting (United States)
• Neon — database (United States)
• Cloudflare (R2) — file storage
• Resend — email delivery
• Stripe — payment processing
• GitHub — private issue tracker for problem reports (United States)

These providers process data on our behalf under their own security and privacy commitments. Data may be stored and processed outside Canada, including in the United States, where it may be accessible to authorities under local law.

Retention

Project content is kept until the designer deletes it or closes the account, then removed within 30 days (from backups within 90 days). Server logs are kept up to 30 days. Problem reports (including any email and screenshot) are deleted automatically 12 months after they are submitted, or sooner on request; the matching GitHub issue contains no contact details. Suppression (unsubscribe) records are kept indefinitely so we can honour them; ask us if you want yours removed, knowing we then can’t guarantee we won’t contact you again. Billing records may be kept longer where tax or accounting law requires (generally up to 7 years).

Your rights and deletion requests

You can ask to access, correct or delete your personal information, or withdraw consent (which may mean we can no longer provide the Service), by emailing hello@brieflasso.com. We respond within 30 days. Clients of a designer may also contact that designer directly; we will help the designer respond. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Changes

We'll post updates here with a new "Last updated" date and notify account holders of material changes.