Privacy Policy

BrieflyLog is an operations and reporting platform for coworking and shared-office businesses, operated by BrieflyLog (“we”, “us”). Each business that uses BrieflyLog (an “Organization”) has its own private workspace.

We handle two kinds of information, and our role differs for each:

• Account and usage information about the people who sign in to BrieflyLog. We decide how this is used to run, secure and support the platform, so we are its data controller.
• Workspace content that an Organization records in BrieflyLog, such as leads, issues, billing, membership, parking and HR records. The Organization decides what to record and why, so it is the data controller. We process that content only on its behalf and on its instructions, as its data processor.

We interpret our obligations in line with the Kenya Data Protection Act, 2019 and its regulations.

About users who sign in to BrieflyLog, we collect:

• Account details: your name, work email address, and the password you set, which we store only as a one-way hash. We never store or see the password itself.
• Workspace access: the Organization you belong to, your role (for example admin or team member), the locations you can access, any temporary admin access and its dates, and whether you have been granted HR access.
• Sign-in and security data: session records containing your IP address, browser and device type (user agent), and when the session was created and expires.
• Activity records: which records you created, updated, submitted or are responsible for, and audit-log entries for sensitive actions such as changes to HR records or access permissions.
• Communications: emails we send you about your account, such as password reset links, and anything you send us when you contact us.

Workspace content. Organizations may also record information about other people, including staff who do not use BrieflyLog, their next of kin, clients, leads, visitors and vehicle owners. Depending on what the Organization chooses to record, this can include contact details, identity and passport numbers, dates of birth, residential details, pay and leave records. The Organization is responsible for that content (see section 3).

Cookies. We use only cookies that are strictly necessary for the platform to work: a session cookie that keeps you signed in, and a preference cookie that remembers whether your sidebar is collapsed. We do not use advertising, analytics or third-party tracking cookies.

When an Organization records information about people in BrieflyLog, the Organization is responsible for having a lawful basis to do so and for telling those people how their information is used, typically in its own privacy notice to staff and clients.

We process workspace content only to provide BrieflyLog to that Organization, as described in our Terms of Service and any data processing agreement we have with it. If you are not a BrieflyLog user and want to know about information an Organization holds about you, please contact that Organization first. We will help it respond.

We use account and usage information to:

• Provide the service: create your account, sign you in, show you the workspace areas your role allows, and attribute your records to you. This is necessary to perform our contract with your Organization.
• Keep the platform secure: enforce permissions, detect and investigate suspicious sign-ins or misuse, and keep audit trails of sensitive actions. This is in our and your Organization's legitimate interests.
• Communicate with you: send password resets and essential service notices, and respond to support requests.
• Meet legal obligations: comply with applicable law, lawful requests and our record-keeping duties.

We do not:

• sell or rent personal information;
• use personal information for advertising or build marketing profiles;
• use workspace content to train artificial-intelligence models.

• Within your Organization. Admins in your Organization can see your account details, role and activity records. What other users see depends on the permissions your Organization sets. HR records are visible only to people your Organization has explicitly granted HR access.
• Service providers. We use trusted providers for cloud hosting, database storage and transactional email. They process information only on our instructions and are bound by confidentiality and security obligations. A current list is available on request.
• Integrations your Organization enables. An Organization's administrator may connect BrieflyLog to a third-party service, for example an analytics tool or an AI assistant, or issue API access to one. We share only the data the administrator authorizes, and only for as long as the integration stays enabled. Once shared, the third party's handling of that data is governed by its agreement with the Organization and its own privacy terms, which may involve its own subprocessors, such as AI model providers. Integrations are off unless your Organization turns them on.
• Legal reasons. We may disclose information where required by law, court order or a lawful request from a public authority, or where necessary to protect the rights, safety or security of our users, the public or BrieflyLog.
• Business changes. If BrieflyLog is reorganized, merged or sold, information may transfer to the successor, which will remain bound by this policy.

Our service providers may store or process information on servers outside Kenya. Where they do, we rely on the safeguards permitted by the Kenya Data Protection Act, 2019, such as contractual protections and providers with appropriate security standards, so that your information remains protected.

• Account details are kept while your account is active. If your Organization removes you, we delete or anonymize your account details within a reasonable period, except where records you created must remain attributed for the Organization's history.
• Sessions expire after seven days and are removed when you sign out or they expire.
• Workspace content is kept for as long as the Organization keeps it. When an Organization stops using BrieflyLog, it can export its data, and we then delete its workspace content within 90 days. Backups are overwritten on a rolling schedule.
• We may keep limited information longer where the law requires it or to resolve disputes.

We protect information with measures that include:

• encrypted connections (HTTPS) between your browser and BrieflyLog;
• passwords stored only as one-way hashes;
• strict separation between Organizations, so each Organization's data is accessible only to its own members;
• role- and location-based permissions checked on the server for every request, with HR data restricted to a separate, explicitly granted permission;
• audit logs for sensitive actions.

No system is perfectly secure. If we become aware of a personal data breach affecting your information, we will notify the affected Organization and, where required, the Office of the Data Protection Commissioner, without undue delay.

Under the Kenya Data Protection Act, 2019, you have the right to:

• be informed about how your personal data is used;
• access the personal data held about you;
• have inaccurate or misleading data corrected;
• have data deleted where there is no longer a lawful reason to keep it;
• object to or restrict certain processing;
• receive your data in a portable format, where applicable.

For your account details, contact us at privacy@brieflylog.app. For workspace content, contact the Organization that recorded it. We will support it in responding. We may need to verify your identity before acting on a request.

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.

BrieflyLog is a business tool for adults and is not intended for anyone under 18. We do not knowingly collect account information from children.

We may update this policy from time to time. If we make material changes, we will notify Organization administrators before the changes take effect. The “Last updated” date above shows when this policy last changed.

Questions or requests about this policy or your personal data: privacy@brieflylog.app.