Privacy Policy

Last reviewed: 2026-10-14

1. Introduction

This Privacy Policy explains how TO BRIEF Ι.Κ.Ε. ("TO BRIEF", "we", "us") collects, uses, and protects personal data in connection with the websites tobrief.gr and tobrief.eu, the To Brief mobile apps for iOS and Android, and related services (together, the "Service"). TO BRIEF is the data controller for personal data processed through the Service, except where another controller is expressly identified below.

Controller details

• Legal name: TO BRIEF Ι.Κ.Ε. (Ιδιωτική Κεφαλαιουχική Εταιρεία)
• Registered office: Troon 26, 118 51, Αθήνα, Αττική, Ελλάδα
• GEMI: 188116103000
• AFM: 803045387
• Email: [email protected]
• Data-protection contact: [email protected]

We do not currently operate a statutorily appointed Data Protection Officer; nevertheless all data-protection enquiries are routed through the dedicated contact above and handled under a documented process that meets the standards expected of a DPO function under GDPR Art. 37-39 where applicable.

2. What data we collect

We collect only the minimum data needed to run the Service and meet our legal obligations.

2.1 Account data

When you register an account we store: your email address, a securely hashed password, your chosen display name (optional), the date of account creation, the edition you registered through (GR or EU), and subscription status. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

2.2 Website usage and analytics data

If — and only if — you grant optional measurement consent through our cookie banner, we collect aggregated usage signals via Google Analytics 4, UX analytics/session signals via Contentsquare/Hotjar, conversion signals via the X pixel, and conversion signals via the Meta (Facebook/Instagram) pixel: pages viewed, device/browser class, approximate geography (country/region from IP, never the raw IP), referrer, session duration, interaction events, user experience friction signals, signups, and subscription conversions. Legal basis: consent (GDPR Art. 6(1)(a) and ePrivacy Art. 5(3)). With the same consent, our server also informs OpenAI when you create an account on our website or when your first subscription payment there is verified, so that we can measure and improve To Brief ads in ChatGPT. OpenAI receives your email address in hashed form, a hashed random customer identifier, the ChatGPT ad click reference if you arrived through such an ad, the time and, for a subscription, the amount and currency. OpenAI sets no cookie and loads no script in your browser. Legal basis: consent (GDPR Art. 6(1)(a)).

2.3 Payment data

Subscription payments are processed by Stripe Payments Europe, Limited ("Stripe"). Card entry is handled by Stripe; card numbers and CVV codes are not sent to our application servers through our checkout. Stripe's privacy notice is at https://stripe.com/privacy. We receive the records needed to administer subscriptions and verify payments: customer, subscription, invoice and refund identifiers; payment/refund amounts and currencies; dates and status; billing details and invoice records. We associate these records with your To Brief account. Legal basis: performance of a contract and legal obligation for billing and accounting. Optional advertising use of a verified payment follows the separate rules in §2.7.

2.4 Complaints and report data

When you use /report or email a complaint we store: your email, the complaint text, attachments you provide, a salted hash of your IP address (not the raw IP), the ticket number we assign, and the outcome of the investigation. Legal basis: legitimate interest (operating an accountable news service and defending legal claims) and legal obligation (EMFA Art. 20, DSA Art. 16).

2.5 Device and browser data

Our servers receive standard HTTP request metadata — user-agent, Accept-Language, referrer, truncated IP — which is retained in access logs. Legal basis: legitimate interest (security, fraud prevention, diagnostics).

2.6 Sensitive categories

We do not knowingly collect special categories of personal data (GDPR Art. 9) such as data about health, religion, political opinions, or sexual orientation. Please do not submit such data through free-text fields.

2.7 Mobile app measurement

We use AppsFlyer to understand which campaigns bring app installations and paying subscribers, and to improve To Brief advertising on Meta (Facebook/Instagram), X and Reddit. This advertising measurement is optional and based on consent. Account access, subscription administration and the security records needed to respect your choices remain separate service functions.

Initial rollout: new users only. We only include newly created accounts with a first-time app installation after this measurement rollout starts. Existing accounts, app updates, known reinstalls and installations of uncertain origin are excluded from AppsFlyer measurement and individual advertising feedback in this release. We verify eligibility after account creation or sign-in, before requesting tracking permission or loading AppsFlyer. This rollout does not enroll existing readers or change their current advertising-measurement choices.

When app measurement is enabled and permitted, AppsFlyer receives its installation identifier, an available advertising identifier, app launches and technical app/device information used for attribution, analytics and fraud prevention. This can include operating-system and app versions, language, launch diagnostics and network information. Its servers receive the connection's IP address and can derive approximate geography. We do not request precise location or GPS access for this measurement. Our backend keeps the installation association, permission state and revisions, app/platform information, native installation time and a limited campaign observation where available.

After an eligible new account is verified and you permit measurement, we link the installation to that account using random measurement identifiers. We record registration, an initial qualifying use of the app, checkout initiation and verified subscription events. If you pay on our website using the same To Brief account, we can associate that payment with an eligible app installation. Permitted events sent through AppsFlyer can include registration and subscription payments, renewals or refunds, with an event identifier, amount, currency and time. Each partner receives the events configured for its integration; not every event is sent to every partner. With the same app permission, our server also sends OpenAI up to three events directly, so that we can measure and improve To Brief ads in ChatGPT: registration, the first verified subscription payment and a new app installation. These are sent only for eligible new installations and only for events after you gave permission, never for existing installations, app updates or reinstalls. Each event carries your email address in hashed form, a hashed random customer identifier, the ChatGPT ad click reference if one was recorded at sign-up, the time and, for a subscription, the amount and currency. Renewals and refunds are not sent to OpenAI.

We do not include your email, name, telephone number, comment text, article titles, reading topics, search queries, political interests, card details or invoice documents in these advertising event payloads. Partner sharing can include eligible new users from organic and other campaign sources, not only users attributed to that partner. Existing readers are not opted into this new app measurement by updating or reinstalling the app, or by signing into an older account on a new device. The only exception is the OpenAI events described in §2.2 and in this section, which carry your email address in hashed form only, never in plain text.

Your choice. On iOS, Apple's standard App Tracking Transparency (ATT) prompt is the only tracking permission prompt. You can change it later in iPhone Settings. On Android, use the app's measurement choice and its Settings entry. You can use the app after declining. A website cookie choice cannot override an app tracking refusal. The app rechecks the platform choice when it returns to the foreground; our backend checks the current recorded permission and account association before sending queued events. Withdrawal stops the SDK on the device and updates our backend; if the device is offline, that server update is retried when connectivity returns.

Apple's separate aggregate attribution mechanism can remain active after ATT refusal. It reports limited conversion values without our account or AppsFlyer identifiers. Withdrawal stops future personal advertising measurement; it is not an automatic deletion of data already received by a provider. Account deletion starts the applicable erasure process, removes local campaign observations and severs advertising links from retained billing records. Provider-held records are handled through the erasure process rather than assumed deleted immediately. You can also request erasure through [email protected]. The retention distinctions in §4 apply.

3. Why we use your data

Purpose	Data categories	Legal basis
Providing the reading experience	Account, device	Contract, legitimate interest
Billing, fraud prevention, tax compliance	Payment, account	Contract, legal obligation
Measuring engagement and improving the product	Measurement	Consent
UX analytics through Contentsquare/Hotjar	Measurement	Consent
Conversion measurement via X pixel	Measurement	Consent
Conversion measurement via the Meta pixel	Measurement	Consent
Conversion measurement for OpenAI ads (server-side)	Measurement	Consent
Optional app acquisition and subscription measurement	Installation, permission, account and payment events	Consent
Handling complaints and corrections	Complaints, account	Legitimate interest, legal obligation
Security, abuse detection, incident response	Device, account	Legitimate interest
Complying with lawful requests	All categories, as relevant	Legal obligation

We do not use personal data for automated decision-making that produces legal or similarly significant effects on you (GDPR Art. 22).

4. How long we keep your data

• Local app campaign observations: expire 89 days after the earlier of first backend installation registration or campaign-observation receipt, and are cleared earlier on withdrawal or account deletion. Repeated campaign callbacks do not extend the period.
• Direct event-to-installation links: excluded from measurement reporting after 89 days from the event and removed by scheduled cleanup. Old browser conversion claims are also removed after 89 days. Financial identities, amounts and the minimum event records needed to prevent duplicate payment/conversion records are separate from these advertising links.
• Permission and erasure records: installation records needed to enforce choices, prevent account reassignment and fulfil erasure requests are kept separately from campaign observations. A provider identifier required for an outstanding erasure request remains until completion is confirmed. A restricted suppression record is retained to prevent that retired identity from being reused for advertising. These records are not anonymous and are not used as campaign-audience data. Provider-side retention and an individual erasure request are separate from our local campaign expiry.
• Account data: for as long as the account is active and up to two (2) years after closure, to handle post-closure disputes and chargebacks.
• Analytics data: fourteen (14) months for GA4; Contentsquare/Hotjar measurement cookies are retained according to their purpose and generally up to thirteen (13) months for visitor-level UX analytics cookies.
• Payment / invoicing data: seven (7) years, to meet Greek tax-archiving obligations (Κ.Φ.Α.Σ. / Law 4174/2013).
• Complaints data: three (3) years from final response, aligned with the five-year statute for contractual claims but trimmed where possible.
• Access logs: ninety (90) days.
• Backups: encrypted backups roll off within 35 days.

After these periods we delete or irreversibly anonymise the data.

5. Who we share data with

We share personal data only with the recipients and for the purposes listed here. We do not sell personal data to any third party.

• Stripe (payments, as independent controller).
• Google Ireland Limited (GA4) — only if you consent to analytics.
• Contentsquare/Hotjar — only if you consent to optional UX analytics measurement.
• X — optional website conversion measurement and permitted app-event sharing through AppsFlyer.
• Meta (Facebook/Instagram) — optional website conversion measurement and permitted app-event sharing through AppsFlyer.
• AppsFlyer — our mobile attribution and measurement service provider, including the permitted account-to-subscription link and erasure handling described in §2.7.
• Reddit — permitted app-event sharing through AppsFlyer to measure and improve To Brief campaigns.
• OpenAI (OpenAI Ireland Limited): optional conversion measurement for To Brief ads in ChatGPT, sent by our server as described in §2.2 and §2.7.
• Hosting and infrastructure providers (e.g. Vercel, AWS, Cloudflare) acting strictly as processors under Art. 28 contracts.
• Professional advisors (lawyers, accountants, auditors) where legally necessary and under confidentiality.
• Competent authorities, where we are compelled by a lawful, specific, and proportionate request (court order, DPA, tax authority).

A current, auditable list of sub-processors is maintained internally and can be provided on request.

6. International data transfers

Some of our processors are established in the United States or operate globally. Where personal data is transferred outside the EEA we rely on:

• the European Commission's Standard Contractual Clauses (Decision 2021/914), or
• an adequacy decision (e.g. the EU-U.S. Data Privacy Framework, for Stripe, Google, and other certified importers), or
• your explicit consent for limited, targeted transfers.

Supplementary measures such as encryption in transit (TLS 1.2+), encryption at rest, and access controls are applied on top of the legal transfer mechanism.

7. Your GDPR rights

You have the following rights under GDPR Arts. 15-22:

• Access — confirmation that we process your data and a copy of it.
• Rectification — correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten") — deletion where grounds exist.
• Restriction — limiting how we process your data pending verification.
• Portability — a machine-readable copy of data you provided under contract or consent.
• Objection — to processing based on legitimate interests, including profiling.
• Withdraw consent — at any time, without affecting processing performed before withdrawal.
• Complain to a supervisory authority — especially the Hellenic Data Protection Authority (see §12).

To exercise any right, email [email protected] from the address on file or provide another reasonable means of identity verification. We respond within one (1) month, extendable once by two (2) further months for complex requests; we will explain any extension.

8. Cookies

We use cookies and similar technologies. The categories, purposes, and duration of each cookie are described in the Cookie Policy. You can configure your preferences and withdraw consent at any time via /cookie-preferences.

9. Children

The Service is not directed at children under fifteen (15) years old, the age of digital consent in Greece under Law 4624/2019 Art. 21. We do not knowingly collect data from younger children. If you believe a child has registered, please contact [email protected] and we will delete the account.

10. Security

We apply commercially reasonable technical and organisational measures — including TLS, hashed passwords (Argon2 family), isolated environments, principle-of-least-privilege access, logging, backups, and incident-response procedures — but no system is perfectly secure. In the event of a personal-data breach likely to result in a risk to your rights, we will notify the Hellenic DPA within 72 hours as required by GDPR Art. 33 and, where the risk is high, we will also notify you directly.

11. Changes to this policy

We will post a revised version at this URL and, for material changes, give notice at least thirty (30) days in advance through the Service or by email. The "Last reviewed" date at the top always reflects the most recent update. Historical versions of this document are preserved in the legal-pages change log.

12. Contact and supervisory authority

• Data-protection enquiries: [email protected]
• Postal address: Troon 26, 118 51, Αθήνα, Αττική, Ελλάδα

You have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα):

• Website: https://www.dpa.gr
• Postal: Kifissias 1-3, 115 23 Athens, Greece

EU residents outside Greece may also contact the supervisory authority in their Member State of habitual residence.