Privacy Policy

1. Identity of the data controller

BrieforSales is published by Nicolas Papon, sole proprietor based in France.
Contact: [email protected]

2. Data collected

2.1 BrieforSales web application

• Account data: name, email address, password (bcrypt-hashed, never stored in clear)
• Project data: sales call transcripts, generated analyses, decks, follow-up emails
• CRM data: deal identifiers and sync notes (HubSpot, Pipedrive)
• Technical data: login logs, IP address (security only)
• Telephony data: call recordings, metadata (numbers, direction, duration) and transcripts, when you connect a telephony service (Aircall)

2.2 LiveCoach — audio capture modes

BrieforSales offers two audio capture modes configurable in Settings → Solution → LiveCoach (default mode: Browser bot-free for new accounts).

Browser bot-free mode

• Guarantee: audio NEVER leaves the seller's browser. It is streamed directly to Deepgram via WebSocket without transiting through BrieforSales servers.
• Seller mic capture: via getUserMedia (explicit consent in Chrome / Firefox / Safari / Edge / Arc).
• Meeting tab audio capture: via getDisplayMedia (explicit consent at each session, selecting the Meet / Teams / Zoom tab).
• No robot joins the meeting: fully invisible to other participants.
• No desktop app to install: works in all modern browsers.

Bot Notetaker mode

• Meeting audio: captured via a headless Chrome bot (account [email protected]) that joins the meeting as a visible participant.
• Audio stream: captured on the VPS side via PulseAudio, streamed to Deepgram, never persisted at rest.
• Activation: requires a connected Google or Outlook calendar; the bot joins detected meetings automatically.
• Deactivation: possible at any time from Settings → LiveCoach.

Data common to both modes

• Text transcript: received via SSE from Deepgram, persisted AES-256-GCM encrypted in CoachingSession.segments (30-day retention then anonymization).
• Meeting URL: used only to detect the platform (Google Meet, Teams, Zoom).
• Session metrics: duration, tip count, estimated costs (anonymized).
• PII sanitization: emails, phone numbers, IBANs are masked before any LLM (Claude) call.

2.3 Data NOT collected

• No browsing history
• No personal data of participants beyond their name (if mentioned in the conversation)
• No advertising or third-party tracking cookies
• No data resold to third parties

3. Purposes of processing

• Provide real-time sales coaching service
• Analyze sales calls and generate structured outputs
• Sync data with the user's CRM
• Improve service quality (aggregated and anonymized metrics)

4. Legal basis

• Contract performance: processing necessary to deliver the subscribed service
• Consent: audio capture via the extension (explicit consent required before each session)
• Legitimate interest: security, fraud prevention, service improvement

5. Processors and transfers

Transfers to the USA are governed by the European Commission's Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.

6. Data security

• AES-256-GCM encryption of sensitive data at rest (CRM tokens, PII data)
• Passwords hashed with bcrypt (cost 12)
• Encrypted communications TLS 1.3 / HTTPS
• Automatic PII sanitization on transcripts (emails, phone numbers, IBANs, social security numbers)
• Tenant data isolation (multi-tenant with tenant_id on every table)
• Rate limiting on sensitive endpoints

7. Retention period

• Transcripts and analyses: 90 days by default (user-configurable)
• LiveCoach sessions: 90 days, then automatic deletion
• Audio streams: never stored, real-time streaming only
• Account data: kept until account deletion
• Audit logs: 2 years (legal obligation)
• Phone call recordings: 6 months maximum, encrypted, then automatic deletion

8. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data
• Right to portability: receive your data in a structured format (JSON, CSV)
• Right to object: oppose the processing of your data
• Right to restriction: restrict the processing of your data

To exercise your rights, contact us at [email protected]. We respond within 30 days.

You may also file a complaint with your local data protection authority (in France, CNIL): www.cnil.fr

9. Chrome extension permissions

The LiveCoach extension requests the following permissions:

No permission is used to collect data outside the sales coaching context. The extension only activates on supported meeting pages.

10. Cookies

BrieforSales uses only cookies essential to the operation of the service:

• Session cookie (authjs.session-token): authentication, httpOnly, secure, sameSite=lax
• localStorage: user preferences, data in LOCAL mode

No advertising, analytics or third-party tracking cookies are used.

11. Changes

This policy may be updated. In case of material changes, users will be notified by email or via the application. The last-updated date is shown at the top of this page.

12. Contact

For any question regarding the protection of your data:

• Email: [email protected]
• Website: https://brieforsales.com