Draft · awaiting legal review
Privacy notice
Version privacy-v1 · [date of publication]
1. Who we are
Before the Brief is a product of Create Impact Products. Create Impact Products is operated by Hieronymus Weyn, who is the data controller responsible for processing your personal data ("we", "us"). Address: Rua da Pedra do Cão [n.º], 4400-396 Vila Nova de Gaia, Portugal. NIF: 323060404. Contact for anything about your data: createimpactproducts@gmail.com · +49 160 94691490. We have not appointed a data protection officer; write to the address above.
2. What this notice covers
The website [your domain], the free weekly digest, the free top-10 sample, the paid memberships (Executive and Executive + Board), and the emails we send and receive.
3. What we collect, why, on what legal basis, and for how long
| What for | Data | Legal basis (GDPR Art. 6) | How long we keep it |
|---|---|---|---|
| Sending you the free weekly digest | Email address; the consent wording you saw (version) and when you signed up; when you confirmed by email; which form you used and campaign tags (UTM); the referring website's name | Your consent, Art. 6(1)(a) (and, for emails, the Portuguese e-privacy law, Lei 41/2004) | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep your address and dates for 24 months as a record that we stopped, then delete them. |
| Preparing and sending your free top-10 | Email, first name (optional), what you're looking for (track, role, location, remote, sectors), companies to leave out, any note you add | You asked for it — steps at your request / providing the service, Art. 6(1)(b) | 12 months after your request, unless you become a member |
| Providing your membership | Email, first name, plan, your radar answers (roles, locations, sectors, company size, languages, board interest, companies to leave out, notes), payment-reference IDs from Stripe, membership status | Contract, Art. 6(1)(b) | While you are a member, then 90 days |
| Payments, invoices and tax records | Name, billing address and country, email, amounts, dates, invoice numbers. Card details are handled by Stripe; we never see your full card number. | Contract, Art. 6(1)(b), and our legal obligations, Art. 6(1)(c) | Invoices and tax records: 10 years, as Portuguese tax law requires (CIVA art. 52) |
| Withdrawals, complaints and refunds | Name, email, contract details, your message, what we did | Legal obligation, Art. 6(1)(c) | 3 years after we close the matter [lawyer to confirm] |
| Answering your emails | Your message and contact details | Our legitimate interest in replying, Art. 6(1)(f) | Up to 2 years after our last exchange [confirm] |
| Counting visits to the website | No cookies. Our analytics tool (Plausible) counts visits without storing personal data; it uses a daily-changing anonymous code to tell unique visits apart and stores no IP addresses | Legitimate interest in knowing how the site is used, Art. 6(1)(f) | Aggregated statistics only |
| Keeping the service secure | Technical logs kept by our hosting provider (such as IP address and browser type) | Legitimate interest in security, Art. 6(1)(f) | As short as the provider allows (days to weeks) |
| Partner and business contacts | If we write to you about a partnership: your business contact details from public sources and our correspondence | Legitimate interest in business contact, Art. 6(1)(f) — you can object at any time | 12 months after our last contact, or until you object |
4. What we don't do
- We don't sell or rent your data, and we never tell anyone who subscribes.
- The radar works from company events. We don't build profiles of individuals.
- We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
- No advertising cookies, no tracking pixels in our emails, no third-party embeds on the site.
5. Who processes data for us
These providers process data on our instructions, under data processing terms:
| Provider | What they do for us | Where |
|---|---|---|
| Lovable (Lovable DPA) | Website hosting and our database (Lovable Cloud) | Database in Lovable's Europe region [confirm country]; Lovable is a US/Swedish group |
| Brevo | Sending our emails and holding the digest mailing list | EU servers (Brevo) |
| Stripe Payments Europe, Limited (Ireland) | Taking payments and managing subscriptions; Stripe also uses some data as an independent controller, for example to prevent fraud (Stripe Privacy Center) | EU entity; may transfer data outside the EU under safeguards |
| Plausible Insights (Estonia) | Cookie-less website statistics | EU (Plausible) |
| Google (Gmail) | Our mailbox createimpactproducts@gmail.com, where we answer your emails and send briefings | Google's data centres, which can be outside the EU [check: consumer Gmail comes with no data processing agreement; Google Workspace or an EU mailbox on your domain would] |
| [Accountant / contabilista certificado] | Bookkeeping and tax returns | Portugal |
6. Transfers outside the EU
Some providers belong to groups outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on a European Commission adequacy decision or on the Commission's standard contractual clauses. You can ask us for details or a copy of the relevant safeguards.
7. Your rights
You can ask us at any time for access to your data, correction, deletion, restriction of processing, a copy to take elsewhere (portability), and you can object to processing based on our legitimate interests — and always to direct marketing. Where we rely on consent, you can withdraw it at any time (one click in any digest email); this doesn't affect what we did before. Write to createimpactproducts@gmail.com; we reply within one month. You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or to the authority in the EU country where you live or work.
8. Do you have to give us data?
No. But without an email address we can't send the digest or your sample; without your radar answers we can't build your list; and without payment details you can't buy a membership.
9. Cookies and similar technology
The site sets no cookies and stores nothing in your browser. Fonts are served from our own site (no calls to font providers). Statistics are cookie-less. That's why there is no cookie banner. If this ever changes, we'll ask for your consent first.
10. Security
Our database is hosted in Europe with access rules that stop the public website from reading it, all traffic is encrypted (HTTPS), our accounts use two-factor sign-in, and payment card data never touches our systems.
11. Changes
If we change this notice, we'll update the version and date at the top and, if the change matters, tell subscribers and members by email.