Privacy Policy

This policy explains what personal information The Defense Brief (“we”, “us”) collects, why, who receives it, how long we keep it, and the choices and rights you have. It applies to our website, applications, email and services. Section 14 adds information for people in Australia.

1. Who Is Responsible

The Defense Brief, Toronto, Ontario, Canada, is responsible for the personal information described here. Our privacy contact can be reached at info@defensebrief.ca (subject line “Privacy”).

2. What We Collect

• Account information: your email address, sign-in identifiers, verification status and role.
• Membership and payments: your plan, subscription status, the version of the Membership Agreement you accepted and when, Stripe customer and subscription identifiers, and the country of your billing address as reported by Stripe. Card details are collected by Stripe, not by us.
• Settings and saved work: email preferences, watchlists, followed programmes and companies, saved searches and views, company profiles, bid workspaces, certification registrations, research partner lists and preparation tasks.
• Questions you ask our AI tools: the text you enter in the Market Assistant or Scenario tool, the countries, keywords, sectors and tickers you choose for My Brief, and the answers generated.
• Screening searches: the names and notes you enter in restricted-party screening.
• DB Wire purchases: the licences you buy, the licence version accepted, and payment references.
• Pilot requests: the organization, name, email, role, country, team size and scope you give us, and the IP address, browser type and referring page sent with the form.
• Site analytics: pages viewed, referring site, device and browser type, approximate country (derived from your IP address, which is not stored), and a random visitor identifier held in a cookie.
• Messages, requests and reports you send us: the content of emails, privacy requests made from your account, and correction or content reports made with our report form (with your name and email if you give them).
• Email choices: a dated record each time you switch an optional email on or off or unsubscribe, so we can show what you agreed to.
• Contributors and staff: for people who write or edit for us, their name, email, role, assignments, drafts, submissions, editorial notes and workflow history.

We do not ask for government identifiers, and we do not need sensitive information (such as health, political opinions or religious beliefs) to provide the Service. Please do not send it to us.

3. Why We Use It

• to provide the Service, including accounts, membership, saved work, alerts and briefs you ask for;
• to take payment, keep financial records and send the notices a purchase requires;
• to generate AI-assisted answers and briefings you request;
• to answer enquiries and pilot requests;
• to understand how the site is used in aggregate and improve it;
• to show ads to non-members on a few pages, only if you accept advertising cookies;
• to secure the Service, prevent abuse, and meet legal obligations.

We do not sell personal information. We do not use your data to train AI models. Topics you follow — including sensitive subjects — are treated as coverage preferences only; we do not infer anything about your identity, beliefs or characteristics from them.

4. Consent and Your Choices

We ask for your express consent where it matters most: to receive optional email, and before any advertising cookies are set. Other uses described in this policy are those a reasonable person would expect when using the Service, and you can withdraw consent to optional uses at any time:

• Email: every optional email has an unsubscribe link, and you can switch each kind off in your account settings. Unsubscribing takes effect immediately. Account, billing and security notices are still sent.
• Advertising cookies: off unless you accept them. Change your choice any time from Cookie settings at the bottom of every page.
• Site analytics: on by default; switch it off in Cookie settings. We also treat a browser’s Global Privacy Control or Do Not Track signal as switching it off.

Withdrawing consent may mean a feature that depends on it (for example, emailed alerts) stops working.

5. Who Receives Personal Information

We share personal information only with service providers who process it for us under contract, and as the law requires. Current providers:

• Supabase — sign-in, database and file storage.
• Stripe — payments and billing records.
• Resend — email delivery, with SendGrid or our mail host used only if Resend is unavailable.
• OpenAI — generating AI-assisted answers, summaries and briefings. We send the text needed for the request. Under OpenAI’s API terms this data is not used to train its models, and OpenAI may keep it for up to 30 days for abuse monitoring.
• Google AdSense — ads for non-members on a few pages, only after you accept advertising cookies.
• Google Fonts, jsDelivr, unpkg and Plotly’s CDN — deliver fonts and code libraries; your browser’s IP address and page address reach them when a page loads.
• CARTO — delivers the basemap images (built from OpenStreetMap data) on some of our map pages; your browser’s IP address and the map area requested reach it.
• Our hosting provider — runs the servers the Service operates on.

If you are a member of an organization that uses The Defense Brief, the organization’s administrators can manage your membership of it, and the organization’s weekly brief is built from the items its members follow. You can opt out of receiving that brief in your account settings.

We may disclose information where required by law, to protect the rights and safety of others, or as part of a sale or reorganization of our business, subject to this policy.

6. Where Information Is Processed

We are based in Canada. Our service providers may store or process personal information outside Canada and outside your own country — in particular in the United States, where Stripe, OpenAI, Resend and Google are headquartered, and in other countries where those providers operate. Information held in another country is subject to that country’s laws and may be accessible to its authorities. We require providers to protect it in line with this policy.

7. Cookies and Similar Technologies

We use a small number of cookies and browser-storage items. We do not use marketing pixels, social-media trackers or cross-site advertising cookies other than Google AdSense, which is off unless you accept it.

Analytics cookies are not set if you switch analytics off in Cookie settings, or if your browser sends a Global Privacy Control or Do Not Track signal. Marketing cookies are never set unless you accept them.

8. How Long We Keep It

• Account information and saved work: while your account is open.
• Site analytics: 395 days.
• IP address, browser and referrer sent with a pilot request: 90 days. Pilot request details: 2 years, unless they become a customer relationship.
• Market Assistant questions and answers: 365 days.
• Screening searches: 2 years.
• My Brief runs and PDFs: 365 days.
• Payment, purchase and licence records: as long as tax and contract law require (generally at least six years).
• Email unsubscribe records: kept so we do not email you again.
• Records of privacy requests: 3 years after completion.
• Correction and content reports: 2 years after they are closed.
• Records of your email choices: while your account is open, and afterwards for as long as we need to show what you agreed to.
• Security incident records: at least 2 years.

9. Accessing, Correcting and Deleting Your Information

You can download a copy of your data and close your account at any time from your account settings. Closing your account deletes your saved work and settings and removes your sign-in; we keep only the records described in section 8 that the law or our contracts require, with your email address removed from your account record.

You may also ask us for access to, or correction of, the personal information we hold about you — from the Your data section of your account settings, or by writing to info@defensebrief.ca. You can correct your email address yourself in account settings. We may need to confirm your identity. We will respond within thirty (30) days. If we need more time, we will tell you within those thirty days why and when to expect a response, which will be no more than thirty (30) further days. Requests are free.

10. Security and Breaches

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, access controls and limiting access to those who need it. No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, and we keep a record of every breach. For people in Australia, see section 14. To report a security vulnerability, see our security contact.

11. Children

The Service is designed for professional and adult audiences and is not directed at children. Our Terms of Use require users to be at least 18, and we do not knowingly collect personal information from anyone younger. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to This Policy

We will post changes here with a new date. If a change significantly affects how we use information we already hold, we will tell you by email and ask for consent where required.

13. Questions and Complaints

Contact info@defensebrief.ca (subject line “Privacy”). We acknowledge complaints within two business days and aim to resolve them within thirty (30) days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you are in Australia, to the Office of the Australian Information Commissioner (see section 14).

14. People in Australia

Where the Australian Privacy Act 1988 (Cth) applies to our handling of your personal information, we handle it in line with the Australian Privacy Principles (APPs). This section adds to the rest of this policy.

• Kinds of information, and why: sections 2 and 3. We collect personal information directly from you, from your use of the Service, and from Stripe (payment status and billing country). We collect it only where it is reasonably necessary for the Service.
• If you do not provide it: you can read our public pages without identifying yourself. Membership, saved work, alerts and briefs need an account and an email address, and payment needs Stripe; without them we cannot provide those features.
• Overseas disclosure (APP 8): we are located in Canada, so personal information of people in Australia is held in and disclosed to Canada, and to the service providers in section 5, which may process it in the United States and other countries where they operate. We take reasonable steps, including contractual terms, to require those providers to handle it consistently with the APPs.
• Direct marketing (APP 7): we do not currently send marketing email. The optional emails we send (alerts, My Brief, organization briefs) are ones you switch on, each carries a working unsubscribe link, and we honour an unsubscribe immediately. If we start sending marketing messages, we will do so only with your consent, identify ourselves, and include an unsubscribe facility, as the Spam Act 2003 (Cth) requires. You can also ask us which source we obtained your details from.
• Access and correction (APPs 12 and 13): section 9. We respond within thirty (30) days and do not charge for making a request. If we refuse access or correction, we will tell you why in writing and how to complain. If we do not correct information, you may ask us to attach a statement that you believe it is inaccurate.
• Security and retention (APP 11): sections 8 and 10. We destroy or de-identify personal information we no longer need, unless the law requires us to keep it.
• Data breaches: if we have reasonable grounds to suspect an eligible data breach under the Notifiable Data Breaches scheme, we assess it promptly (within thirty (30) days). If it is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable.
• Complaints: write to us first at info@defensebrief.ca. If you are not satisfied with our response, or we have not responded within thirty (30) days, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au, phone 1300 363 992).

Some of our reporting and analysis about public figures, organizations and events is journalism. How we handle personal information in that work is described in our Editorial Standards.