ClientBriefStudio · Updated 29 October 2026
Privacy Policy
Who we are
ClientBriefStudio (clientbriefstudio.com) is operated by Tomas Gabalis, an individual sole trader based in Lithuania, trading as ClientBriefStudio (“we”, “us”), who is the data controller for account data. Contact: support@clientbriefstudio.com.
Data and purposes
We process account details, agency settings, client names, marketing metrics, specialist notes and briefs to provide the service. Subscription identifiers and payment status support billing. Payment details are handled by Stripe, not stored as card numbers in ClientBriefStudio. Avoid uploading personal-level advertising exports or sensitive personal data.
Legal bases and your clients
Account and subscription processing is necessary for our contract. Security and service reliability rely on legitimate interests; statutory records may be retained to meet legal obligations. You remain responsible for the lawful collection of your clients’ data. For client data processed on your instructions, you are the controller and we act as processor; a data processing agreement (GDPR Article 28) is available on request.
Service providers and transfers
Lovable Cloud supports hosting, authentication and storage; Lovable’s AI service receives client names, periods and verified aggregate KPIs to draft briefs. Stripe handles payments. Where providers process data outside the EEA, we rely on adequacy decisions or EU Standard Contractual Clauses. We do not send public-link passwords to AI.
Your rights and retention
You may request access, correction, erasure, restriction, portability, or object to processing where applicable. Export your workspace or delete your account in Settings. Shared links stop working when the workspace is deleted. Legally required financial records may remain with the payment provider; deletion does not erase copies recipients already downloaded. Account data is deleted within 30 days of closure; billing records are kept as required by tax law. Requests are normally answered within one month, subject to GDPR extensions. You can complain to the Lithuanian State Data Protection Inspectorate (VDAI) or your local EU supervisory authority.
Storage and public sharing
The app stores your chosen language and sign-in session in browser storage. Anyone holding an unprotected brief link can view it; enable password protection for confidential figures and share the password separately. No non-essential tracking is introduced by these changes. Review payment-provider cookies and consent obligations before enabling production tracking.