Privacy Policy

Last updated: 6 November 2026

This Privacy Policy explains how Lengin OÜ(“ Briefkits”, “we”, “us”) collects, uses, shares, and retains information when you use the Briefkits application at app.briefkits.com and the briefkits.com website (together, the “Service”).

Briefkits is an advertising-analytics tool for businesses: you connect your own advertising account, and we analyse your own ads and creatives to produce insights and creative briefs. When you ask our assistant to, Briefkits also creates and manages ads in that account on your behalf. We are the data controller for the information described below, and you can reach us at info@lengin.com or by post at Kaupmehe tn 7-120, Kesklinna district, Tallinn city, Harju county, 10114, Estonia.

1. Information we collect

1.1 Information you give us

• Account information — your email address and full name, created when you sign up with an email and password or with Google. Authentication is handled by our infrastructure provider, Supabase; we never see or store your password in readable form.
• Organisation and workspace information — the names of the organisations and workspaces you create, the members you invite (their email addresses), and their roles. If someone invites you to their organisation, we receive your email address from them, and use it solely to deliver the invitation and set up your membership.
• Content you enter — brand context, product categories, notes, hypotheses, and similar text you add to your workspaces, and the messages and images you send to the assistant chat.
• Support and billing correspondence — messages you send us, including credit requests.

1.2 Information we receive from Meta when you connect an ad account

When you connect a Meta (Facebook/Instagram) advertising account, you are asked to grant a specific set of permissions: ads_read (read your ads and their performance metrics), pages_show_list (see the list of Facebook Pages you manage), and pages_read_engagement (read the content your Pages have published, such as the posts and videos behind your ads). If you use the assistant to create and manage ads, you are also asked for ads_management (create campaigns, ad sets, ads and ad creatives in your ad accounts, and change their status, budgets and names) and pages_manage_ads (run the ads it creates from your Facebook Page). Based on what you grant, we receive and store:

• An access token for the connection, so we can retrieve data on your behalf. Tokens are stored encrypted and are never exposed to your browser or to other customers.
• Basic profile of the connecting user — your Facebook user ID and name, received as part of the authorisation dialog. We use them only to identify and label the connection; they are not used to sign you in or to create a Briefkits account. We never publish posts to your Page or timeline.
• The list of ad accounts and Pages you administer — so you can choose which of them to connect. We store details only for the ones you select.
• Ad account details — account ID, name, currency, and account status.
• Page details — the ID and name of the Pages covered by your authorisation, shown to you when you connect. We use them to locate the published posts and videos behind your ads and, when you ask the assistant to create ads, to name the Page the ads run from. We do not keep a separate register of your Pages.
• Ads and creatives — ad names, IDs, and the creative assets themselves (video and image files, including thumbnails and video URLs).
• Aggregated performance metrics — spend, impressions, clicks, CTR, CPM, reach, frequency, video plays, ThruPlays, average watch time and retention curves, link clicks and landing-page views, conversion counts and values (such as purchases, leads, add-to-cart, and associated revenue), and aggregate engagement counters (reactions, comments, shares, saves), together with the dates they relate to.

We do not receive, request, or store personal data about the people who saw or interacted with your ads. We only access aggregated, ad-level statistics and the creative assets you yourself published. We do not read comments, messages, follower lists, or any other information about individual people, and we do not access your personal Facebook timeline, friends, or private messages.

Ads you ask us to create or change.When you ask the Briefkits assistant to, we use ads_management and pages_manage_ads to create campaigns, ad sets, ads and ad creatives in the ad accounts you connected — from images you upload or generate in Briefkits, or from creatives already in your account — and to activate, pause or rename them or change their budgets. New ads are always created paused. We act only on a request made in the chat, never automatically, and a change that starts or increases spending waits for you to confirm it in Briefkits unless you choose otherwise. Images you choose are uploaded to your ad account as ad images. We keep a record of each change — what was requested, by whom, when, and Facebook’s response — in your workspace. We do not publish posts to your Page, read its messages, or change its settings.

1.3 Information collected automatically

• Technical logs — our hosting and infrastructure providers keep short-lived technical request logs (including IP address and browser user-agent string) as part of operating the platform. We use them solely to operate the Service, secure accounts, and investigate abuse.
• Product analytics and error reports — we use PostHog, hosted in the EU, to see how the application is used and to diagnose failures. It records the pages and features you use and the errors you hit, together with your account, organisation and workspace identifiers, your email address and name, your browser and device type, and an approximate location derived from your IP address. Analytics is served from our own domain, so no third-party tracking cookie is set.
• Cookies — strictly necessary session cookies set by Supabase to keep you signed in, functional first-party cookies (your selected workspace, invitation and Facebook-connection flow state), and a first-party analytics cookie that lets PostHog recognise your browser across visits. We use no advertising or third-party tracking cookies, and run no advertising or ad-retargeting scripts.

1.4 Payment information

Payments are processed by Stripe, which collects and stores your payment-card details directly; we never receive or store your full card number. We store your Stripe customer ID, your credit balance, and the credits each piece of work spent.

2. How and why we use your information

We do not sell your personal data, share it with data brokers, or use it to target advertising to you or to anyone else. You are not legally obliged to provide any of this information, but without the data described above we cannot provide the Service to you.

3. Automated processing by AI providers

To produce creative analyses and briefs, answer your questions and generate ad images, we send your ad creatives (video and image content), the associated performance metrics, and what you write and add in the assistant chat to AI providers who process them on our behalf:

• Google Cloud (Vertex AI / Gemini) — describes and analyses video and image creatives and generates the written analyses, hypotheses, and creative briefs.
• Anthropic (Claude)— runs the assistant chat: reads the account data you ask about (ads, creatives and their performance metrics) together with your messages to answer them and to prepare the ad changes you request, and structures the brand context and product categories you set up for a workspace. If you provide your website address, Anthropic’s systems retrieve publicly available pages of that website on our behalf.
• fal.ai — generates and edits the ad images you ask for, using image models from providers such as OpenAI and Google that fal.ai runs. It receives the brief and the images used as references, which may include your product photos, logo, and creatives from your ad account.

These providers act as our processors under contract: they process the content only to return a result to us, and are not permitted to use it to train their models. For every AI request we log metadata (model, token counts, cost) for billing and monitoring. The analyses are advisory — they produce no legal effects for you and are not used to make automated decisions about you.

4. Who we share information with

We share information only with service providers that make the Service work:

We may also disclose information where legally required — to comply with a valid legal process, to enforce our terms, or to protect the rights and safety of our users. If we are ever involved in a merger or acquisition, we will notify you before your information becomes subject to a different privacy policy.

5. Data we obtain from Meta: specific commitments

In line with the Meta Platform Terms, we commit that data obtained through the Meta Marketing API is:

• used only to provide analytics and creative insights, and to create and manage ads on request, for the business that authorised the connection;
• never sold, licensed, or transferred to data brokers, advertising networks, or any third party other than the processors listed above;
• never used to build user profiles, to target advertising, or for any purpose unrelated to the Service;
• deleted as follows: the stored access token is deleted when you disconnect Facebook, and imported advertising data is deleted when you detach the ad account, delete the workspace, or delete your account (see Section 7).

You can revoke our access at any time:

• In Briefkits — press Disconnect in Settings → Workspaces. This deletes the stored access token and also revokes Briefkits’s authorisation on Facebook’s side for you.
• In Facebook — go to Settings & Privacy → Settings → Apps and Websites, select Briefkits, and remove it. For connections made through a Business account, use Business Settings → Integrations → Connected Apps.

Revoking access in Meta stops any further data retrieval immediately. To also have the data we already imported deleted, follow Section 7.

Briefkits is an independent product and is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc.

6. How long we keep information

• Account, organisation, and workspace data — for as long as your account is active.
• Advertising data, creatives, and AI analyses — for as long as the workspace exists and the ad account they came from remains attached, so that historical comparisons remain available to you.
• Records of ad changes— what was requested, by whom, and Facebook’s response — for as long as the workspace exists.
• Meta access tokens — until you disconnect Facebook in Briefkits, which deletes the stored token. Revoking access in Meta or token expiry makes the stored token permanently unusable.
• Technical logs — kept by our hosting providers for their standard short retention periods.
• Product-analytics events and error reports — kept in PostHog for its standard retention period; when you delete your account or ask us to delete your data, we delete the analytics profile associated with you.
• Billing records — 7 years from the end of the financial year in which the transaction was recorded, as required by Estonian accounting and tax law.

When you delete your account, the corresponding database records are deleted immediately, and stored copies of creative files are removed by an automated cleanup shortly afterwards — in all cases within 30 days. The exceptions are records we must retain by law (principally billing records) and backups, which are overwritten on our provider’s normal backup cycle of seven days.

7. How to delete your data

You have two ways to have your data deleted:

1. Delete your account in the app. Sign in and go to Settings → Account → Delete account. This permanently deletes your profile and personal data. If you own an organisation, this also permanently deletes that organisation — all of its workspaces, connected ad-account tokens, imported advertising data, and AI analyses — together with the accounts of its members, and you will be shown exactly what will be removed before you confirm. The action cannot be undone.
2. Ask us. Email info@lengin.comfrom the address associated with your account with the subject “Data deletion request”. We will verify the request and complete the deletion within 30 days, and confirm by email when it is done.

If you are a member of an organisation owned by someone else, be aware that the organisation’s owner can delete the organisation. That deletes all of its workspaces and data, and — if that organisation is your only footprint in Briefkits — your account with it. If you also own or belong to another organisation, your account survives and only the membership is removed.

If you connected a Meta ad account and later removed Briefkits in your Facebook settings, we can no longer retrieve any data from Meta, but the data already imported remains in your Briefkits account until you delete it. Disconnect the ad account (see below) or use either method above to have it removed.

To remove only your Meta advertising data while keeping your Briefkits account: detach the ad account (or delete the workspace that contains it) in Settings → Workspaces — this deletes the data imported from that account — and press Disconnect there to delete the stored access token.

8. Your rights

Depending on where you live, you have the right to access, correct, delete, or export your personal data; to restrict or object to certain processing (including our product analytics); and to withdraw consent where processing relies on it. You can exercise most of these directly in the app, or by emailing info@lengin.com; we respond within 30 days. If you are in the EEA or the UK and believe we have handled your data improperly, you may lodge a complaint with your local data-protection authority.

9. International transfers

We are based in Estonia, and several of our providers are located in the United States. Where personal data is transferred outside the EEA/UK, we rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard offered by the provider.

10. Security

Access to your data is restricted at the database level by row-level security, so members of one organisation cannot read another’s data. Stored files are held in private storage and served through short-lived signed links issued to authorised viewers, except preview images of your ads’ creatives — copies of what Meta already showed publicly while the ads ran — which are served at unguessable addresses so that reports and answers you share can show them. Data is encrypted in transit (TLS) and at rest by our infrastructure providers, and ad-platform access tokens are additionally encrypted at the application level before they reach the database. Access by our staff is limited to what is necessary to operate and support the Service.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority as required by law.

11. Children

The Service is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service evolves. We will post the revised version at this URL and update the “Last updated” date. If the changes are material, we will notify account holders by email before they take effect.

13. Contact

Lengin OÜ
Kaupmehe tn 7-120, Kesklinna district, Tallinn city, Harju county, 10114, Estonia
Email: info@lengin.com