Privacy Policy

1. Who we are

Two Cores Operations Ltd is the data controller for the personal data described in this policy. You can reach us at any time through our contact page.

2. What we collect

We collect only what the service needs to work:

• Account data. Your email address and, if you choose to provide it, your company name. We sign you in with magic links, so we never store a password.
• Content you upload. The competitor CSVs you upload (company names and any attributes or notes you include), the column mappings you choose, and the landscapes, maps, and briefs generated from them. If you use branding settings on a paid plan, we also store the company details, accent colour, and logo you provide.
• Payment data. Payments are handled entirely by Stripe. We never see or store your card details. We store only your Stripe customer reference, subscription reference, and subscription status so we know which plan you are on.
• Usage data. We use Google Analytics 4 to understand how the site is used (pages visited, device and browser type, approximate location derived from IP address).
• Newsletter and contact messages. If you subscribe to The Landscape Letter we store your email address. If you use the contact form we store your name, email address, and message. Both forms are handled through Netlify Forms.

3. Why we collect it

• To provide the service you signed up for: generating, saving, sharing, and exporting competitive landscapes (performance of a contract).
• To take payment for paid plans and manage your subscription (performance of a contract).
• To understand how the product is used and improve it (legitimate interests).
• To send the newsletter you asked for (consent, which you can withdraw by unsubscribing at any time).
• To reply when you contact us (legitimate interests).
• To meet legal and accounting obligations (legal obligation).

4. AI processing

When you generate a landscape, the competitor data in your CSV is sent server-side to Anthropic's Claude API, which chooses the positioning axes, places each competitor, identifies clusters and whitespace, and writes the brief. This data is used only to generate your output. It is not used to train AI models, and we never share it beyond the processing described in this policy.

To display competitor logos, we load favicon images from Google's public favicon service using the competitor's domain name. Only the domain name is included in that request.

5. How long we keep it

• Anonymous demo landscapes are temporary and are deleted after around 2 hours.
• Landscapes and reports saved to your account are kept until you delete them or delete your account.
• Account data is kept while your account is active and deleted when your account is deleted.
• Newsletter emails are kept until you unsubscribe.
• Contact messages are kept only as long as needed to handle your enquiry.
• Billing records are kept as long as tax and accounting law requires.

6. Who we share it with

We never sell your data. We share it only with the service providers that run CompBrief, each acting under their own data processing terms:

• Supabase, which provides our database, authentication, and file storage.
• Stripe, which processes payments and manages subscriptions.
• Anthropic, which provides the Claude API used to generate landscapes and briefs.
• Google, which provides Google Analytics 4 and the favicon service used for competitor logos.
• Netlify, which hosts the site and handles the newsletter and contact forms.

Some of these providers store data outside the UK, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the UK extension to the EU-US Data Privacy Framework or standard contractual clauses.

7. Cookies

We use essential cookies to keep you signed in (set by our authentication provider, Supabase) and Google Analytics cookies to measure site usage. We do not use advertising cookies.

8. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Have your data deleted.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us through the contact page. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.

9. Changes to this policy

If we change this policy, we will update it here and revise the date at the top. Material changes will be flagged on the site. Your continued use of CompBrief after a change means you accept the updated policy.

10. Contact

Questions about this policy or your data: reach us through the contact page. You can also review our Terms of Service.