Privacy Policy | Briefcase

1. Who We Are

Briefcase (翰途 Briefcase, briefcase.hk) is operated by Just Education Coaching (BR 77225401), trading as Just Law Education, in Hong Kong. In this policy, "we" and "us" mean that business, and "the Service" means the Briefcase website and platform.

2. Information We Collect

Account information: your name and email address, taken either from your Google account if you sign in with Google, or from what you provide if you sign up with an email address and password. You may optionally add a telephone number in your account settings.
Subscription and payment information: your plan, its status, your billing cycle and the customer and subscription identifiers issued by Stripe, our payment processor. Card details are entered directly with Stripe and never reach our systems. We do not store card numbers.
Usage information: a record of which form number you opened, when, and through which part of the Service, together with your sign-in and sign-out times. This is used for billing, support and fraud prevention. It records the form number only, never what you wrote in it.
Website analytics: pages viewed, clicks and similar interactions, collected through PostHog and the Meta (Facebook) pixel. See section 6.
Briefcase AI queries: if you use the optional plain-language form finder, the short description you type is sent to our AI provider to return matching form numbers. See section 5.
Enquiries: the email address and any message you send us through a contact or enquiry form on the site.

3. Your Form Content

This is the part of the Service that matters most, so we set it out in full.

Filling a form in the editor. The blank template is loaded into your browser and everything you type stays there. When you finish, the completed Word document is assembled on your own device and downloaded to it; a PDF is produced by your browser's own print function. The content of the document is never sent to us, and there is no copy of it on our servers. We record only that you opened that form number.
Step-by-step (guided) fill. As you answer the questions, your answers are saved in your own browser's local storage so that you can come back to them. They stay on your device. When you ask for the finished document, your answers are sent once to our server, merged into the template in memory and returned to you immediately as a Word file. Neither the answers nor the finished document is written to any database, file store or log; they exist only for the few seconds the request takes.
Client invites. If your firm uses the client invite feature, you send your client a one-time link to complete a form without needing an account. The completed Word document is stored, so that your firm can retrieve it. It is kept in a private storage area partitioned by firm; the individual field values are not stored separately, only the finished document. It is downloadable only through a link that we generate for your firm and that expires after five minutes. The invite link itself expires after 30 days and can be revoked at any time. Firms may ask us to delete stored submissions at any time (see section 10). If you do not use this feature, nothing you enter is stored with us.

4. How We Use Your Information

To provide the form library, the editor and document downloads
To create and administer your account, and to authenticate you when you sign in
To process subscriptions and one-off purchases, and to count usage against your plan's monthly allowance
To send you service messages, such as receipts, account notices and reminders that a free access period is ending
To answer your support enquiries
To understand how the site is used and to measure our advertising, in the ways described in section 6

We do not sell your personal data, and we do not provide it to third parties for their own marketing purposes. We share it only with the service providers listed in section 7, each acting on our instructions for the purpose stated, and where we are required to do so by law.

5. Artificial Intelligence

No part of any document produced by Briefcase is written by an AI model. Documents are built from fixed, pre-approved templates and from what you type. We do not use AI to draft, complete, rewrite or translate the contents of a court document, and we do not read, analyse or extract data from any file you hold.

The one AI-assisted feature is Briefcase AI, an optional form finder. If you describe your situation in plain language, that short description (up to 500 characters) is sent to OpenAI's API, which returns up to three matching form numbers with a one-line explanation of each. It is given nothing else: no document, no file, no account data and no information from our database. It suggests forms only and is not legal advice. We do not store the text you type, and under OpenAI's API terms it is not used to train their models. We record only that a query was made, and how many suggestions came back. There are no autonomous or agentic AI systems anywhere in the Service.

6. Cookies and Similar Technologies

Essential cookies keep you signed in, secure your session and remember whether you are using the English or Chinese version of the site. The Service cannot work without these.
Analytics. We use PostHog to understand how the site is used, which pages are visited and where people get stuck. If you are signed in, your PostHog activity is linked to your account identifier and email address so that we can follow a problem across sessions.
Advertising. We use the Meta (Facebook) pixel to measure whether our advertising works, for example by recording that a visitor started free access or subscribed. This sets third-party cookies and shares those events with Meta.
Payments. Stripe sets its own cookies on the checkout pages for fraud prevention.

Neither our analytics nor our advertising tools receive the contents of any document you prepare. You can block or delete cookies through your browser settings, and you can use a browser or extension that blocks analytics and advertising scripts; the form library and the editor will continue to work.

7. Service Providers

We rely on the following providers, each for a defined purpose:

Supabase — accounts, authentication, database and file storage
Vercel — hosting of the website and its server functions
Stripe — payments and subscription billing
Resend — service and account emails
PostHog and Meta — website analytics and advertising measurement
OpenAI — the Briefcase AI form finder only

8. Where Your Data Is Stored

Accounts, subscription records and any stored client-invite documents are held in a managed PostgreSQL database and file store operated by Supabase on Amazon Web Services in the Asia Pacific (Tokyo) region, encrypted at rest with automated backups. The website and its server functions run on Vercel in the United States, with static content served from their global network. Stripe, Resend, PostHog, Meta and OpenAI process data on their own infrastructure, which is located outside Hong Kong, principally in the United States and the European Union. By using the Service you consent to your personal data being transferred to and processed in those places for the purposes set out in this policy.

9. Security

All traffic is served over HTTPS with HTTP Strict Transport Security, and data is encrypted at rest. Access to your records is enforced by row-level security policies inside the database itself, so that a query made on behalf of one account cannot return another account's data. Stored files sit in a private area partitioned by firm and are retrievable only through a short-lived signed link issued after we have checked ownership. Our programmatic endpoints are rate limited, payment notifications are signature-verified, and privileged credentials exist only on our servers and are never exposed to your browser. Access to production systems within our organisation is limited to those who need it. No system can be guaranteed absolutely secure, but the design of the Service means there is no store of your clients' case details for an attacker to reach.

10. Retention and Deletion

We keep your account, subscription and usage records for as long as your account is open, and afterwards only for as long as we need them for legal, accounting and tax purposes. Documents stored through the client invite feature are kept so that the instructing firm can retrieve them, and are deleted when the firm asks us to delete them.

To close your account or have your personal data deleted, email privacy@briefcase.hk from the address on your account. We will delete your personal data and any documents stored for you, other than records we are required to keep, such as payment records needed for accounting purposes. Anything held in your own browser's local storage can be cleared through your browser settings.

11. Your Rights

Under the Personal Data (Privacy) Ordinance (Cap. 486) you have the right to ask whether we hold personal data about you, to be given a copy of it, and to have it corrected if it is inaccurate. Send data access and correction requests to privacy@briefcase.hk. We will respond within the 40-day period allowed by the Ordinance, and we may charge a reasonable fee for complying with a data access request as the Ordinance permits.

12. Changes to This Policy

We may update this policy as the Service changes. The date at the top of this page shows when it was last revised, and material changes will be notified to account holders by email.

13. Contact

For any privacy-related enquiry, or to make a data access or correction request, contact us at privacy@briefcase.hk.