1Who is responsible for your information
Atrium Capital (Pty) Ltd (registration number 2026/343577/07), trading as BriefCounsel (“Atrium”, “we”, “us”), is the responsible party for the personal information described in this policy. Our registered address is 8 Harfield Road, Claremont, Cape Town, 7708.
Our Information Officer is Daniël Francois Rheeder, who can be contacted at franco@briefcounsel.ai or +27 73 956 7459. Our PAIA manual is published on our website.
This policy explains how we handle personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
2How BriefCounsel is designed to protect your data
BriefCounsel runs locally on the practitioner’s device. Before any content leaves the device, the Redaction Engine identifies personal and identifying information in the prompt and replaces it with consistent pseudonyms. The map between the original information and those pseudonyms (the Restoration Map) stays on the device and never leaves it. Only redacted content is sent to our AI provider for processing. It is our design intent that content leaving the device is anonymous — this is not a guarantee, and the practitioner must review each redacted prompt before it is sent. Your case data and work product stay on your device; we do not host or store them.
3What personal information we collect
To run your account, we collect your name, email address, and firm or practice name; your subscription and payment status; a customer reference from our payment processor (we do not receive or store your card details); and any messages you send us.
4Why we process it, and our lawful basis
We process this information to create and manage your account, provide BriefCounsel to you, take payment, give support, and comply with our legal obligations. Our lawful bases are the performance of our contract with you, our legitimate interests in running the service, compliance with the law, and, where relevant, your consent.
5Who we share it with
We use trusted service providers (operators) who process information on our behalf under confidentiality and security obligations:
- (a)Railway — cloud hosting and infrastructure for your account data, on servers located outside South Africa (currently the United States).
- (b)Anthropic — our AI provider, which receives only redacted content for processing.
- (c)Paystack — payment processing.
- (d)Postmark — transactional email delivery (for example, password resets and account notifications).
We may engage further operators as the service grows and will update this policy where necessary. We do not sell your personal information.
6Cross-border processing
Your account data is hosted with Railway on servers outside South Africa (currently the United States). Where any processing takes place outside South Africa — for example, by our AI provider — we rely on your consent and on the necessity of the transfer to perform our contract with you, and we put in place agreements requiring a level of protection substantially similar to POPIA. As noted above, content sent to the AI provider is designed to be anonymous.
7How we keep it secure
We take reasonable technical and organisational steps to protect personal information in our systems. The security of your own device and local environment — where your case data and the Restoration Map live — remains your responsibility.
8How long we keep it
We keep your personal information for as long as you have an account and for five years afterwards, or longer where the law requires it (for example, financial records under the Tax Administration Act). We delete or de-identify information when we no longer need it and there is no legal reason to keep it.
9Your rights
Under POPIA you may: ask what personal information we hold and request access to it; ask us to correct or delete it; object to our processing; and withdraw consent where we rely on it. To exercise any of these, contact our Information Officer at franco@briefcounsel.ai. We will not charge a fee that obstructs your rights.
10Complaints
If you are unhappy with how we handle your information, please contact our Information Officer first. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, at POPIAComplaints@inforegulator.org.za or enquiries@inforegulator.org.za.
11Changes to this policy
We may update this policy from time to time. We will post the current version on our website with its “last updated” date.