Privacy Policy

Who we are

Brewmate is operated by NZK TECNOLOGIA LTDA ("NZK", "we"), a company based in Brazil. This policy covers the site brewmate.io, the beta waitlist and the app at app.brewmate.io.

For anything about your data, write to contact@brewmate.io.

Who decides about each piece of data

Brazil's data protection law (LGPD), like the GDPR, separates whoever decides about data (the controller) from whoever processes it on someone else's behalf (the processor). Both roles exist in Brewmate:

• Waitlist, account and brewery data (email, name, members, roles, subscription): NZK is the controller.
• The content a brewery puts into Brewmate (recipes, batches, fermentation readings, notes, diary, inventory, costs and imported files): the brewery decides what goes in and who sees it, and NZK is the processor, handling that content only to provide the service.

In practice, almost all of that content is about beer, not people. If your team records other people's data, such as the name of someone who tasted a batch, it is up to the brewery to have a reason to do so.

Data we process

• Waitlist: the email you enter and the page's language, to confirm your sign-up and tell you about your access in your language.
• Account: name, email, photo and language. If you sign in with Google or Apple, we receive your name, email and photo from them, and keep the tokens they issue for that connection.
• Brewery and team: the workspace name, members, roles (owner, admin and member) and invitations, with the invited email.
• Session and security: the IP address and browser (user agent) of each session, and an audit log of actions taken in the workspace.
• Brewing content: recipes and their versions, equipment profiles, batches and the calendar, the readings you type on brew day, fermentation readings (°Plato and temperature), water and pH, inventory and costs, the diary, tasting notes and scores.
• Imported and exported files: the Brewfather (JSON), BeerXML, Tilt, iSpindel and RAPT files you upload, and the files you export. We do not connect to those devices or apps: we only read the file you choose to upload.
• Payment: the Stripe customer identifier, the plan and the subscription status. Card details stay with Stripe; we never receive them.
• Site and app usage: page views and usage events, as described under Cookies.

Why we use it, and on what legal basis

• The waitlist (steps taken at your request before a contract): keeping your email, confirming your sign-up and telling you when your beta access opens.
• Providing the service (performance of a contract): signing in, storing and calculating recipes and batches, importing and exporting files, and charging the subscription.
• Security and fraud prevention (legitimate interest and legal obligation): sessions, rate limits, the audit log and access records, which Brazilian law (the Marco Civil da Internet) requires us to keep.
• Service emails (performance of a contract): the waitlist confirmation, the beta access notice, sign-in links, brewery invitations, receipts and billing notices.
• Improving the product (legitimate interest): usage metrics without names or emails. You can turn off the ones your browser sends under cookies.
• Measuring ads (consent): learning which ads bring sign-ups and subscriptions, only if you accept advertising cookies.
• Legal and tax obligations: invoices, payment records and requests from authorities.

We do not sell personal data and do not use your brewing content for advertising.

Who we share it with

We use providers that process data on our behalf (sub-processors), each only for its part of the service:

• Server provider: NZK's own servers, where Brewmate and its database run.
• Cloudflare (R2): storage for imported and exported files.
• Stripe: payments, subscriptions and the billing portal.
• Resend or our own mail server (SMTP): sending the waitlist confirmation, the beta access notice, sign-in links and the other service emails.
• PostHog: usage metrics for the site and the app (events without names or emails, with the originating IP address).
• Google (Google Ads tag): ad measurement, only with your consent to advertising.
• Google and Apple: signing in, only if you choose to sign in with them.

Beyond that, we share data only when the law or an order from a competent authority requires it.

International transfers

Some providers (Stripe, PostHog, Resend, Cloudflare, Google and Apple) may process data outside Brazil, mainly in the United States. In those cases the transfer follows what the LGPD allows, such as performing the contract with you and contractual clauses with those providers. For readers in the EU or UK, transfers rely on the same contracts, including the standard contractual clauses those providers offer.

Cookies

We use few cookies, all our own (first-party), valid on brewmate.io and app.brewmate.io:

• brewmate.session_token: keeps you signed in to the app. Necessary; cannot be read by scripts on the page; lasts 7 days and renews with use.
• brewmate.state: protects signing in with Google or Apple. Necessary; lasts a few minutes.
• brewmate_ephemeral: holds the brewery's name while you create it. Necessary; lasts 15 minutes.
• analytics_consent: stores your cookie choice. Necessary; lasts 180 days.
• NEXT_LOCALE: remembers the language you chose.
• ph_brewmate_ph: identifies the browser anonymously in usage metrics (PostHog). Analytics; lasts up to a year.
• brewmate_ads_click and the Google Ads tag's cookies (such as _gcl_au): remember the ad you arrived through, for up to 90 days, to measure which ads bring sign-ups and subscriptions. Advertising; they exist only after you accept advertising cookies.

Usage metrics start on, and you can turn them off at any time. Advertising cookies turn on only if you accept them. If you accepted and then create an account, Google receives an irreversible code (a hash) of your email, never the email itself.

Change your choice whenever you like in the cookie notice or under "Cookie preferences" in the site's footer. If your browser sends the Do Not Track or Global Privacy Control signal, metrics and advertising stay off. We do not record sessions.

How long we keep it

• Waitlist email: until you create your account or ask to leave. If you never create the account, we delete the email 12 months after telling you your access opened.
• Account, brewery, recipes, batches, notes and files: while the account and the brewery exist.
• A paid plan that ends (cancelled or unpaid): the brewery returns to the Free plan and nothing is deleted because of it. Whatever goes beyond the Free plan's limits stays available to read and export.
• Email sign-in link: 15 minutes, single use. Brewery invitations: 7 days.
• Audit log: 12 months.
• Access records (IP, date and time): 6 months, as the Marco Civil da Internet requires.
• Payment and tax records: for as long as the law requires, usually 5 years.

To delete your account or, if you are the owner, the whole brewery, write to contact@brewmate.io. We act within 15 days, and the deletion is final, files included; only the records the law requires us to keep remain. Before that, you can export your recipes as BeerXML.

Security

All traffic uses HTTPS. There is no password to leak: you sign in with a single-use link or with Google or Apple. Session cookies cannot be read by scripts on the page, the platform's credentials live in a secrets vault, and each member sees only what their role allows.

No system is infallible. If we become aware of an incident that may cause significant risk or harm, we notify those affected and the authorities as the law requires. If you notice something, write to contact@brewmate.io.

Your rights

Under the LGPD, you may ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability of your data;
• information about whom we share it with;
• review of decisions made solely by automated processing;
• withdrawal of consent, where processing depends on it.

If you are in the EU or UK, the GDPR gives you the same rights, plus the right to object to processing based on our legitimate interest and to restrict processing.

Send your request to contact@brewmate.io. We may ask you to confirm your identity first. To leave the waitlist, just ask at the same address.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD) or, in the EU or UK, with your local data protection authority.

Minors

Brewmate is about making alcoholic drinks and is for adults only. It is not meant for anyone under 18, nor for anyone under the legal drinking age where they live. If we learn that a minor created an account or joined the waitlist, we delete their data.

Changes to this policy

When Brewmate starts collecting, keeping or sharing data differently, this policy changes with it, with a new date at the top. Significant changes are announced by email or in the app before they take effect. See also the Terms of Use.

Contact

NZK TECNOLOGIA LTDA, responsible for Brewmate. Email: contact@brewmate.io. Personal data requests, including to the data protection officer, go to the same address.