BrewHQ Data Processing Terms
Last updated 6 October 2026.
These terms form Annex A to the BrewHQ Terms of Service and apply whenever a brewery ("you", the "Brewery") uses BrewHQ to hold personal information about other people. In that relationship the Brewery is the controller, deciding why the information is collected and how long it is kept, and BrewHQ LLC, an Illinois limited liability company ("BrewHQ") is the processor, handling it only on the Brewery's instructions. Where privacy law uses other words for the same roles, such as "business" and "service provider" under California law, those apply with the same meaning.
If anything here conflicts with the Terms of Service on the handling of personal information, these terms win.
1. What is processed
Whose information. The Brewery's customers and their staff, including buyers and people who sign for deliveries; the Brewery's suppliers and their staff; the Brewery's own team members and sales representatives; and anyone else the Brewery chooses to record.
What kinds. Names, business contact details, delivery and billing addresses, signatures and photographs taken as proof of delivery, licence numbers for licensed customers, notes the Brewery writes about an account, and the trail of who recorded what and when. BrewHQ is not designed for, and the Brewery agrees not to enter, health information, government identification numbers beyond licence numbers, payment card numbers, or information about children.
Why. To run the Brewery's production, inventory, sales, delivery, accounting and regulatory record-keeping through the service, and for no other purpose.
For how long. For as long as the Brewery's account is open, then as set out in section 8.
2. The Brewery's instructions
BrewHQ processes personal information only on the Brewery's documented instructions. The Terms of Service, these terms, and the Brewery's use of the service's features are those instructions. Turning a feature on, such as sending an invoice to an accounting service, or asking the assistant a question, is an instruction to do what that feature does. BrewHQ will tell the Brewery if it believes an instruction breaks the law, and may pause that processing until the matter is resolved.
BrewHQ will not sell personal information, share it for advertising, combine it with information from other breweries or other sources except as needed to provide the service, or use it for its own purposes beyond running, securing and improving the service in aggregated form that identifies no one.
3. Confidentiality
BrewHQ limits access to personal information to people who need it to run or support the service and who are bound by confidentiality. BrewHQ staff look at the contents of a Brewery's records only to resolve a problem the Brewery raised, to investigate a security incident or abuse, or where the law requires.
4. Security
BrewHQ maintains measures appropriate to the risk, which today include:
- Encryption of data in transit and at rest by the hosting providers.
- Separation of each brewery's data, enforced in the database itself, so that a person can read only the breweries they belong to.
- Individual accounts for every person, with roles that limit what each can do, and no shared logins.
- Two-factor sign-in available to everyone, required for BrewHQ's own administrators, and able to be required by the Brewery for all its people.
- Daily backups kept for seven days, held apart from the live database.
- Records that are corrected by voiding and re-recording rather than deleted, so an audit trail survives.
- Logging of administrative access and of the AI features' use.
BrewHQ may improve these measures and will not reduce the overall level of protection during the term.
5. Subprocessors
The Brewery authorises BrewHQ to use the following subprocessors, each bound by written terms that protect personal information at least as well as these terms do:
| Subprocessor | What it does | Where |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | United States |
| Vercel, Inc. | Hosting the application | United States |
| Resend, Inc. | Sending email such as invitations, notifications and the morning brief | United States |
| Anthropic, PBC | Language-model processing for the AI features; no training on content | United States |
Services the Brewery connects itself, such as Square, Xero or QuickBooks Online, are not BrewHQ's subprocessors. They receive data because the Brewery authorised the connection, under their own terms, and the Brewery can disconnect them at any time.
BrewHQ will give the Brewery at least 30 days' notice before adding or replacing a subprocessor, by email to the Brewery's owners and in the service. If the Brewery objects on reasonable grounds relating to the protection of personal information and the parties cannot resolve it, the Brewery may end the service and take its data under section 8, without penalty.
6. Helping the Brewery meet its obligations
Requests from people. If BrewHQ receives a request from a person about their information in a Brewery's records, it will pass it to the Brewery without responding on the substance, unless the law requires otherwise. BrewHQ provides the tools to answer most requests directly: searching, correcting and exporting records in the service. Where a request needs BrewHQ's help beyond that, BrewHQ will assist at no charge where the effort is modest and otherwise at a reasonable rate agreed in advance.
Security incidents. If BrewHQ becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, a Brewery's personal information, it will notify the Brewery without undue delay and in any case within 72 hours of becoming aware, with what is known at the time: what happened, what information is affected, what BrewHQ is doing about it, and what the Brewery might do. BrewHQ will update the Brewery as more is learned and will cooperate with the Brewery's own notifications to people and authorities.
Assessments and audits. On request, no more than once a year unless a security incident or a regulator requires it, BrewHQ will provide information reasonably needed to show compliance with these terms, including the current security measures and subprocessor list, and will answer reasonable written questions. Where that is not enough, the Brewery or an independent auditor it appoints, bound by confidentiality, may audit BrewHQ's relevant processing at the Brewery's cost, on at least 30 days' notice, during business hours, without disrupting the service, and without access to other breweries' data.
7. Transfers
Personal information is processed in the United States. If the Brewery is outside the United States and its law restricts transfers, the parties will put in place the mechanism that law requires, such as standard contractual clauses, before the transfer, and these terms will be read with them.
8. Return and deletion
While the account is open, the Brewery can export every main list from the service at any time. When the account ends, for whatever reason, BrewHQ keeps the Brewery's data for 30 days so the Brewery can export it, provides a complete export on request within that period, and then deletes it from live systems, with backups expiring in the ordinary course within a further seven days. BrewHQ may keep what the law requires it to keep, and aggregated information that identifies no one, and will certify deletion in writing on request.
9. Liability
Each party's liability under these terms is subject to the limits in the Terms of Service. Nothing here increases those limits.
10. Term
These terms apply from the day the Brewery first uses BrewHQ and last until all of its personal information has been returned or deleted under section 8.