BrewHQ Privacy Policy

Last updated 6 October 2026.

This policy explains what personal information BrewHQ collects, why, who sees it, and the choices you have. BrewHQ is the brewery management service at brewhq.app, provided by BrewHQ LLC, an Illinois limited liability company ("BrewHQ", "we", "us"). It is written for two groups: the people who use BrewHQ at a brewery, and the people whose details a brewery enters into it, such as its customers' contacts and delivery signers.

1. Two roles, in plain terms

For the people who use BrewHQ, we decide how your account information is handled, and this policy applies directly.

For information a brewery enters about other people, such as a bar's buyer, a driver's signature or a supplier's email, the brewery decides why it is collected and how long it is kept. We hold it on the brewery's behalf and act only on its instructions. If you are one of those people and want to see, correct or remove your details, ask the brewery; we will help it respond.

2. What we collect

Account information. Your name, email address, password (stored only as a hash), the breweries you belong to and your role in each, your notification preferences, your time zone, and whether you have set up two-factor sign-in. If you add an authenticator app, we store the shared secret needed to check its codes.

Activity in the service. What is recorded carries who recorded it and when: a brew step, a tank reading, a stock count, an order marked delivered, a return marked filed. This attribution is how a brewery keeps its records honest and is kept as part of the brewery's data. We also keep the time of your last sign-in.

Device and technical information. The browser type and version when you turn on push notifications or send feedback, and the push subscription itself, which is an address issued by your browser or phone maker that lets us deliver notifications to that device. Our hosting providers keep standard server logs, including IP addresses, for security and troubleshooting.

Documents and photos. Files a brewery uploads, such as supplier price lists, customer purchase orders and proof-of-delivery photos or signatures.

Messages you send us. Feedback sent from within the service and emails to support.

Information a brewery enters about others. Customer and supplier contacts, delivery addresses, the names of people who sign for deliveries, and sales representatives. See section 1.

We do not collect payment card details; there is no billing in the service yet. We do not use advertising or analytics trackers.

3. Why we use it

To run the service: sign you in, show you your brewery's records, send the notifications you asked for, and attribute what is recorded to the person who recorded it.
To keep the service secure: detect and investigate unauthorised access and abuse, and enforce two-factor sign-in where a brewery requires it.
To support you: answer questions and investigate problems you raise, which may mean looking at the records involved.
To improve the service: understand which features are used and how the service performs, using aggregated information that does not identify a person.
To meet legal obligations and to protect our rights.

We do not sell personal information, and we do not use it for advertising.

4. Cookies

BrewHQ uses cookies only to keep you signed in and to remember which brewery this browser is working in. There are no advertising or third-party tracking cookies. The service also uses browser storage on your device for conveniences such as a draft you have not sent. Blocking cookies will prevent sign-in.

5. AI features

Some features send content to a third-party language-model provider to be processed: documents a brewery uploads for reading, such as price lists and purchase orders, and questions put to the assistant together with the brewery data needed to answer them. Our provider is Anthropic, used under commercial terms that do not permit it to train models on this content. The provider keeps the content only as long as needed to process the request and for its own abuse monitoring, as its terms describe. We record each use with what it was for and how large it was, so a brewery's use of these features can be limited and reviewed.

6. Who sees it

People in your brewery. Owners and admins see who is in the brewery, their roles, when they last signed in and whether they have two-factor on. Everyone in a brewery sees records attributed to colleagues, because that is what the records are for.

Other breweries. Never. Each brewery's data is held apart, and the database itself enforces that a person reads only the breweries they belong to.

Service providers who process data for us. We use a small number of providers to run BrewHQ, each bound by contract to use the data only to provide their service to us:

Supabase, for the database, authentication and file storage, in the United States.
Vercel, for hosting the application.
Resend, for sending email such as invitations, notifications and the morning brief.
Anthropic, for the AI features in section 5.
Services a brewery chooses to connect, currently Square, Xero and QuickBooks Online, which receive only what that integration needs and only while the brewery keeps it connected.

Authorities and others when the law requires. We may disclose information to comply with a legal obligation, a court order or a lawful request, or to protect the rights, safety or property of BrewHQ, its users or the public. We will tell the brewery concerned unless prohibited.

A successor. If BrewHQ is sold or merged, information may transfer to the successor under this policy; we will tell you before that happens.

7. Where it is kept and how it is protected

Data is stored and processed in the United States. It is encrypted in transit and at rest by our providers. Access within BrewHQ is limited to the people who need it to run or support the service, and support access to a brewery's records happens only to resolve a problem that brewery raised, to investigate a security incident or abuse, or where the law requires. Backups are taken daily and kept for seven days. Two-factor sign-in is available to everyone and can be required by a brewery for all its people; it is required for BrewHQ's own administrators.

No system is perfectly secure. If we learn of a breach affecting your personal information we will tell the affected breweries without undue delay and as the law requires.

8. How long we keep it

Account information: while your account exists, then deleted within 30 days of closure, except where we must keep it longer by law.
A brewery's data, including records attributed to you: while the brewery's account exists, then 30 days after it ends so it can be exported, then deleted from live systems, with backups expiring in the ordinary course.
Server logs at our providers: as their standard retention sets, typically days to weeks.
Feedback and support messages: up to two years, so we can follow up on what was raised.
AI usage records: as part of the brewery's data, for the same period.

A person leaving a brewery stays named on the records they created there, in the same way a signature stays on a form, because those records belong to the brewery.

9. Your choices and rights

See and correct. You can see and change your name, email, notification preferences and two-factor setup in the service. Owners and admins can see and change their brewery's records.
Notifications. All notifications are off by default. Turn each on or off under Notifications; push notifications can also be revoked in your browser or phone settings.
Delete. You can ask us to delete your account. Records you created in a brewery remain the brewery's and keep your name as the person who recorded them.
Export. A brewery can export its data at any time from within the service, and on request we provide a complete export within 14 days.
Legal rights. Depending on where you live you may have rights to access, correct, delete, port or restrict use of your personal information, and to object to certain processing. Residents of California have the rights in the California Consumer Privacy Act; we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of there. To exercise a right, email support@brewhq.app. We will verify the request and respond within the time the law allows. You may also complain to your local data protection authority.

For information a brewery entered about you, your request goes to that brewery; see section 1.

10. Children

BrewHQ is for people working in licensed breweries and requires users to be at least 18. We do not knowingly collect information from anyone under 18, and we will delete it if we learn we have.

11. Changes

We may update this policy. We will give at least 30 days' notice of material changes by email to brewery owners and in the service, and the date at the top will change. Continuing to use the service after that date means you accept the updated policy.

12. Contact

BrewHQ LLC 2501 Chatham Rd, Suite R Springfield, IL 62704 support@brewhq.app