Privacy policy

The controller within the meaning of the General Data Protection Regulation is Mats Echterhoff, c/o Chatbyte GmbH, Mühlenkamp 31, 22303 Hamburg, Germany.

For privacy questions and to exercise your rights, you can contact us at privacy@brewquester.com.

Brewquester must process certain personal data to operate the website and app, enable accessible access to our content, and provide the requested functions.

We do this because we want to ensure that you can move around the website and app in a user-friendly way and, in particular, that no technical problems or disruptions occur. We also want to provide relevant content and functions; for this purpose it may be necessary to take into account personal data such as your browser language settings or the country from which you access our service.

When you visit the website or use the app, data such as IP address, date and time of the request, time zone, request content, data volume, browser information, country of origin, operating system, and comparable technical information transmitted by your device or browser to our servers may be processed. Depending on the context, processing is carried out for the performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR, to comply with legal obligations pursuant to Art. 6(1)(c) GDPR, on the basis of your consent pursuant to Art. 6(1)(a) GDPR, or on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR. We do not sell personal data.

When you visit the website or use the app, technical data may be processed, in particular IP address, date and time of access, requested URL, referrer, browser and device information, operating system, language settings, request headers, and comparable server log data.

This processing is necessary to provide the website and app, ensure the security of the service, detect errors, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR and, where access is necessary to use requested app functions, Art. 6(1)(b) GDPR.

Brewquester uses technically necessary cookies and comparable storage technologies for authentication, email verification, password reset, consent status, security, language settings, app settings, offline functionality, and the operation of requested functions.

The app may store data locally on your device so that requested app functions can load reliably. You can delete browser storage through your browser settings.

Consent records may include required information about your choices and the time of those choices. Optional analytics tools are used only where legally permitted and, where required, after consent. Marketing tools are used only if introduced later and legally permitted.

If you consent to analytics, Brewquester may use PostHog to measure page views and selected product events. Browser autocapture and session replay are disabled.

If you create an account or sign in, we process in particular name, email address, password data, verification status, profile image, language, time zone, settings, session data, and security and access metadata.

We use this data to create and secure your account, verify your email address, reset passwords, keep you signed in, personalize the app, prevent misuse, and provide the functions you request. The legal basis is Art. 6(1)(b) GDPR and, for security measures, Art. 6(1)(f) GDPR.

If you upload a profile image or organization logo, we process the uploaded file, technical metadata, and the resulting URL. Uploaded media may be publicly accessible where the app displays it as a profile or workspace image.

Processing takes place to provide the upload and display functions on the basis of Art. 6(1)(b) GDPR. Coffee packaging images for AI scans are described separately in the AI scan section.

Brewquester sends transactional emails such as email verification and password reset messages through an email delivery provider. This involves processing recipient address, subject, message content, and action links.

If you contact us, we process your email address, message content, and any information you voluntarily provide in order to respond to your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR.

If you use paid features, billing and subscription data is processed to complete payments, manage subscriptions, send confirmations, handle cancellations or refunds, prevent fraud, and comply with accounting and tax obligations.

Stripe is used for payment and subscription processing where paid features are active. Depending on the payment flow, payment data may include customer, subscription, plan, payment, invoice, cancellation, tax, and webhook data. The legal bases are Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR, and Art. 6(1)(f) GDPR.

If you use the online withdrawal function, we process the consumer name, contract, subscription, or order identifier, email address, withdrawal declaration, and receipt timestamp to receive the withdrawal declaration, send a receipt confirmation, and handle the related contract process. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR.

If you use AI-assisted functions, Brewquester sends the content required for this purpose to Vercel, Anthropic, and OpenAI in order to provide the requested results.

Processing takes place only if you use a corresponding function. The legal basis is Art. 6(1)(b) GDPR where the function is part of the app service you use, and Art. 6(1)(f) GDPR for security, misuse prevention, and technical traceability.

AI results can be incomplete or incorrect. You should review and correct suggestions before saving or using them. Brewquester does not use AI results to make legal, financial, health, employment, credit, or similarly significant decisions about people.

We disclose personal data only where this is necessary to provide Brewquester, where a legal obligation exists, or where this is necessary to protect rights, security, and the integrity of the service.

Personal data may be accessed only by persons who participate in the operation, maintenance, support, security, or further development of Brewquester and who need corresponding authorization for this purpose. We take technical and organizational measures to prevent unauthorized access and to limit access to what is necessary.

In addition, we use services from external service providers, for example for hosting, infrastructure, email delivery, payment processing, storage, security, consent management, and AI functions.

These third-party providers and their authorized employees may obtain access to personal data through the services they provide.

We select third-party providers with appropriate care, require confidentiality, and, where necessary, enter into data processing agreements with them in accordance with the GDPR. If you have questions about the service providers we use, you can contact us at privacy@brewquester.com.

Personal data is generally processed within the European Economic Area. Where service providers are located outside the EEA or access from outside the EEA is possible, we base such transfers on appropriate safeguards, in particular adequacy decisions, EU Standard Contractual Clauses, and supplementary protection measures.

You have the right to withdraw consent to the storage of your data at any time. We store personal data only as long as needed for the purposes described in this privacy policy or as required by law. Technical logs are generally stored only for a limited period for security and troubleshooting.

Account and app data are kept while the account is active or as needed for shared workspaces, support, security, legal obligations, billing, backups, and abuse prevention.

You can request deletion of your account. Account deletion may require that legitimate interests of other users or legal obligations are considered first. Certain data may remain where this is necessary or legally permitted.

We use appropriate technical and organizational measures to protect personal data.

You are not required to provide personal data. If you do not provide certain data, we may be unable to provide the website, an account, support, paid features, uploads, the AI scan, or individual app functions, or may only be able to provide them in a limited way.

Under the GDPR, you may request access, correction, deletion, restriction of processing, data portability, objection to processing, and withdrawal of consent. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

Privacy and data subject rights requests can be sent to privacy@brewquester.com.

You also have the right to lodge a complaint with a competent data protection supervisory authority. For Hamburg, this is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, mailbox@datenschutz.hamburg.de.

We may update this privacy policy from time to time when Brewquester, our processing activities, or legal requirements change.