Privacy Policy

Last updated: April 2, 2026

1. Introduction

BeerCraft ("we", "us") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data. This policy complies with Brazil's LGPD (Lei Geral de Proteção de Dados) and applicable US privacy laws.

2. Data We Collect

• Account data: Email address, name, and profile photo (from Google OAuth).
• Recipe data: Beer recipes, brewing parameters, and brew tracking data you create.
• Payment data: Processed by Stripe. We store your Stripe customer ID but never your card number.
• Usage data: Session cookies for authentication.

3. How We Use Your Data

• To provide and maintain the Service.
• To process subscription payments.
• To communicate about your account (password resets, billing notifications).
• We do not sell your personal data. We do not use your data for advertising.

4. Legal Basis (LGPD)

We process your data based on:

• Consent: You consent to data processing when you create an account.
• Contractual necessity: Processing needed to provide the Service you subscribed to.
• Legitimate interest: Maintaining security and improving the Service.

5. Your Rights (LGPD)

Under Brazil's LGPD, you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your data (right to erasure).
• Port your data to another service.
• Revoke consent at any time.
• Know which entities your data has been shared with.

To exercise these rights, contact our Data Protection Officer at dpo@beercraft.app.

6. Data Retention

We retain your data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days. Anonymized usage data may be retained for analytics.

7. Data Sharing

We share data only with:

• Stripe: For payment processing.
• Resend: For authentication emails.
• MongoDB Atlas: For data storage (encrypted at rest).

We do not share data with advertisers or data brokers.

8. Cookies

We use essential cookies only:

• Session cookie: For authentication (Auth.js).
• Consent cookie: To remember your cookie consent choice.

No tracking cookies, no analytics cookies, no third-party cookies.

9. Security

We use HTTPS encryption, JWT tokens for session management, and encrypted database storage. We conduct regular security reviews.

10. International Data Transfers

Your data may be stored on servers outside Brazil. We ensure appropriate safeguards are in place for international transfers as required by LGPD.

11. Children

The Service is not intended for users under 18. We do not knowingly collect data from minors.

12. Changes to This Policy

We may update this policy at any time. We will notify you of material changes via email.

13. Contact

• General inquiries: legal@beercraft.app
• Data Protection Officer (DPO): dpo@beercraft.app