BrewOS

This is a translation; the Finnish version prevails.

Privacy policy

This is the privacy policy of the BrewOS service (brewos.fi) under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act. It explains what personal data we process, why, who we disclose it to, how long we keep it and how you can exercise your rights.

Updated 27 October 2026.

Controller

BrewOS (2307798-3), Kymintie 4 A21, 15140 Lahti, Finland.

Privacy matters: Veikko Hyyrynen, tuki@brewos.fi.

Who this policy covers

BrewOS is a business service for breweries. This policy covers

  • the service's users: employees of customer companies and other people who have a user account in the service
  • contact persons of the customer companies' own customers and partners, whose details a customer company stores in the service
  • visitors to our public pages.

A customer company is itself the controller of the data it stores in the service about its own customers and partners. For that data BrewOS acts as a processor and processes it only on the customer company's behalf, to provide the service.

What data we process

User data

  • name and email address
  • password as a hash (we never store the password itself) and the two-factor authentication key, if the user has turned it on
  • the user's choices, such as language and interface version
  • the accounts the user can access and their role on each

Usage data

  • sign-ins and the change history of what was changed in the service, by whom and when
  • page load times, for monitoring the service's performance
  • API calls made by AI assistants and other software (MCP and other APIs): the operation called, when, and whether it succeeded
  • granted access (OAuth) and API keys; keys are stored as hashes

Customer companies' business data

Most of the data in the service is business data: recipes, production batches, stock, shipments, invoices and reports to authorities. It can include names, email addresses, phone numbers and delivery addresses of contact persons at the customer companies' customers and partners.

The service does not collect sensitive personal data, such as health data, or payment card data.

Purposes and legal bases

  • Providing the service to the customer company and its users: contract with the customer company.
  • Security, abuse prevention and troubleshooting (for example the change history and the API call log): legitimate interest.
  • Developing the service from aggregated usage and performance data: legitimate interest.
  • Billing and accounting: contract and legal obligation.
  • Service notices to users, for example about an account due for deletion: contract and legitimate interest.

We do not sell personal data or make automated decisions based on it that have legal effects. We do not use the service's data for advertising. We use visit data from our public pages to measure and target our ads only if the visitor has accepted marketing cookies, see About cookies.

Recipients

We disclose data only to:

  • Hosting and email. The service and its database run on servers of a Finnish hosting company, and the service's email is relayed through it.
  • Services the customer company connects itself. When a customer company turns on an integration, such as an accounting or e-invoicing service (for example Netvisor, Procountor, Fennoa or Maventa), the service passes it the data the integration needs, such as invoices and customer details.
  • Authorities. Reports made by the customer company's users are delivered to the Finnish Licensing and Supervisory Agency (Lupa- ja valvontavirasto) and the Finnish Tax Administration. We also disclose data when a competent authority requires it under law.
  • AI assistants. When a user connects an AI assistant, such as ChatGPT or Claude, the service passes the assistant the data it reads or changes on the user's behalf, never beyond the user's own rights and only on the account the user granted access to. The assistant's provider processes the data it receives under its own terms and privacy policy. See AI assistant connections below.
  • Visitor statistics. If the visitor accepts statistics cookies, our public pages use Google Analytics, see About cookies.
  • Ad measurement. If the visitor accepts marketing cookies, the public pages pass visit data to Google (Google Ireland Limited) and Meta (Meta Platforms Ireland Limited), see About cookies.

Transfers outside the EU and EEA

The service's data is stored in the EU, and we do not ourselves transfer personal data outside the EU or EEA. AI assistants a user connects, Google Analytics, Google Ads and Meta may process data outside the EU and EEA under their providers' terms.

AI assistant connections

An AI assistant gets access only when the user signs in to BrewOS and approves the access themselves (OAuth). When approving, the user picks the account and the access level: read only or read and write. The assistant always acts within the user's own current rights.

Users see the access they have granted on Settings > AI agents and can revoke any of it at any time; access ends immediately. Access also expires on its own after 60 days at the latest.

API calls are logged for security and troubleshooting. Conversations with the assistant are not stored in BrewOS.

Retention

  • User and account data is kept while the account is in use. An unused account is deleted automatically: an account that never had a licence after six months without use, and an account whose licence has ended after 18 months. Users are notified in advance, and the data is permanently deleted 14 days after the notice.
  • Change history is kept for 365 days.
  • The API call log is kept for 90 days.
  • Page load times are kept for 30 days; after that only aggregated statistics remain, from which no individual user can be identified.
  • Billing data is kept for the period the Finnish Accounting Act requires.
  • Backups are taken daily. Deleted data also disappears from backups as old backups are replaced by new ones.

A user can ask for their data to be deleted sooner, as described below.

Your rights

You have the right to

  • know what data about you is processed and get a copy of it
  • have inaccurate data corrected
  • have your data deleted or its processing restricted
  • object to processing based on legitimate interest
  • receive the data you provided in a machine-readable format. An account owner can export the account's data themselves on Settings > Data export.

Send requests to tuki@brewos.fi. We reply within one month. If your data was stored by a customer company whose customer or partner you are, you can also contact that company directly.

If you believe the processing of your data breaks data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

Security

  • Connections to the service are encrypted (HTTPS).
  • Passwords and API keys are stored only as hashes.
  • Users can turn on two-factor authentication.
  • Each customer company's data is isolated: a user sees only the accounts they have been given access to, and only as far as their role allows.
  • Only people authorised by the service provider can access the servers.

Changes

We may update this policy as the service changes. The current version is always on this page, with its date at the top.

Page last updated 3 Nov 2026 10:16