Privacy & Security Policy

BrewChat is a networking platform that lets professionals, college students, and businesses create booking pages, discover others, and schedule short video or in-person conversations. We are based in the State of Michigan, United States.

For privacy questions, contact us at mg@brewchat.co.

We collect information in three ways: information you give us, information we collect automatically, and information we receive from third parties.

2.1 Information You Provide

• Account and profile information: Name, email address, password (stored in hashed form), company, professional title, years of experience, area of expertise, industry/category, university, major, graduation year, bio, LinkedIn profile URL, location, time zone, and the availability you set. We also store your profile photo where you provide one.
• Booking and conversation information: Session requests you send or receive, introductory messages, accept/decline decisions, scheduled times, meeting durations, and post-call ratings and feedback. We also collect guest emails if you invite others to a booking.
• Phone number: We require a US or Canada mobile number when you create or secure an account. The account number is private and is not shown on your public profile. You may separately choose whether BrewChat sends booking-request alerts to that number; providing the required number does not itself give SMS consent. If you opt into attendee reminders while booking, we collect the number you enter for that booking and use it only for those reminders. A different phone number may be collected when needed to conduct a phone-call or in-person meeting and may be shared with the other participant and booking guests through booking messages and calendar invitations.
• Resume and uploaded content: Any resume or document you choose to upload in connection with profile or resume-related features.
• Payment information: If you subscribe to a paid plan (e.g., BrewChat Plus, BrewChat Premium), your payment details are collected and processed by our payment processor (Stripe). We do not store full payment card numbers on our systems.
• Communications: Information you provide when you contact support, respond to surveys, or otherwise communicate with us.

2.2 Information We Collect Automatically

• Usage data: Pages viewed, features used, searches performed, bookings made, and interactions with the Services.
• Device and log data: IP address, browser type, device identifiers, operating system, referring URLs, error logs, and timestamps.
• Cookies and similar technologies: See Section 7: Cookies & Tracking.

2.3 Information From Third Parties

• OAuth Providers (LinkedIn, Google): If you sign up or log in with LinkedIn or Google, we receive profile information you authorize them to share, such as your name, email, photo, and professional details.
• Calendar Providers (Google Calendar, Microsoft Outlook, Apple Calendar): If you choose to sync a calendar, we receive availability and scheduling information necessary to display your open times, prevent double-bookings, and sync scheduled events.
• CRM and Contact Providers (HubSpot, Copper, Microsoft Outlook): If you choose to connect a CRM or contacts account, we use our integration provider Nango to make a read-only connection and import your contact records. This means we receive and store information about other people in your address book or CRM — for each contact, their name, email address, employer, job title, and the date their record was created or last modified in that system. We do not import phone numbers, notes, deals, message content, or any record of your interactions with those contacts, and we never write to or change your CRM. Imported contacts are visible only to you; we use their email addresses solely, and only on our servers, to tell you whether a contact is already on BrewChat, and we never display a contact’s email address back to you or reveal to that person that they appeared in your import. If you choose to send someone an invitation, we email that contact at the address we hold. Disconnecting a provider deletes the imported contact data we hold for that connection.
• Analytics & Error Tracking Providers: Aggregated usage information about how visitors interact with the Services, as well as crash reports and performance data.

We use the information we collect to:

• Create and manage your account, profile, and subscription tier (Starter, Plus, Premium).
• Operate core features — discovery/search, booking, accept/decline filtering, and scheduling.
• Generate and host or coordinate your chosen meeting format (Zoom, Google Meet, phone, or in person), send confirmations and reminders via email, and send the SMS booking notifications you separately choose.
• Process subscriptions, payments, and enforce plan limits.
• Display your profile and availability to other users so they can find and book you.
• Communicate with you about your account, transactions, and service updates.
• Send marketing or product communications (where permitted — you can opt out at any time).
• Maintain security, prevent fraud and abuse, monitor system health, and enforce our Terms.
• Analyze and improve the Services.
• Comply with legal obligations.

Legal Bases (for users in the EU/UK)

Where applicable, we process personal data on the basis of: contract (to provide the Services you request), legitimate interests (to operate, secure, and improve the Services), consent (e.g., certain marketing and cookies), and legal obligation.

We do not sell your personal information. We share information only as described below.

• With other users: Your profile, professional details, availability, total sessions, and ratings are visible to other users to enable discovery and booking. Do not include information in your profile you don’t want others to see.
• For business/company pages: If you book with or appear on a company’s Business Page, relevant booking and profile information may be shared with that company and its team members.
• With service providers (sub-processors): We share data with vendors who perform services on our behalf under contractual confidentiality and data-protection obligations. Our current sub-processors include:

• For legal reasons: To comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of BrewChat, our users, or others.
• In a business transfer: In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.
• With your consent: For any other purpose disclosed at the time you provide the information.

BrewChat lets you hold your scheduled conversations in whichever format you and the other participant choose:

• Video calls via Zoom or Google Meet. These providers process meeting data under their own privacy policies.
• Phone calls, where the contact details needed to connect may be shared between participants.
• In-person meetings, where any location or arrangement details are shared between participants.

We do not record meetings by default. If recording or AI summary features are introduced, we will obtain required consent from participants before recording.

We retain personal information for as long as your account is active or as needed to provide the Services, and afterward as required to comply with legal obligations, resolve disputes, and enforce agreements. When information is no longer needed, we delete or de-identify it. You may request deletion of your account as described in Section 9.

We retain account phone numbers while the account is active and retain records of SMS consent, opt-outs, and delivery status as needed to honor messaging choices, prevent messages after an opt-out, resolve delivery issues, and meet legal or carrier requirements.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Services, and understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required by law, we will request consent for non-essential cookies.

We take reasonable and appropriate technical and organizational measures to protect personal information, including:

• Encryption in transit: All traffic to and from the Services is encrypted using HTTPS/TLS.
• Encryption at rest: Data stored in our database is encrypted at rest by our hosting provider (Supabase).
• Authentication: Passwords are not stored directly; we use industry-standard authentication mechanisms and OAuth sign-in via trusted providers (Google, LinkedIn).
• Access controls: Access to production systems and personal data is limited to authorized personnel on a need-to-know basis.
• Payment security: Payments are handled by Stripe, a PCI-DSS Level 1 certified processor; we do not store full card numbers.
• Infrastructure: We rely on reputable cloud providers with their own security and compliance programs.
• Monitoring and updates: We monitor for unauthorized access and application errors (using our hosting provider's observability tools) and apply security updates as necessary.

No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

Data Breach Notification: If we become aware of a security incident affecting your personal information, we will notify you and applicable authorities as required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your personal information.
• Port your information to another service.
• Opt out of marketing communications (use the unsubscribe link or contact us).
• Turn off booking-request texts in account settings, or reply STOP to any BrewChat text to suppress further messages to that number. Reply HELP for help.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at mg@brewchat.co. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising these rights.

You can also update most profile information directly in your account settings, and delete your account at any time.

Residents of certain U.S. states (such as California, Virginia, Colorado, Connecticut, Texas) have specific rights regarding their personal information, including the rights to know, access, correct, delete, and opt out of the “sale” or “sharing” of personal information. BrewChat does not sell your personal information. To exercise applicable state-law rights, contact us at mg@brewchat.co.

BrewChat is operated from the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country. Where required, we use appropriate safeguards for international transfers.

The Services are intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child under 18 without appropriate consent, we will delete it.

(Note: Services are currently restricted to college-level students, professionals, and companies. Expansion to users under 18 is strictly prohibited until a compliant minor flow is established).

The Services may link to or integrate with third-party websites and services (e.g., LinkedIn, Google, Zoom, Apple Calendar). Their privacy practices are governed by their own policies, not this one. We encourage you to review them.

We may update this Policy from time to time. We will post the updated version with a new “Last Updated” date and, where required, provide additional notice. Your continued use of the Services after changes take effect constitutes acceptance.

This Policy is governed by the laws of the State of Michigan, without regard to its conflict-of-laws principles, except where superseded by applicable consumer-privacy law.

BrewChat.Co

Email: mg@brewchat.co

Website: brewchat.co