Legal
Privacy statement
Which personal data Brewless holds, why, where it is kept, who else handles it, and what stays in your own accounts.
On this page
Note
Version of 20 October 2026.
Who we are
Brewless is a product of Coding Agency, Blankenstein 131, 7943 PE Meppel, the Netherlands (Chamber of Commerce number 50814281). Coding Agency is the controller for the personal data described here. Questions and requests go to contact@coding.agency.
What Brewless is, and what that means for your data
Brewless deploys and operates applications in your own cloud accounts. Two kinds of data follow from that, and they are treated very differently.
Data in your own accounts. Your application, its database, its files, its logs and its visitors live in your Scaleway project and your bunny.net account. Brewless is not in the path of your visitors' traffic and keeps no copy of your application's data. You are the controller for that data; where Brewless can reach it at all, it does so on your instruction, under the data processing agreement.
Data Brewless holds itself. What we need to give you an account and to do what you ask. That is what the rest of this statement is about.
What we hold, and why
| Data | Why | Legal ground |
|---|---|---|
| Early access: your email address and, if you gave them, what you build with, where you host and your team size | To tell you when your batch opens | Your consent, which you confirm by mail |
| Account: your name, email address, role, and the public half of your passkeys | To sign you in and show your team who is who | The agreement with your organisation |
| Signing in: sign-in links and codes (kept as a hash, valid for 15 minutes), command line tokens (kept as a hash), and your sessions with the IP address and browser they came from | To sign you in securely | The agreement; our legitimate interest in security |
| Organisation: its name, its applications and environments, references to the resources at your providers, releases, the names of your variables | To deploy and operate what you ask us to | The agreement |
| Provider keys: the API keys you connect, stored encrypted | To act in your accounts on your instruction | The agreement |
| Billing: the company name, address, VAT number and invoice address the owner gives, the plan, payments and invoices. The VAT number is checked against the EU's public VIES register. Your payment method and mandate stay with Mollie; we keep only Mollie's references to them | To charge for Brewless and to keep the invoices tax law asks for | The agreement; our legal obligation to keep invoices |
| Audit trail: who did what and when in your organisation | So changes can be traced; you can read it yourself | The agreement; our legitimate interest in security |
| Mail: the address a message was sent to and whether it was delivered | To deliver sign-in mails and invitations | The agreement |
| Technical logs: the time and the page asked for; at the edge of our network, with the visitor's address made anonymous | To keep the service running and to investigate abuse | Our legitimate interest in security |
| Visitor counts: on the public site and the documentation, the page, the site you came from, your browser's language, your screen size and any campaign tags in the address. No cookies, and nothing that follows you to another site or visit. The console and admin are not counted | To see which pages are read and how people find us | Our legitimate interest in improving the site |
What we do not hold: the value of any of your application's secrets (they are in your own Secret Manager; we keep names and a checksum), your application's logs and metrics (read from your provider when you look at them), and your application's data.
There is no advertising on brewless.eu, no profile is built of you, and we do not sell or share data for marketing.
Cookies
Only what the site needs to work: a session cookie and a cookie that protects forms once you sign in, and a cookie that remembers your language. Whether you prefer the light or the dark theme is kept in your browser's own storage. None of these follow you to other sites, so there is no cookie banner.
Who else handles this data
We use a small number of processors, all established in the European Union, and each handles only what its task needs.
| Processor | Task | Where |
|---|---|---|
| Scaleway SAS | Hosting of Brewless and its database | France (Paris) |
| BunnyWay d.o.o. (bunny.net) | Content delivery and DNS for brewless.eu, routed through the EU only, with visitor addresses made anonymous in its logs | Slovenia; EU points of presence |
| Lettermint | Delivery of our mail | European Union |
| Mollie B.V. | Payments, once you take a paid plan | The Netherlands |
| ClearAnalytics | Visitor counts on the public site and the documentation | European Union |
We do not transfer this data outside the European Economic Area.
How long we keep it
- Early access: until your batch has opened and you were told, or until you ask us to remove it, whichever comes first.
- Account and organisation: for as long as the organisation exists. When an organisation is ended, its data is removed within 30 days: its database, its members and everything recorded in it. Invoices and payment records are kept as described below.
- Sign-in links and codes: 15 minutes. Sessions: until you sign out or they run out.
- Provider keys: until you disconnect the provider. Disconnecting removes the key from Brewless at once.
- Invoices, once there are any: seven years, as Dutch tax law requires.
Security
Provider keys are encrypted at rest. Sign-in is without passwords: by a link sent to your address or by a passkey. Sign-in secrets and command line tokens are kept only as a hash. The values of your application's secrets are never stored or logged by Brewless. Every change is written to the audit trail of your organisation.
Your rights
You can ask us to show, correct, or remove your personal data, to limit or object to its use, and to hand it over in a common format. Consent you gave can be withdrawn at any time. Write to contact@coding.agency; we answer within a month.
If you believe we handle your data wrongly, tell us first so we can put it right. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
When this statement changes, the new version appears here with its date. If a change matters to what you agreed to, we tell you by mail first.