How we handle your data.

Brewlytics.ai (“we,” “us,” “Brewlytics”) is the company behind the Barley product. Our marketing site lives at brewlytics.ai. You can reach us at privacy@brewlytics.ai. This notice covers what happens on our marketing site, plus a product section below on how we handle data inside the Barley product as a processor for breweries. Detailed product data-processing terms live in the Data Processing Agreement available to customers in their Brewlytics dashboard, and in the brewery agreement.

Most of this notice is about our marketing site. This section is different: it explains how we handle personal data inside the Barley product — the dashboard, Release Radar SMS, and the embeddable Barley chat widget that breweries place on their own websites.

The brewery is the controller; Brewlytics is the processor. When a brewery uses Barley, it decides why and how its customers’ and website visitors’ data is processed — those are the brewery’s customers and the brewery’s relationship. We process that data on the brewery’s instructions to run the product. For a narrow set of platform purposes (such as de-identified, aggregate models like the Beer Genome, and securing and improving the Service), Brewlytics may act as an independent controller — this is flagged for transparency and is subject to legal review.

What the chat widget processes. A website visitor types a message into the widget on the brewery’s site. That message is sent to Brewlytics and forwarded to our AI sub-processor, Anthropic, to generate a reply. Chat history is held client-side in the visitor’s browser and posted to us one turn at a time; the widget backend is stateless, and no secret keys are exposed to the website that hosts the widget.

Recognition (optional). In the Barley app a customer can turn on recognitionfor the breweries they visit. When it’s on, a brewery they check into can see their first name, that they’re a regular there, and their usual order — scoped to that brewery only, never their history anywhere else. It’s off until the customer switches it on, and they can switch it off any time in their Barley profile.

Location in the Barley app (optional). The Barley iOS app can use your location to notice when you arrive at a brewery you follow, verify your visit, and remind you to rate a beer you bought. If you grant it, the app asks iOS to watch small geographic zones (geofences) around up to 18 breweries you follow — this uses the “Always” location permission so it works while the app is closed. Your location itself is processed on your device: we never receive your coordinates, a movement trail, or any location history. The only things sent to our servers are the fact that you arrived at a specific followed brewery (a check-in) and, if you stay a while, that the visit was long enough to count as verified. The feature is entirely optional — the app works without it — and you can turn it off any time in iOS Settings → Barley → Location. We never use this data for advertising and never share or sell it.

The vendors that help us run the product (our sub-processors) and the data-processing terms between Brewlytics and each brewery are documented in the Sub-processors list and Data Processing Agreement available to customers in their Brewlytics dashboard (Settings → Data Processing) — not by this marketing-site notice. If you interacted with a Barley widget and want your data handled, contact the brewery whose site you used (they are the controller); we’ll assist them as their processor.

Four categories, in plain English.

• What you tell us. When you book a demo or email privacy@brewlytics.ai, we get whatever's in the message — your name, brewery, and what you're trying to do. We use that to talk to you.
• What your browser tells us (with consent). If you accept analytics cookies, Google Analytics records anonymous usage data: which pages you visit, how long you stay, what country you're in. We use this to see what's working and what's broken on the site.
• What identifies your business (with consent). If you accept marketing cookies, we use Artisan (artisan.co), a B2B visitor-identification service. It matches network signals — your IP address, browser and device data, and the pages you view — against Artisan’s third-party business database to tell us which company is visiting. It identifies organizations, not named individuals, and we use it so our team can follow up with breweries that show interest. It stays off until you accept marketing cookies.
• Necessary site state. Your cookie choice itself is stored in your browser's local storage so we don't ask you again. That's it for this category.

We use cookies and equivalent storage in three categories. You can switch the optional ones on or off in cookie settings, or by clicking “Cookie settings” in the footer.

• Necessary

  Always on

  What: Local storage entry storing your cookie consent decision.

  Why: Required for the site to work and to remember this choice.

• Analytics

  Off until you accept

  What: Google Analytics 4 / Google Tag Manager. Pseudonymized identifiers, page-view events, click and scroll events.

  Why: To see what's actually used and where the friction is. This data is aggregated and pseudonymized — we don't use it to identify you. Business-level visitor identification is a separate, marketing-category feature (see below) that only runs if you accept marketing cookies.

• Marketing

  Off until you accept

  What: Artisan (artisan.co) website visitor identification. Matches your IP address and browser/device signals against Artisan's B2B database to identify the company visiting — firmographic, company-level data only, not named individuals.

  Why: So our team knows which breweries and businesses are interested and can reach out. Denied by default under Consent Mode v2; fires only after you accept marketing cookies, and you can withdraw consent anytime.

We use Google Consent Mode v2: analytics tags only fire after you accept analytics cookies, and they default to denied state until then.

Email correspondence is handled through Google Workspace. Demo bookings flow through Calendly. Anonymous analytics flow through Google Tag Manager / Google Analytics 4. If you accept marketing cookies, business-identification signals also flow to Artisan (artisan.co) so it can tell us which company is visiting. The site itself is hosted on Vercel and uses Cloudflare DNS. Each of these vendors has their own data-handling terms; we picked them because they're commonly audited and compliant with the regulations below.

We don’t sell your personal information for money. If you accept marketing cookies, we do share visitor signals with Artisan so it can identify the visiting business on our behalf — under some U.S. state privacy laws (such as California’s CCPA/CPRA) that kind of sharing for our own outreach can be treated as a “sale” or “share.” You can opt out at any time by declining marketing cookies in cookie settings or by emailing privacy@brewlytics.ai. Otherwise we only share data with the vendors listed above, and only the minimum each one needs to do its job.

Depending on where you live (GDPR, CCPA, or similar), you have the right to know what we have about you, ask for a copy, ask for it to be corrected, and ask for it to be deleted. Email privacy@brewlytics.ai with the request and we'll respond within 30 days.

If you change your mind on cookies, you can revoke or update consent any time at cookie settings.

If we materially change anything in here we'll bump the version of the consent banner so you're asked to confirm again on your next visit. The “last updated” timestamp at the top of this page reflects the most recent edit.

Privacy questions go to privacy@brewlytics.ai. We aim to respond within two business days.