Privacy Policy

1. Who We Are

Brewed is an independent South African coffee community platform. We connect coffee lovers with independent roasters, blends, and coffee shops across South Africa. References to "Brewed", "we", "us", or "our" in this policy refer to the operator of brewed.co.za.

2. Information We Collect

Information you provide directly

• Account registration details — username and email address
• Reviews and ratings you submit
• Roaster, blend, and shop submissions you contribute
• Profile information such as your bio and province

Information collected automatically

• Basic usage data such as pages visited and features used
• Device type and browser information
• IP address for security purposes

Information we do not collect

• Payment card details (handled entirely by PayFast)
• Government identification numbers
• Sensitive personal information as defined by POPIA

3. How We Use Your Information

• To create and manage your Brewed account
• To display your reviews and contributions on the platform
• To award badges and passport stamps
• To send account-related notifications (new badge earned, review posted)
• To improve the platform based on usage patterns
• To communicate platform updates when you have opted in

We do not sell your personal information to third parties. We do not use your data for advertising profiling.

4. Community Submissions

When you submit a roaster, blend, or coffee shop, you confirm that the information provided is publicly available and does not include personal contact details of individuals without their consent. Submissions are reviewed by our team before being published.

Your username will appear alongside reviews you post. You may use a pseudonym — your real name is never displayed publicly unless you choose to include it in your profile.

5. Data Storage and Security

Your data is stored securely on Supabase infrastructure hosted in the European Union (Ireland region). Supabase is SOC 2 compliant and implements industry-standard encryption at rest and in transit.

Passwords are hashed using bcrypt and are never stored in plain text. We do not have access to your password.

While we take reasonable precautions, no internet transmission is 100% secure. Please use a strong, unique password for your Brewed account.

6. Data Retention

We retain your account information for as long as your account is active. If you request deletion of your account, we will remove your personal information within 30 days. Reviews you have posted may be retained in anonymised form for platform integrity purposes.

7. Third-Party Services

Brewed uses the following third-party services:

• Supabase — database, authentication, and file storage
• Vercel — website hosting and deployment
• PayFast — payment processing (when applicable)

Each of these providers operates under their own privacy policies and security standards. We have selected providers that meet appropriate data protection standards for South African users.

8. Your Rights Under POPIA

Under the Protection of Personal Information Act (POPIA), you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at the email address below.

9. Cookies

Brewed uses only essential cookies required for authentication and session management. We do not use tracking cookies or advertising cookies. You cannot opt out of essential cookies as they are required for the site to function.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email to registered users. Continued use of Brewed after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related queries, to exercise your rights, or to report a concern, please contact us at:

Email: brewed.community@gmail.com

We aim to respond to all privacy requests within 5 business days.