Brew

GDPR overview

GDPR is addressed concretely rather than in passing. Brew publishes a dedicated GDPR page, a full Data Protection Addendum and a dated, named list of subprocessors. Roles are set out explicitly: the customer is controller for recipient data, Brew is processor, and Brew is controller for its own account, billing and site-usage data. Cross-border transfers rely on the EU Standard Contractual Clauses (Module 2), the UK International Data Transfer Addendum and Swiss equivalents; Brew states it has not self-certified to the Data Privacy Framework. Data-subject requests concerning data Brew controls go to legal@brew.new, with a right to complain to a local supervisory authority. Two gaps are worth noting: no Article 27 EU representative and no Data Protection Officer is named anywhere in the legal pages.

Who owns the data?

Brew's terms state that, between the parties, the customer owns the Outputs generated from their prompts, minus any Brew materials, system prompts or templates embedded in them; Brew and its suppliers own the Service itself. For recipient data uploaded to the platform, the customer is the controller and Brew the processor under the published DPA. For account, billing and security-log data, Brew acts as an independent controller. Brew may also derive anonymised, aggregated Analytics Data and use it for its own purposes. Separately, Brew may attach a discreet attribution to public emails, feature published templates in its gallery, and name the customer commercially, which can be refused by emailing legal@brew.new within thirty days.

Reuse rights

Customers can reuse what they create without asking permission: they own their Outputs, keep their contact data, and can export it at any time from the same Audience section used to import it, a position Brew frames as a rejection of vendor lock-in. Finished emails can be sent from Brew, pushed as templates into a connected ESP, or downloaded as raw HTML on paid plans. On Brew's side, the security page states that limited samples from Free Plan accounts may be used to train or fine-tune Brew-hosted models, while paid plans are excluded from training; outputs from any account may still be evaluated to improve the system without training a model. The terms also allow Brew to scan content, links, inputs and outputs for abuse, malware, spam and policy violations. Feedback sent to Brew is licensed to it perpetually and irrevocably.

Data retention & training

Hosting summary

Brew states that it processes and stores data primarily in the United States, and invites customers with specific residency requirements to contact the team; no self-service European region is offered. The application runs on Vercel, with Cloudflare for DNS and network security, Convex and MongoDB Atlas as databases, Upstash for caching, Turbopuffer for vector search, Clerk for authentication, Datadog for monitoring and Resend, Mailgun and Entri for sending and domain services. Model traffic is routed mainly through Vercel's AI Gateway to Anthropic, Google, OpenAI, xAI, AWS, Fal.ai and Cohere. Data at rest is encrypted with AES-256, with row-level encryption on sensitive tables; data in transit uses TLS 1.3 or higher. Backups are point-in-time, kept for 30 days and replicated globally. The full subprocessor list is public and dated, and Brew commits to updating it whenever a provider changes.