Privacy Policy
Last updated: June 7, 2026
BrewedOps ("BrewedOps", "we", "us") provides a web dashboard of productivity tools for GoHighLevel (GHL) agencies and virtual assistants, available at brewedops.com. BrewedOps is operated from the Republic of the Philippines. This policy is aligned with the Data Privacy Act of 2012 (Republic Act No. 10173) and, for the users it covers, with the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA). It explains what we collect, why, how we protect it, and the rights you hold. Region-specific rights are in Section 8 (EU/UK) and Section 9 (California).
1.Information we collect
| Data | Why we collect it | Where it lives |
|---|---|---|
| Email address | Account creation, sign-in, transactional email | Our database |
| Full name | Profile display and leaderboard | Our database |
| Password | Authentication - stored only as a one-way hash, never in plain text | Our database |
| Profile preferences (avatar, border, theme) | Personalising your workspace | Database + your browser localStorage |
| Usage & gamification data (XP, levels, streaks, typing/reaction scores, game progress, tasks) | Running the Play-mode features and your task board | Our database |
| Support tickets (name, email, message, issue type) | Responding to help requests | Our database |
| Messages you send (Kape AI assistant chats, in-game World Chat) | Providing the AI assistant and community chat features | Our database |
| Technical data (IP address, session token, timestamps) | Session security and abuse prevention | Our database (sessions) |
2.How we use your information
- To provide, operate, and maintain the Service.
- To authenticate you and keep your session secure.
- To display your profile, scores, and rank where you choose to participate.
- To send essential transactional email (welcome, password reset) via Resend.
- To respond to support tickets and improve the Service.
Our lawful bases for processing (RA 10173 and GDPR Art. 6) are: performance of a contract (operating the account and tools you sign up for), your consent (given when you create an account, and which you may withdraw at any time), and our legitimate interest in keeping the Service secure and preventing abuse. Withdrawing consent does not affect processing already carried out, and you can withdraw it fully by deleting your account. We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you (GDPR Art. 22).
3.The tools and how they handle data
BrewedOps Pro Mode includes Workflow Creator, Marketing, Claude Code, UI Prompts, Glossary, PDF Tools, PDF Forms, Pomodoro, Mini Tools, the OLJ Job Board, and Tasks. A few handle data in specific ways:
- GHL API tools - any GoHighLevel token or sub-account ID you enter is used to call GoHighLevel from your session. We do not harvest or store your clients' GHL data.
- PDF Tools - files you open are processed locally in your browser and are not uploaded to our servers.
- PDF Forms - to make a PDF fillable, the file you upload is sent to our server to detect its form fields and is returned to you. We use it only for that request.
- AI features - prompts you submit are sent to AI providers to generate a response: Anthropic (Claude) for most features and Google (Gemini) for some. The Kape AI assistant saves your chat history to your account so it can keep context across a conversation; that history is removed when your account is deleted.
- Video to Text - audio you submit for transcription is sent to Groq.
- OLJ Job Board - displays publicly available job listings sourced from OnlineJobs.ph. We do not share your data with them.
- Mini Tools - utilities such as the JSON formatter and regex tester run entirely in your browser.
4.Data sharing
We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. We disclose data only to the processors (service providers) needed to run the Service, each bound by contract to use it only on our instructions:
- Resend - delivery of transactional email.
- Anthropic and Google - processing of prompts you submit to AI features (Claude and Gemini).
- Groq - transcription of audio you submit to the Video to Text tool.
- Our hosting provider - infrastructure on which the Service runs.
We may also disclose data if required by law or a valid legal process.
5.Storage and security
- Data is stored on a private virtual server and served only over encrypted connections (HTTPS/TLS).
- Your session uses a secure, HttpOnly cookie - the token is not readable by JavaScript and is not exposed to other sites.
- Passwords are stored as a one-way hash; we never store or display your plain-text password.
- A strict Content-Security-Policy limits what code and resources can run on the site.
- The database uses access controls and is not publicly reachable.
No method of transmission or storage is perfectly secure, but we apply reasonable and appropriate organisational, physical, and technical safeguards as required by RA 10173. If a breach affecting your personal data occurs, we will act in line with the Act's notification requirements.
6.Cookies and local storage
We use one essential HttpOnly session cookie to keep you signed in. We also use your browser's localStorage for preferences (theme, avatar/border, checklist progress). We do not use advertising cookies or third-party analytics/tracking.
7.Your rights as a data subject
Under the Data Privacy Act of 2012, you have the right to:
- Be informed about how your data is processed.
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data (you can edit your name, avatar, and preferences in-app).
- Erasure or blocking - delete your account and associated data yourself from Profile menu → Delete Account, or request it from us.
- Object to certain processing, and to restrict processing in some cases.
- Withdraw consent at any time, without affecting processing already done.
- Data portability - request a copy of your data in a usable format.
- Damages and to file a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated.
You can use most of these immediately in-app: edit your name, avatar, and preferences anytime, and delete your entire account and data from Profile menu → Delete Account (this takes effect right away). For access or portability requests, use File a Ticket on the sign-in page or email us (see Contact). We respond to verified requests within 30 days and never charge for them.
8.If you are in the EU or UK (GDPR)
If you are in the European Economic Area or the United Kingdom, the GDPR / UK GDPR gives you the rights listed in Section 7 - access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. In addition:
- Controller - BrewedOps is the data controller for the personal data described here. Contact details are in Section 14.
- International transfers - your data is processed in the Philippines and by the processors in Section 4, which may be outside the EEA/UK. Where required, these transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision, and the processors are contractually bound to protect your data.
- Complaints - you may lodge a complaint with your local supervisory authority (for example, your national Data Protection Authority, or the UK Information Commissioner's Office at ico.org.uk).
- No automated decisions - we do not subject you to decisions based solely on automated processing that have legal or similarly significant effects.
9.If you are in California (CCPA/CPRA)
If you are a California resident, the CCPA (as amended by the CPRA) gives you specific rights over your personal information.
In the last 12 months we collected the following categories of personal information (see Section 1 for specifics): identifiers (email, name, IP address), customer account records, internet/usage activity (gamification and tool-usage data), and the contents of messages you choose to send (AI assistant chats, world chat, support tickets). We collect these directly from you and from your use of the Service, for the business purposes in Section 2. We do not collect sensitive personal information for the purpose of inferring characteristics, and we do not sell or share personal information.
Your California rights:
- Know / Access - request the categories and specific pieces of personal information we hold about you.
- Delete - request deletion of your personal information (also available instantly via Profile menu → Delete Account).
- Correct - request correction of inaccurate personal information.
- Opt out of sale/sharing - not applicable, because we do not sell or share personal information.
- Limit use of sensitive personal information - not applicable, because we do not use sensitive personal information for purposes that would trigger this right.
- Non-discrimination - we will never deny service, charge a different price, or provide a lower quality of service because you exercised any of these rights.
To exercise these rights, email us or use File a Ticket (see Contact). You may use an authorised agent to submit a request on your behalf; we will ask for proof of authorisation and may verify your identity before acting.
10.Data retention
We keep account data while your account is active. When you request deletion, your profile, scores, tasks, tickets, and sessions are permanently removed within 30 days, except where we are required to retain certain records by law.
11.Children's privacy
The Service is intended for working professionals and is not directed at children. We do not knowingly collect data from children under 16 (or the minimum age in your jurisdiction, which is 13 in the United States). If you believe a child has provided us data, contact us and we will delete it.
12.International users and transfers
BrewedOps is operated from the Philippines and data is stored on infrastructure, and processed by the providers in Section 4, that may be located outside your country. Where the law requires it, these cross-border transfers are protected by appropriate safeguards - such as the EU Standard Contractual Clauses with the UK Addendum, or transfers to providers in jurisdictions with an adequacy decision - and every provider is contractually bound to protect your data. By using the Service you understand your data may be processed in those locations under these safeguards.
13.Changes to this policy
We may update this policy as the Service evolves. Material changes take effect when posted, and the "Last updated" date above will change.
14.Contact
For privacy questions, data requests, or to reach our privacy contact, email brewedops@gmail.com or use File a Ticket on the sign-in page. You may also lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).