Privacy Policy

Last updated October 18, 2026

Brewster AI is a website audit service operated by JNova IT Solutions ("we", "us"). This policy explains what we collect, why, and the choices you have. It is written to meet the Philippine Data Privacy Act of 2012 (RA 10173), the EU/UK GDPR and similar laws.

What we collect

• Account data: your name, email address and, if you use a password, a scrypt hash of it (we never store your actual password). If you sign in with Google, we receive your name, email, profile picture and a Google account ID. We do not get access to your Gmail, Drive or contacts.
• Sites and audits: the website addresses you add, and the results of crawling their public pages (titles, headings, links, speed and similar signals). We do not log in to your website or change it.
• AI requests: when you use Brewster's fixes or the AI answer check, the relevant audit data (and, for alt text, the public images from your site) is sent to our AI provider (Google Gemini) to generate the result.
• WordPress plugin (add-on): the Brewster AutoFix plugin sends us your licence key, your site's address and name, and, to write suggestions, each page's address, title, current SEO title and description, the first part of its text, and the addresses of images without alt text. It does not send your visitors' or customers' data. We store which website each licence is active on and when it last checked in.
• Billing: subscriptions and one-time add-on payments are handled by PayPal. We store your PayPal subscription ID, its status and dates, your plan, and a one-way hash of your PayPal payer ID (to allow one free trial per PayPal account). We never see or store your card or bank details.
• Security data: for rate limiting and abuse prevention we store keyed hashes of IP addresses for short periods (minutes to hours), never the raw IP.

How we protect it

• All traffic uses HTTPS (TLS), with HSTS and a strict Content Security Policy.
• Your email address and name are encrypted in our database with AES-256-GCM. The database is MongoDB Atlas, which is also encrypted at rest.
• Sessions use random tokens in secure, HttpOnly cookies. We store only a hash of each token, and you can sign out of every device from Settings.
• Logins are rate-limited and accounts are temporarily locked after repeated failed attempts.

How we use it

To run the service (audits, AI fixes, reports, alerts), to process payments, to secure accounts, and to send service emails such as password resets and score alerts. If you click "Fix it for me", we send your request to the JNova team so they can quote. We do not sell your data or use it for third-party advertising.

Processors we use

MongoDB Atlas (database), Vercel (hosting), Google (sign-in, Gemini AI and PageSpeed Insights), PayPal (payments) and Mailjet (email). Each processes data only to provide its service to us.

Retention

We keep your account data while your account is open. Each site keeps its 20 most recent audits; older ones are deleted automatically. Sessions expire after 30 days and password-reset links after 1 hour. When you delete your account, your data is deleted immediately. Backups roll over within 30 days.

Your rights

You can download all your data (Settings → Your data → Download my data) and delete your account at any time (Settings → Delete account). You can also ask us to correct your data, or object to how we process it, by emailing jnovaitsolutions@gmail.com. You may complain to the National Privacy Commission (Philippines) or your local data protection authority.

Cookies

We use only essential cookies: a session cookie that keeps you signed in, and a short-lived cookie that secures Google sign-in. There are no advertising or tracking cookies.

Changes

If we make material changes we will email account holders before they take effect.

Contact

JNova IT Solutions · jnovaitsolutions@gmail.com