Privacy Policy
Last updated: 4 October 2026
1. Who we are
EnterpriseBrew is operated by Simpux Bilişim Ltd. Şti., Esentepe Mah. Talatpaşa Cad. No:5/1, 34394 Şişli / İstanbul, Türkiye ("Simpux", "we"). For the personal data described in this policy, Simpux is the controller. Privacy contact: kvkk@simpux.com
2. What this policy covers
This policy covers the enterprisebrew.com website, demo and contact requests, sign-up, and the accounts of the people who administer an EnterpriseBrew workspace. It does not cover the data an organisation using EnterpriseBrew processes about its own developers and Macs (device names, installed packages, install history and similar). For that data your organisation is the controller and we process it on its behalf under our Data Processing Agreement. If you are a developer at such an organisation, your employer's privacy notice applies and your requests should go to them; we help them answer.
3. What we process, why, and on what legal basis
• Visiting the website: IP address, browser and device information, the pages requested. Used to deliver the site and protect it from abuse. Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)). • Analytics, only if you accept: Google Analytics records pages visited, session length, referrer and approximate location using cookies. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time from "Cookie settings" at the bottom of every page. • Demo and contact requests: name, company, work email, your message, and the version of this policy you were shown. Used to answer you and prepare a demo. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in replying to business enquiries (Art. 6(1)(f)). • Bot protection: when you start filling in the contact or sign-up form, Google reCAPTCHA loads and sends your IP address, browser data and interaction signals to Google to tell people from bots. Legal basis: our legitimate interest in keeping the forms free of abuse (Art. 6(1)(f)). • Your account: name, username, email address, password hash, MFA and passkey data, workspace membership and role, sign-in times and IP addresses, and the record that you accepted our Terms (version, time, IP address). Used to provide the service, secure it, and prove the agreement. Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in security and in being able to prove what was agreed (Art. 6(1)(f)). • Admin activity in the portal: a tamper-evident log of administrative actions. Legal basis: the contract and our legitimate interest in security (Art. 6(1)(b), (f)). • Billing: paid plans are sold through Paddle, which acts as merchant of record and collects payment details as an independent controller under its own privacy notice. We receive the customer and subscription identifiers, the plan and the invoice status. Legal basis: the contract and our legal obligations under tax and commercial law (Art. 6(1)(b), (c)). • Service and security emails: the email address and the message. Legal basis: the contract (Art. 6(1)(b)). We do not send marketing emails, do not sell personal data and do not use it for advertising.
4. Where your data is stored
When a workspace is created its data region is chosen, and its data stays there: • EU region: servers and database at Hetzner Online GmbH in Germany and Finland, encrypted disaster-recovery copies at Scaleway SAS in the Netherlands, transactional email through Scaleway in France. • Türkiye region: servers, database and backups in a data centre in Türkiye. The website and our DNS run on Cloudflare's global network.
5. Who receives your data
Only the service providers we need to run EnterpriseBrew, each bound by a contract to process the data on our instructions. The current list, with what each one does and where, is on our Subprocessors page. Paddle receives billing data as described above. We disclose data to public authorities only when the law requires it.
6. International transfers
Simpux is established in Türkiye. When you give us data directly (on the website, in a form or in your account), you provide it to a company outside the EEA; the GDPR still applies to that processing (Art. 3(2)). Our team in Türkiye operates and supports the service, so EU-region data can be accessed from Türkiye, which has no EU adequacy decision. For our customers' workspace data this transfer is covered by the EU Standard Contractual Clauses (and the UK Addendum) incorporated in our Data Processing Agreement. Providers based in the United States (Cloudflare, Google, Resend) receive data under the EU-U.S. Data Privacy Framework where they are certified, and otherwise under Standard Contractual Clauses. You can ask us for a copy of the safeguards.
7. How long we keep it
• Demo and contact requests: up to 24 months after our last exchange, unless they lead to a contract. • Account data: while the account exists. When a workspace is deleted its data is purged after a 30-day grace period; database backups expire within a further 30 days. • Audit and device data in a workspace: for the retention period the workspace sets. • Records of accepting our Terms, and billing records: for the duration of the contract and then as long as commercial and tax law requires (up to 10 years). • Server logs: application and access logs 30 days, security logs 1 year. • Google Analytics: no longer than 14 months.
8. Your rights
Under the GDPR (and the UK GDPR) you can ask for access to your data, its correction or erasure, restriction of processing, and a copy in a portable format. You can object at any time to processing based on our legitimate interest, and withdraw consent at any time without affecting earlier processing. You can also complain to the data protection authority where you live or work (in the UK, the ICO). If you are in Türkiye, your rights under KVKK are set out in our KVKK Aydınlatma Metni. Write to kvkk@simpux.com. We answer within one month. If the request concerns data we process for an organisation, we pass it to them and help them answer.
9. Cookies
What we store in your browser, and how to change your choice, is described in our Cookie Policy.
10. Automated decisions
We make no decisions with legal or similarly significant effect solely by automated means. reCAPTCHA may stop a form from being sent when it scores a visit as automated; in that case write to us at contact@simpux.com.
11. Do you have to give us your data?
The fields marked as required in a form are needed to answer you; the account fields are needed to provide the service. Analytics is optional.
12. California and other US states
We do not sell or share personal information for cross-context behavioural advertising. See Your Privacy Choices.
13. Changes
When this policy changes we update the date above. We tell everyone with an EnterpriseBrew portal account about material changes by email before they take effect.
14. Contact
Simpux Bilişim Ltd. Şti. Esentepe Mah. Talatpaşa Cad. No:5/1, 34394 Şişli / İstanbul, Türkiye kvkk@simpux.com