Legal

Privacy policy

Last updated: August 2026  ·  AI-brouwerij, Amsterdam

Sherpa is a service of AI-brouwerij, registered at Nieuwendammerkade 28-C13, 1022 AB Amsterdam, the Netherlands. This privacy policy explains which personal data we process, why we process it, and what your rights are as a user. We comply with the General Data Protection Regulation (GDPR).

1. Who is responsible?

AI-brouwerij is the data controller for the personal data processed through Sherpa.

Contact details:
AI-brouwerij
Nieuwendammerkade 28-C13, 1022 AB Amsterdam, the Netherlands
[email protected]

2. What data do we collect?

Account data

When you register we ask for your email address and a password. Your name is optional.

Payment data

Payments are processed through Stripe. We do not store full payment card numbers. Stripe processes payment data under its own responsibility and is PCI DSS certified.

Uploaded files

Images you upload for processing are stored temporarily in order to generate the AI render. Files are deleted automatically after 30 days. We never use your files to train third-party AI models.

Usage data

We log technical data such as the number of renders, timestamps and error messages. We do this to improve the service and to resolve technical problems.

3. Why do we process your data?

  • Performance of the contract — to deliver the service you signed up for.
  • Legitimate interests — to prevent abuse, improve the service and provide technical support.
  • Legal obligation — such as retaining invoice records for the tax authorities (7 years).

4. Who do we share your data with?

We only share personal data with processors that are necessary to deliver the service:

  • Supabase — authentication and database (EU hosting)
  • Stripe — payment processing
  • kie.ai — AI image processing (renders)

We never sell personal data to third parties and we do not share data for other parties' marketing purposes.

5. How long do we keep your data?

  • Account data: for as long as your account is active, or until you request deletion.
  • Uploaded images: no longer than 30 days after upload.
  • Generated renders: available for as long as your account is active.
  • Invoice records: 7 years (statutory retention period).

6. Your rights

Under the GDPR you have the following rights:

  • Access — you can request which data we hold about you.
  • Rectification — you can have inaccurate data corrected.
  • Erasure — you can request deletion of your data.
  • Restriction — you can have the processing restricted.
  • Portability — you can request your data in a commonly used format.
  • Objection — you can object to processing based on legitimate interests.

To exercise these rights, email [email protected]. We respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own country.

7. Security

We take appropriate technical and organisational measures to protect your data, including encryption of data in transit (HTTPS/TLS) and at rest, access controls and logging of security events.

8. Cookies

Necessary cookies. These are required for the service to work: staying signed in, remembering your language preference and storing your cookie choice. No consent is required for these and we cannot switch them off.

Analytics and advertising cookies. Only with your consent do we place cookies from Google Analytics 4 (Google Ireland Limited). These show us how many people visit the site, which channel they arrive through, which pages they read and whether our ads produce results. If you do not give consent, these cookies are not placed.

What never ends up in there: your uploads, your renders and the content of your projects. Those stay within Sherpa and are not sent to Google.

Google may process data outside the European Economic Area, on the basis of the European Commission's standard contractual clauses. Analytics data is retained for a maximum of 14 months. See Google's privacy policy for details.

You can change your choice at any time: .

9. Changes

We may update this privacy policy. In the event of material changes we will notify you by email or through a message in the application. The date at the top of this document indicates when it was last updated.

10. Contact

For questions about this privacy policy or your rights: [email protected]