Privacy notice

This notice covers openbarista.io, the OpenBarista website. It explains what we collect when you visit, join the waitlist or apply to be a Founding Roaster, what we do with it, and what you can ask of us. The OpenBarista app has its own notice.

Who we are

OpenBarista is run by Tim O’Brien in Tampa Bay, Florida, USA (“we”, “us”). We decide why and how your information is used. You can reach us at info@openbarista.io.

What we collect

When you join the waitlist: your email address, the language you were reading in, and whether you ticked the box to receive launch news.

When you apply to be a Founding Roaster: your email address, your name, your roastery’s name, and — if you give them — its website and city.

With either form, we also record:

• whether you agreed to marketing email, the exact wording you agreed to, and when;
• where you came from, if you arrived by one of our links (for example the code on our festival flyer) — campaign codes only, nothing that identifies you;
• a one-way, salted fingerprint of your IP address (a “hash”). We never store the address itself; the fingerprint lets us limit abuse of the forms;
• the result of an automated check that you are a person, provided by Cloudflare Turnstile.

When you browse: privacy-friendly analytics (PostHog in cookieless mode) record which pages and buttons are used, without cookies and without identifying you. Our host (Vercel) keeps standard server logs, including IP addresses, for a short time to run and secure the site.

We don’t ask for, and please don’t send us, sensitive information such as health or financial details.

Why we use it, and on what basis

| Purpose | What we use | Legal basis (EU/UK) | |---|---|---| | Replying to your Founding Roaster application and setting up your roastery | Application details, email | Steps you asked us to take before an agreement; our legitimate interest in answering you | | Telling you when OpenBarista opens to you | Email | Our legitimate interest in answering a waitlist request you made | | Launch news and offers | Email | Your consent (the unticked box). You can withdraw it at any time | | Keeping the forms free of spam and abuse | IP fingerprint, Turnstile result, rate-limit counters | Our legitimate interest in keeping the service safe | | Understanding which parts of the site work | Cookieless analytics | Our legitimate interest in improving the site |

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Who processes it for us

We use these service providers. Each processes data only on our instructions:

• Supabase — our database, where form submissions are stored;
• Vercel — hosts the website;
• Cloudflare — the Turnstile check that you’re a person;
• PostHog — cookieless analytics;
• Resend — sends our emails.

Some of these providers process data in the United States. Where EU or UK data leaves those regions, we rely on the provider’s standard contractual clauses or equivalent safeguards.

How long we keep it

• Waitlist sign-ups: until OpenBarista opens to you, then for up to 24 months after our last contact, unless you ask us to delete them sooner. (Proposed — to be confirmed.)
• Founding Roaster applications: for as long as we’re talking with you, and for up to 24 months after our last contact if nothing comes of it.
• Rate-limit counters: about two days.
• Marketing consent records: for as long as we email you, and as long as needed afterwards to show we had your consent.

Your rights

Depending on where you live (including under the GDPR, the UK GDPR and California law), you can ask us to:

• tell you what we hold about you and give you a copy;
• correct it;
• delete it;
• stop using it for marketing, or object to other uses;
• move it to another service.

Every marketing email has an unsubscribe link, or write to info@openbarista.io. We’ll answer within 30 days and won’t treat you differently for asking. If you’re in the EU or UK, you can also complain to your data protection authority.

Children

openbarista.io is not meant for children under 16, and we don’t knowingly collect their information.

Changes

If we change this notice, we’ll update the date at the top, and tell you by email if the change matters to how we use your information.