Privacy notice

Who handles your data

Coffee.Global determines how account and marketplace data are used. Hosting and account services are provided through Lovable Cloud and its service providers. Farms receiving sample requests independently handle the information shared with them; their later use of that information is outside this platform’s direct control.

What we collect and why

• Account: email, account identifier, authentication credentials handled by the account provider, profile information you supply, and account timestamps. These support registration, sign-in and account administration. Providing an email and password is necessary for email-based accounts, not for browsing.
• Public listings: farm name, country, region, description, growing information, certifications and lot specifications, prices and availability. These are published to operate the marketplace. Listing details may identify a sole trader. Avoid publishing personal contact details or confidential information.
• Sample requests: account identifier, selected lot, message, status and timestamp. The requester and the relevant farm owner can read these records. Share only information needed for sourcing; avoid sensitive personal data.
• Privacy requests: your account identifier, request type, message, status and timestamp, to process your data rights.
• Technical records: hosting and account providers may process IP addresses, request metadata and security logs to deliver and protect the service. Provider-specific retention and hosting locations remain to be verified.

Account and requested marketplace services are intended to rely on performance of a contract or steps you request before a contract (GDPR Article 6(1)(b)). Security and abuse prevention are intended to rely on legitimate interests (Article 6(1)(f)), subject to an operator assessment and your right to object. Handling data rights may be necessary for legal obligations (Article 6(1)(c)). The operator must validate these bases before a full launch. There is no marketing subscription in the current account flow.

Visibility and sharing

Farm profiles and lots, including prices and available quantities, are public and may be indexed or copied by search engines and visitors. Sample and privacy requests are not public. We do not provide application features to sell personal data or run advertising profiles. External sites linked from directories apply their own privacy notices when you visit them.

Cookies and browser storage

The application uses essential persistent browser storage for your sign-in session. Sign-out removes the local session; account deletion removes the account identity. Fonts are served locally rather than requested from Google. The application code does not install analytics or advertising cookies, so it does not request optional tracking consent. Hosting-level scripts and logs must be checked separately before launch. See the storage notice.

Retention and deletion

Your account and listings remain until you delete them. Sample requests remain until their requester removes them, their associated lot or farm is deleted, or the account is deleted. Privacy requests remain until account deletion unless an operator introduces and discloses a lawful retention schedule. An inactivity and resolved-request retention schedule has not yet been approved or automated.

Self-service deletion removes active application records before removing the account identity. Deleted records may remain in provider backups until those backups expire; Lovable Cloud documentation describes daily database snapshots retained for up to roughly 14 days. We have not verified this project’s backup inventory or provider log retention. If a backup is restored, the operator must reapply erasures before reopening access. Copies independently retained by recipients or search engines are not removed by account deletion.

Your rights

Depending on applicable law, you may request access, a portable copy, correction, erasure, restricted processing or object to processing; you may withdraw any consent where processing relies on it. In your dashboard, download your account records, submit additional rights requests, withdraw sent sample requests or delete your account. You can edit farm details directly. Downloads exclude other members’ messages, passwords, access tokens, provider logs and backups; request additional personal data through the rights form.

GDPR requests ordinarily require a response within one month; a permitted extension of up to two further months requires timely explanation. Additional identity verification must be proportionate. Submitted requests are saved for manual operator review, not automatically resolved. A contact channel for people without an account remains to be supplied. You may complain to the supervisory authority in your EU/EEA country of residence, work or the alleged infringement.

International processing and safeguards

The operator is based in Doha, Qatar. EU/EEA data may be processed outside the EU/EEA. The specific hosting region, subprocessors, processing agreements and applicable transfer safeguards, such as adequacy decisions or standard contractual clauses and transfer assessments, have not yet been verified. Do not treat this notice as confirmation that these arrangements are complete.

Security and changes

Account authentication and database access controls limit private records to their authorized users. Erasure requires a recent sign-in and explicit confirmation. These measures reduce risk but cannot guarantee security. The operator must maintain an incident response process, assess notification duties (including the GDPR’s 72-hour supervisory-authority deadline where applicable), document processing, and update this notice when purposes or providers change.