Privacy Policy
This Policy describes how shelf.coffee handles your personal data under Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and the EU General Data Protection Regulation (GDPR), where applicable.
1. Controller
The controller of your data is shelf.coffee ("Controller"), a service operated from Brazil. Contact: privacy@shelf.coffee.
2. Data we collect
- Account: email, name, and profile picture provided by the OAuth provider (Google).
- Usage: brew history, coffee catalog, equipment, and notes you register.
- Payment: card and billing data are handled directly by Paddle; we never store card data. We receive only opaque identifiers (paddle_customer_id, paddle_subscription_id) and transaction metadata (date, amount, status). We do not collect or store physical shipping addresses, as the Service is strictly a digital software platform with no physical fulfillment.
- Telemetry: pages visited, usage events (brews started, methods chosen) via Google Analytics 4.
- Technical: IP address and User-Agent recorded in Cloudflare and Supabase logs for security and diagnostics.
3. Why we collect (legal basis)
- Contract performance: authentication, brew storage, subscription processing.
- Legitimate interest: security, fraud prevention, product improvement via aggregated telemetry.
- Legal compliance: tax record retention via Paddle.
- Consent: non-essential cookies (analytics), where applicable.
4. Sharing
We share data only with processors essential to operating the Service:
- Supabase (processor) — database and authentication, with servers located in the United States.
- Cloudflare (processor) — hosting and CDN.
- Paddle (independent controller for payment) — processes payments as Merchant of Record and is responsible for the financial transaction of the digital subscription. Access to the SaaS features is granted immediately upon Paddle's confirmation. Policy: paddle.com/legal/privacy.
- Google — OAuth authentication and Google Analytics 4 (pseudonymized telemetry).
We do not sell your data nor share it for third-party marketing.
5. Cookies and similar technologies
- Session: Supabase cookies keep you logged in across visits.
- Preferences: theme (light/dark), language, units stored in
localStorage. - Analytics: Google Analytics 4 with IP anonymization.
6. Retention
- Software usage data (recipes, brews, and account preferences): while the account is active. Upon deletion we remove within 30 days (backup logs kept up to additional 30 days before final purge).
- Payment records: kept by Paddle per applicable tax requirements (5 years in Brazil).
- Technical logs: 90 days.
- Webhook events: 1 year (internal audit).
7. Your rights
Under LGPD Art. 18 (and GDPR equivalents), you may request:
- Confirmation of processing
- Access to your data (via
/me→ Export JSON) - Correction of incomplete or outdated data
- Anonymization, blocking, or deletion of unnecessary data
- Data portability (Export JSON covers this)
- Deletion of consent-based data
- Information about sharing
- Withdrawal of consent
To exercise any right: privacy@shelf.coffee. We respond within 15 business days.
8. Security
We adopt reasonable technical controls: enforced HTTPS, password hashing (delegated to OAuth), Row Level Security in the database, server-side secrets (API keys) isolated from the client, HMAC verification with replay protection on payment webhooks. No system is 100% secure — in case of an incident involving personal data, we will notify the relevant authority (ANPD in Brazil) and affected data subjects per LGPD requirements.
9. International transfer
Some processors (Supabase, Cloudflare, Paddle, Google) process data in servers outside Brazil. We ensure these processors offer adequate protection levels via standard contractual clauses and recognized certifications.
10. Children
The Service is not directed to children under 13. We do not knowingly collect data from children. Legal guardians who identify a child has provided data should contact us for removal.
11. Changes
This Policy may be updated. We will notify material changes via the Service interface. The date at the top indicates the current version.
12. Data Protection Officer (DPO)
The channel for data protection matters is privacy@shelf.coffee. Contact: privacy@shelf.coffee.
