Privacy policy

112 Coffee is operated by OFFICECAFFE SRL, CUI RO30940491, trade register no. J2012001120261, registered office Str. Pandurilor 94/3, Târgu Mureș, județul Mureș, Romania. We are the controller of your personal data.

For anything about your data write to istvan.zsigmond@112coffee.com. For help with the app: istvan.zsigmond@112coffee.com.

• We use your data to run your account, the simulator and the community, to take payments and to keep the service safe.
• We do not sell your data. Advertising cookies and pixels load only if you accept them.
• Other members see your display name, the country you choose to show and your public shots, never your email address.
• You can download all your data and delete your account yourself in My account.

Other members see your display name, your country and city unless you hide them, your public extractions with their photos and comments, and the coffees you added. You choose whether new extractions are public or private by default, and you can change it per shot. Your email address is never shown to other members, roasters or cafés.

Every public extraction also has a share link (/s/…) that anyone with the link can open without an account. It shows the coffee, how the shot tasted, its date and your country (unless you hide it); the dose, yield and time only where the coffee's recipe is open to the viewer; never your name, city, comment, equipment or photos. Making the extraction private or deleting it closes the link.

Private extractions are never shown to anyone else and are not counted in roaster statistics. Roasters see statistics about their coffees only as totals of public shots, and only for groups of at least 5 members. If you are in a café team, the café's team sees the shots you log for that café.

Some recommended products are sponsored placements paid for by a brand or shop, always labelled "Sponsored". Some links are affiliate links: if you buy after clicking, the seller may pay us a commission. Sponsors receive only totals per product, placement and month, never your name, email or account.

When you click a link you leave our app, and the seller's own privacy policy applies to what they collect.

Paid plans are bought on a checkout page of Stripe (Stripe Payments Europe, Ltd., Ireland). You type your card or other payment details there, not in our app; we never see or store your full card number. Stripe tells us the result: plan, amount, currency, status, renewal date and your Stripe customer number. Stripe also works out the VAT from your country and checks payments for fraud; for that it acts as a separate controller under its own privacy policy.

We issue Romanian fiscal invoices with SmartBill (Intelligent IT SRL, Romania) and, as the law requires, report them to the Romanian tax authority ANAF through the RO e-Factura system. An invoice contains your name, billing address and email, and a business's VAT number.

These providers process data on our behalf under a data processing agreement, only for the purposes above:

• Vercel (Vercel Inc., USA): runs the website and the app; our server functions run in Stockholm. Vercel Web Analytics counts visits without cookies.
• Supabase (Supabase Inc., USA): database, sign-in and storage of photos and of coffee and product pictures, hosted in the EU (Stockholm). When a picture is added by link, our server downloads it once and keeps a copy there, so your browser never loads pictures from a roaster's or shop's website.
• Anthropic (Anthropic PBC, USA): when you add a coffee by link, the text of that roaster page is sent to its AI model (Claude) to fill the form. No personal data of yours is sent.
• Stripe and SmartBill: payments and invoices (see above).
• Email: our email delivery provider (we name it here before we start sending emails) sends account emails (confirmation, password reset) and service emails such as receipts.
• Cloudflare Turnstile (Cloudflare Inc., USA): checks that the sign-up, sign-in and feedback forms are sent by a person, using technical data from your browser.
• Sentry (Functional Software Inc., USA, data stored in the EU): records errors in the app so we can fix them. It is set up not to store IP addresses or other personal details we do not need.
• Cloudflare R2 (Cloudflare Inc., USA; storage in the EU): keeps our encrypted nightly backups of the database and photos, for disaster recovery only.
• Brevo (Sendinblue SAS, France): sends the newsletter, only if you subscribed. It receives your email address, language and country, and removes you when you unsubscribe or delete your account.

These providers receive data as separate controllers:

• Google and Apple, only if you choose to sign in with them. Google shares your name and email; Apple shares your email (or a private relay address) and, if you allow it, your name.
• Meta (Meta Platforms Ireland Ltd.) and Google (Google Ireland Ltd.), only after you accept advertising or analytics cookies: their pixels, and our server's matching sign-up and purchase events. For collecting and sending that data we and Meta or Google may be joint controllers.
• OpenStreetMap (OpenStreetMap Foundation, UK): maps on Explore and café pages load map images from OpenStreetMap, and "Near me" looks up your city there; your browser connects to them directly and they see your IP address.
• ANAF, the Romanian tax authority, receives invoices by law.

Our database is in the EU. Some providers above are based in the United States or the United Kingdom, or may access data from there. Transfers to the UK rely on the European Commission's adequacy decision; transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the Commission's Standard Contractual Clauses with extra safeguards. You can ask us for a copy of these safeguards.

• Account data, extractions, photos, coffees and bookmarks: while your account exists. When you delete your account they are deleted at once (or, if you choose, your extractions are kept without any link to you: no name, no country, no photos).
• Sign-ups that are never confirmed: deleted after 7 days.
• Records of terms acceptance, age confirmation, newsletter choices and checkout confirmations: while your account exists and 3 years after it is closed, to answer legal claims.
• Invoices and accounting records: 10 years, as Romanian accounting law requires (they are kept with SmartBill and Stripe even after you delete your account).
• Reports, feedback and roaster or café claims: 2 years, counted from the decision (or the appeal decision) where there was one.
• Account suspensions: 2 years after they end or are lifted.
• Team invitations to a roastery or café: 90 days after they were sent.
• Records of roaster pages read for you and of pictures copied for you (the link and when): 30 days.
• Staff action log (who changed what, with the reason): 5 years.
• Records of your cookie choices: 3 years. Browser ids kept for server events: until you withdraw consent or delete your account, and at most 180 days after your last visit.
• How you found us (sign-up source): while your account exists.
• One-way keys used to count QR code scans and visitors once: 2 hours.
• Encrypted backups: 30 days; data deleted in the app disappears from the backups within 30 days.
• Technical logs at our hosting providers: a few days to a few weeks, depending on the provider.

We use only what is strictly necessary unless you accept optional cookies in the cookie banner. You can change your choice at any time from the link in the footer.

Vercel Web Analytics and Sentry set no cookies.

You have the right to access your data, correct it, delete it, restrict its use, take it with you (data portability), object to processing based on legitimate interest, and withdraw consent at any time without affecting what happened before. Most of this you can do yourself in My account: edit your profile, hide your country, make extractions private, turn the newsletter off, download all your data as a file, and delete your account.

For anything else write to istvan.zsigmond@112coffee.com. We answer within one month (we may extend this by two months for complex requests and will tell you why). We may ask you to confirm that the request comes from you.

You can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), dataprotection.ro, or to the authority where you live or work.

You must be at least 16 years old to create an account. We do not knowingly collect data of younger children; if you think a child under 16 has an account, write to us and we will delete it.

Data travels encrypted (HTTPS) and is stored encrypted at rest with our providers. Database rules make sure each member can read only what they are allowed to; staff accounts use two-step sign-in; staff actions are logged. If a breach puts your rights at high risk, we will tell you without undue delay.

If we change this policy in a way that matters, we will tell you in the app or by email before the change applies and, where needed, ask for your consent again.