1. Who is responsible
Good Cup is operated by Vector Labs B.V., registered in the Netherlands under KvK 99771438, Gustav Mahlerlaan 647, 1082MK Amsterdam, Netherlands. For Good Cup privacy requests, contact hello@farandwide.io and mention Good Cup.
Vector Labs B.V. is the controller. This notice covers the Good Cup website, installable web app and review version, including both visitors and professionals in our coffee directory.
2. Accounts, saved activity and reports
We process your email, account identifier, authentication records and optional communications preference when you request a sign-in link. We use them to provide your account (GDPR Article 6(1)(b), performance of our agreement) and protect it from misuse (Article 6(1)(f), legitimate interests). Browsing does not require an account; an email is necessary to create one.
Saved cafés and beans, visit dates and linked places are stored under your account to provide your lists and journey. These lists are not public. Saving and recording visits are optional.
Reports and support messages may contain your text, account identifier, page address, browser/device details, language and time. Bug reports include a salted IP digest for abuse prevention. We use these records to investigate problems, reply and secure the service, on the basis of legitimate interests. Please avoid unnecessary sensitive information or passwords.
3. Optional analytics and communications
PostHog analytics is off until you choose “Accept all” or enable Analytics in “Cookie settings” and save your preferences. With your consent (Article 6(1)(a)), it receives browser/session identifiers, visited pages, referring addresses, device/browser details and events such as searches, saves and opened profiles. Events can include your account identifier when signed in. These identifiers are pseudonymous, not anonymous. Search text is shortened and email- and phone-shaped text is filtered; other identifying text can remain. Session replay is disabled.
Use “Cookie settings” on any page to reject or withdraw analytics consent. Withdrawal stops future collection and clears PostHog identifiers in this browser, but does not automatically erase earlier events. To request their erasure, contact hello@farandwide.io. Your separate, optional preference for personalised emails and push messages can be withdrawn in Account or by contacting us. Sign-in and security messages are separate from marketing. Withdrawal does not affect the lawfulness of processing before withdrawal.
4. Public professional information
We collect professional information from public competition results, organisers, café and roaster websites, biographies, public professional social profiles and editorial sources. Records can include names, professional photographs, roles, workplaces, biographies, competition results, certifications, languages and professional contact/social links. Farmers, producers, sole traders and named owners can also be identifiable.
We use this information to describe the coffee industry, connect professionals to venues and explain expertise. Our intended lawful basis is our legitimate interest in an accurate professional directory (Article 6(1)(f)), balanced against the rights and reasonable expectations of the people concerned. Public availability does not remove your rights or amount to consent to Good Cup.
Some profile information is public and can be read by search engines; additional detail may be available to members. Automated extraction and matching help assemble records, and competition evidence can inform displayed expertise. Sources can be incomplete or wrong. You may request source information, correction, restriction, removal or an assessment of your objection without creating an account. Include the profile address when contacting us below. The claim and edit forms are not yet submission services.
This notice explains indirect collection under Article 14. It is not a claim that every person has already received individual notification or that an exception to notification applies.
5. Providers and other recipients
- Supabase: database, authentication and related storage for accounts, lists, visits, reports and catalogue records.
- Vercel: website hosting and delivery, including network/device request information and operational logs.
- PostHog: optional analytics, sent to its EU collection endpoint after consent.
- Mapbox: map delivery and service measurement. Loading a map sends network and map request information to Mapbox; see the Cookie Policy.
- Google Cloud: catalogue processing and storage. Search, source-retrieval and AI-assisted processing providers may receive public professional source material used to build the directory. Public personal information remains personal data.
- Email services deliver sign-in links and handle your messages. Authorised staff and providers may access information needed for support and security. Authorities or advisers may receive information where legally required or necessary for legal claims.
External links lead to independently operated services. We do not sell personal account information. Contact us for the providers and processing relevant to your information.
6. International processing
Our providers operate internationally, including outside the European Economic Area. An EU analytics endpoint does not establish that all support access or onward processing stays in the EEA. Where GDPR restricts a transfer, an adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses, are required. Ask hello@farandwide.io for the locations and safeguards applicable to your data and a copy where available.
7. Retention
Account information and saved activity are held to operate your account until you remove items or request account closure. Signing out is not deletion. Reports and support records may remain where needed to resolve an issue, prevent misuse or establish, exercise or defend legal claims. Unlinking an account does not necessarily anonymise report text; ask us to include it in an erasure request.
Directory information is kept while relevant to professional coffee information, subject to correction, objection and erasure rights. Minimal records may be needed to respect a removal request and prevent re-import. Cookie lifetimes are in our Cookie Policy. They are not the retention periods of events already sent to a provider. Analytics, provider logs and backups have separate settings and deletion cycles. Ask us for the period applicable to a record; any exception requiring continued retention must have an identified reason and duration or determining criteria.
8. Your rights
Email hello@farandwide.io with “Good Cup” in the subject to request access and a copy, correction, erasure, restriction, or — where applicable — a portable machine-readable copy. You may object to legitimate-interest processing, including professional profiles, and withdraw consent. Direct marketing objections will be respected. No Good Cup account is required to request your rights.
Include your account email or the relevant profile address and what you want us to do. We may request proportionate information to resolve reasonable doubts about identity; do not send an identity document unless we explain why it is necessary.
We respond without undue delay and normally within one month. If complexity or the number of requests requires up to two additional months, we explain this within the first month. Requests are normally free. Where a legal exception applies, we explain any refusal and how to challenge it. You may complain to the Dutch Autoriteit Persoonsgegevens or the authority where you live or work or where an alleged infringement occurred.
9. Security and changes
We use encrypted connections and access controls, including owner-scoped access to account records. No service can guarantee complete security. Contact us promptly about a suspected exposure. Good Cup is a general coffee information service, not a service designed for children; contact us about any inappropriate collection of a child’s information. We do not use account activity for solely automated decisions with legal or similarly significant effects about you.
Changes are identified by the version and date above. We explain material changes through an appropriate notice. A changed policy does not itself supply consent for a new purpose.