1. Who is responsible
Good Cup is operated by Vector Labs B.V., registered in the Netherlands under KvK 99771438, Gustav Mahlerlaan 647, 1082MK Amsterdam, Netherlands. For privacy requests, contact support@goodcup.coffee.
Vector Labs B.V. is the controller. This notice covers the Good Cup website, installable web app and review version, including both visitors and professionals in our coffee directory.
2. Accounts, saved activity and reports
We process your email, account identifier, authentication records and optional communications preference when you request a sign-in link. We use them to provide your account (GDPR Article 6(1)(b), performance of our agreement) and protect it from misuse (Article 6(1)(f), legitimate interests). Browsing does not require an account; an email is necessary to create one. The sign-in form asks only for your email. Your name is optional: you can add it in Account and remove it there. The café levels you choose to see on the map and in City Guides are kept with your account to show them to you. We do not ask for your phone, address or payment details.
Saved cafés and beans, visit dates and linked places are stored under your account to provide your lists and journey. These lists are not public. Saving and recording visits are optional.
Rating a visit is optional too. After you record a visit you can rate your coffee there — stars, what you loved or what wasn’t right, what you had, a note — and share photos you took. They are stored privately with your account and that visit, and we use them to analyse the café, on the basis of legitimate interests (Article 6(1)(f)); we never show your name or account with them. Before a photo is uploaded your browser redraws it, which leaves out its location and camera details. Please avoid photos in which other people can be recognised. To tell what a photo shows — a menu, a bag of coffee, a machine, an award — an AI model of our provider Anthropic reads it, and what it finds about the café (for example, which coffees are on its menu) is added to our information about that café, without your name; a photo in which a person is the subject is not read further. You can change your rating or remove a photo on the café page the same day; taking back the visit removes its rating and photos, and they are deleted with your account. What was learned about the café from a photo stays, because it is about the café, not about you.
Showing your location on the map is optional. It starts only after you tap the location arrow and allow it in your browser, or once you have already allowed Good Cup there; you can withdraw the permission in your browser’s settings at any time. Your browser then gives the map your device’s location to show where you are, centre the map on the area around you and show how far cafés are. Your exact location stays in your browser: Good Cup does not store it or include it in analytics, and the map loads the area around you from Mapbox and our database, centred on a point rounded to about 100 m. If you have not shared your location, the map opens in your approximate city: Vercel, our host, reads it from your connection’s IP address, checked against your device’s time zone (a phone abroad can connect through its home country), on the basis of legitimate interests (Article 6(1)(f)). That city goes back only to your browser, and neither it nor the time zone is stored.
Reports and support messages may contain your text, account identifier, page address, browser/device details, language and time. Bug reports include a salted IP digest for abuse prevention. We use these records to investigate problems, reply and secure the service, on the basis of legitimate interests. Please avoid unnecessary sensitive information or passwords.
3. Optional analytics and communications
PostHog analytics is off until you choose “Accept all” or enable Analytics in “Cookie settings” and save your preferences. With your consent (Article 6(1)(a)), it receives browser/session identifiers, visited pages, referring addresses, device/browser details and events such as searches, saves and opened profiles. Events can include your account identifier when signed in. These identifiers are pseudonymous, not anonymous. Search text is shortened and email- and phone-shaped text is filtered; other identifying text can remain. With the same consent PostHog also receives time spent on pages, technical error reports and recordings of how pages are used (session replay): what was shown, where you tapped and scrolled, with everything you type hidden, your account name and email masked, and your distance to cafés and your location marker left out; sign-in pages are not recorded. Recordings are kept for up to 30 days.
Vercel Web Analytics and Speed Insights count every visit without cookies or browser storage: the page address (without query or fragment, except campaign tags), the referring site, country, device and browser type, and how fast the page loaded. A visitor is not recognised from one day to the next and no account identifier is sent. We use these aggregate counts to understand how Good Cup is used and how fast it is, on the basis of legitimate interests (Article 6(1)(f)). Sign-in pages are excluded.
Use “Cookie settings” beside the legal links in Account or at the top of this page to reject or withdraw analytics consent, without signing in. Withdrawal stops future collection and clears PostHog identifiers in this browser, but does not automatically erase earlier events. To request their erasure, contact support@goodcup.coffee. Your separate, optional preference for personalised emails and push messages can be withdrawn in Account or by contacting us. Sign-in and security messages are separate from marketing. Withdrawal does not affect the lawfulness of processing before withdrawal.
4. Public professional information
We collect professional information from public competition results, organisers, café and roaster websites, biographies, public professional social profiles and editorial sources. Records can include names, professional photographs, roles, workplaces, biographies, competition results, certifications, languages and professional contact/social links. Farmers, producers, sole traders and named owners can also be identifiable.
We use this information to describe the coffee industry, connect professionals to venues and explain expertise. Our intended lawful basis is our legitimate interest in an accurate professional directory (Article 6(1)(f)), balanced against the rights and reasonable expectations of the people concerned. Public availability does not remove your rights or amount to consent to Good Cup.
Some profile information is public and can be read by search engines; additional detail may be available to members. Automated extraction and matching help assemble records, and competition evidence can inform displayed expertise. Sources can be incomplete or wrong. You may request source information, correction, restriction, removal or an assessment of your objection without creating an account. Include the profile address when contacting us below. The claim and edit forms are not yet submission services.
This notice explains indirect collection under Article 14. It is not a claim that every person has already received individual notification or that an exception to notification applies.
5. Providers and other recipients
- Supabase: database, authentication and related storage for accounts, lists, visits, visit ratings and photos, reports and catalogue records.
- Vercel: website hosting and delivery, including network/device request information and operational logs, and cookieless aggregate visit and page-speed statistics (Web Analytics, Speed Insights).
- PostHog: optional analytics and session replay, sent to its EU collection endpoint after consent.
- Anthropic: an AI model reads the photos visitors share of a café, to describe what they show; the photo is not used to identify you.
- Mapbox: map delivery and service measurement. Loading a map sends network and map request information to Mapbox; see the Cookie Policy.
- Google Cloud: catalogue processing and storage. Search, source-retrieval and AI-assisted processing providers may receive public professional source material used to build the directory. Public personal information remains personal data.
- Email services deliver sign-in links and handle your messages. Authorised staff and providers may access information needed for support and security. Authorities or advisers may receive information where legally required or necessary for legal claims.
External links lead to independently operated services. We do not sell personal account information. Contact us for the providers and processing relevant to your information.
6. International processing
Our providers operate internationally, including outside the European Economic Area. An EU analytics endpoint does not establish that all support access or onward processing stays in the EEA. Where GDPR restricts a transfer, an adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses, are required. Ask support@goodcup.coffee for the locations and safeguards applicable to your data and a copy where available.
7. Retention
Account information and saved activity are held to operate your account until you remove items or request account closure. Signing out is not deletion. Reports and support records may remain where needed to resolve an issue, prevent misuse or establish, exercise or defend legal claims. Unlinking an account does not necessarily anonymise report text; ask us to include it in an erasure request.
Directory information is kept while relevant to professional coffee information, subject to correction, objection and erasure rights. Minimal records may be needed to respect a removal request and prevent re-import. Cookie lifetimes are in our Cookie Policy. They are not the retention periods of events already sent to a provider. Analytics, provider logs and backups have separate settings and deletion cycles. Ask us for the period applicable to a record; any exception requiring continued retention must have an identified reason and duration or determining criteria.
8. Your rights
Email support@goodcup.coffee to request access and a copy, correction, erasure, restriction, or — where applicable — a portable machine-readable copy. You may object to legitimate-interest processing, including professional profiles, and withdraw consent. Direct marketing objections will be respected. No Good Cup account is required to request your rights.
Include your account email or the relevant profile address and what you want us to do. We may request proportionate information to resolve reasonable doubts about identity; do not send an identity document unless we explain why it is necessary.
We respond without undue delay and normally within one month. If complexity or the number of requests requires up to two additional months, we explain this within the first month. Requests are normally free. Where a legal exception applies, we explain any refusal and how to challenge it. If you are unhappy with how we handled your request, please tell us first at support@goodcup.coffee. You also have the right to complain to a data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.
9. Security and changes
We use encrypted connections and access controls, including owner-scoped access to account records. No service can guarantee complete security. Contact us promptly about a suspected exposure. Good Cup is a general coffee information service, not a service designed for children; contact us about any inappropriate collection of a child’s information. We do not use account activity for solely automated decisions with legal or similarly significant effects about you.
Changes are identified by the version and date above. We explain material changes through an appropriate notice. A changed policy does not itself supply consent for a new purpose.