Privacy Policy

Notice at collection

This is what we collect at each step, why, and the minimum time we keep it. The sections below give the full detail.

• When you apply: your business details and contact email, and what you tell us about your coffee program (for buyers: business type, city and state, weekly volume, roast preferences, current roasters, and why you’re joining). We use them to review your application and, for buyers, to share your profile with the roasters you ask to buy from.
• When you set up your account: roasters give their business’s legal name, business address and an email for legal notices; buyers give their shipping address, an optional phone number for the carrier, and how they use the coffee they buy (for sales tax). We use them to run your account, fulfill orders, and meet our legal and tax obligations.
• When you accept our terms (at setup, at checkout, or after an update): a record of your acceptance. We keep it as evidence of the agreement.
• When a buyer signs a resale certificate: the certificate details and an electronic signature. We use them to apply the right sales tax and to give each roaster the buyer orders from a copy.

Minimum retention: acceptance records for as long as you have an account and at least 10 years after; resale certificates for at least 4 years after the later of the last order that relied on them or their replacement; order records for at least 7 years. See “Data retention” below.

Information we collect

Information you provide

• Roasters: business name, contact email, location, website, program details, and storefront branding. Also your business’s legal name, business address, an email for legal notices, an optional public contact email, the name and title of the person who accepts our terms for the business, and a history of changes to these details. Buyers and visitors see your legal name with your city and state, and your street address only if you choose to show it. Your full business address prints on the resale certificate copies buyers issue to you.
• Buyers: business name and type, contact email, program style, shipping address and phone number, weekly volume, current roasters, why you’re joining, equipment details (including whether you weigh espresso shots), and roast preferences. Also how you use the coffee you buy (resale, your own use, or a tax-exempt organization); if you resell, your state sales-tax permit or registration number for your delivery state, including before you can sign a certificate for that state; and, if you sign a resale certificate, its details: your legal business name and address, your state sales-tax registration numbers, the signer’s name and title, the signature, and the IP address and browser recorded at signing.
• Acceptance records: when you accept our terms, the date and time, your IP address and browser user agent, the version of each document, and the business you accepted for.
• Messages you send to roasters or buyers through the platform, including attachments.
• Application and onboarding responses.

Sanctions screening

Roasterra checks business names against the U.S. government’s (OFAC) sanctions list, and keeps a record of each check.

Information from connected Shopify stores

When a roaster connects their Shopify store, we access — using the permissions the merchant grants — their store domain, products, and inventory (to build the catalog), and order and fulfillment data for orders that Roasterra facilitates. Draft orders that Roasterra creates in the roaster’s store include the buyer’s business name, shipping address, and phone number (not their email) so the roaster can fulfill them. We only request the data our features need.

Payments

Payments are processed by Stripe on the roaster’s own Stripe account. At checkout we send the buyer’s email to that account, and card and bank details are entered with and processed by Stripe there. We do not collect or store full payment-card or bank-account numbers; Stripe handles them under its own PCI-compliant terms. We retain records of transactions (amounts, dates, payout and commission details) to operate the marketplace.

Technical information

Standard log and device information (such as IP address and browser type) and basic usage data, used to keep the service secure and reliable.

How we use information

• Operate the marketplace — accounts, catalogs, discovery, orders, and messaging.
• Process orders and payments, calculate commission, and route payouts to roasters.
• Sync catalog, inventory, order status, and tracking with connected Shopify stores.
• Send transactional email (applications, approvals, orders, shipping, messages).
• Provide support, prevent fraud and abuse, and comply with legal obligations.

How we share information

• Between roasters and buyers as needed to establish a wholesale relationship and fulfill orders. A buyer’s full profile goes to each roaster the buyer asks to buy from, and a buyer’s shipping address is shared with a roaster they order from.
• Resale certificates are shared only with the roasters a buyer has ordered from, each after the buyer’s first order with them, and with Roasterra as the marketplace facilitator.
• Service providers that operate the platform on our behalf: Shopify (merchant integration), Stripe (payments and payouts), Clerk (authentication), Supabase and Vercel (database and hosting), Resend (email), Cloudflare (Turnstile bot protection on public forms), and the U.S. Census Bureau geocoder (address standardization). Each processes data only to provide its service.
• Legal and safety reasons, or in connection with a business transfer, where permitted or required by law.

We do not sell or share your personal information, including for cross-context behavioral advertising, and we have not done so in the preceding 12 months. Because we do not sell or share, no “Do Not Sell or Share My Personal Information” link is required.

Shopify customer data

For connected roasters, we handle protected customer data from Shopify under Shopify’s requirements: we access only what our features require, encrypt it in transit and at rest, and retain it only as long as needed to provide the service. We honor Shopify’s privacy webhooks — customer data requests, customer redaction, and shop redaction — and when a store uninstalls the app we sever the connection and delete the stored access token.

Data retention

We keep information for as long as your account is active or as needed to provide the service, then retain what we must for legal, accounting, and fraud-prevention purposes. When you close your account, we delete or de-identify personal information that we are not required to keep.

We keep these records for at least the periods below, including after an account closes:

• Acceptance records: for as long as you have an account and at least 10 years after.
• Resale certificates: at least 4 years after the later of the last order that relied on them or their replacement.
• Order records: at least 7 years.

Security

We protect data with encryption in transit (TLS) and at rest, encrypted storage of third-party access tokens, scoped access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To make a request, email us at privacy@roasterra.com. We will respond within the time required by applicable law.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the rights below. We will not discriminate against you for exercising them.

• Know and access: request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of parties we share it with.
• Delete: request deletion of your personal information, subject to legal exceptions (for example, records we must keep for tax, accounting, or fraud prevention).
• Correct: request correction of inaccurate personal information.
• Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of.
• Limit sensitive information: we do not use sensitive personal information for purposes that would require an option to limit it.
• Non-discrimination: we will not deny service, charge a different price, or provide a different quality of service because you exercised a right.

Categories we collect. Under the CCPA, the information described above falls into these statutory categories: identifiers (name, email, address, IP address), commercial information (orders and transactions), internet or network activity (log and usage data), approximate geolocation (from IP address or a provided address), and professional or business information (including resale-certificate details and acceptance records). We collect it from you directly, from a roaster’s connected Shopify store, and automatically from your use of the service, and we do not collect it in order to sell or share it.

Making a request. Email privacy@roasterra.com. To protect your account we verify requests by confirming control of the email on file and may ask for additional information to match you to your records. You may use an authorized agent with proof of authorization. We respond within 45 days, and may extend by a further 45 days where permitted, with notice to you.

Children

Roasterra is a business service and is not directed to children under 16.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above, and where appropriate we will notify you.

Contact

Questions about this policy or your data? Email privacy@roasterra.com.