Legal
We collect as little as we can, we keep it on our own hardware, and we have never sold or shared any of it. This page explains exactly what that means.
Effective 2026-08-16
This website is operated by Proper Coffee. We design and manufacture coffee brewing equipment in Michigan, USA. For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the information described here.
We are a small workshop and do not publish a street address. Our registered postal address is available on request — email us and we will provide it.
Privacy questions and requests are handled by the owner of the business, reachable at the address above.
Your name, email address, shipping address, the items you bought, and the order total. We keep an order number so you and we can refer to the order later.
Payment card details are entered on Stripe's own checkout pages and never reach our servers. We never see, store, or process your card number.
Your name, email address, the subject you selected, and your message. Contact form submissions are not stored in our database — they are relayed straight to our inbox by email. They persist in that mailbox and in our email provider's delivery logs.
Your email address, the date you subscribed, and a record of the consent you gave. Nothing else — no name, no purchase linkage.
The pages and products you view, what you add to or remove from your cart, the website that referred you, any campaign parameters in the link you clicked, and a coarse label for your device, browser and operating system (for example “mobile, Chrome, macOS”).
Three things are worth stating plainly, because they are unusual:
Our website application does not record or store your IP address. However, like every website, our web server and our network provider (Cloudflare) keep short-term access logs that include IP addresses, for security, abuse prevention and troubleshooting. These logs are retained for approximately 30 days and are not linked to your orders or to your browsing activity on this site.
When you load the site, our network provider tells our server which country your connection appears to come from, so that we can show you the privacy choices you are entitled to in your location. We reduce that to a broad region label, we never receive or store your IP address, and we do not keep the region either.
| What we do | Legal basis |
|---|---|
| Fulfil and ship your order | Performance of a contract — Art. 6(1)(b) |
| Take payment through Stripe | Contract, and Stripe's own legal obligations — Art. 6(1)(b), 6(1)(c) |
| Send order confirmation and shipping notices | Performance of a contract — Art. 6(1)(b) |
| Reply to your enquiry | Pre-contractual steps or legitimate interests — Art. 6(1)(b), 6(1)(f) |
| Keep sales records for tax and accounting | Legal obligation — Art. 6(1)(c) |
| Send you our newsletter | Your consent — Art. 6(1)(a) |
| First-party analytics | Your consent — Art. 6(1)(a) and ePrivacy Art. 5(3) |
This website sets no cookies. Not one. To keep your shopping cart and to count visits, we store a small amount of information in your browser's local storage — every item of it is listed in our Cookie & Local Storage Notice.
Analytics storage is optional. If you are in the EU, EEA, UK or Switzerland, nothing is written to your device until you agree. Elsewhere, you can opt out at any time and we will erase the identifier immediately. .
When you withdraw consent we stop collecting and delete the identifier from your browser. Visit records already collected are pseudonymous and no longer linkable to your browser once that identifier is gone; they are deleted on the schedule below.
We do not sell your personal information, and we do not share it for advertising. The companies below are the complete list of anyone who touches your data, and each one processes it only to perform a specific service for us.
| Recipient | Role | What it receives |
|---|---|---|
| Stripe, Inc. | Payment processing. Stripe also acts as an independent controller for its own fraud, anti-money-laundering and legal purposes. | Name, email, billing and shipping address, and card details entered directly on Stripe's pages |
| Resend | Transactional email delivery | Recipient email address and message content |
| Cloudflare, Inc. | Network security, TLS and content delivery | Request metadata including IP address, in short-term logs |
Our database and website run on hardware we control, not on a public cloud platform. The software we use for the database is open source and self-hosted, which means there is no database vendor with access to your information.
We may also disclose information where we are legally required to, or to establish or defend a legal claim.
| Category | Collected | Details |
|---|---|---|
| A. Identifiers | Yes | Name, email, postal address, order number, analytics visitor ID. Not IP address at the application layer. |
| B. Customer records | Yes | Name and shipping address. No Social Security number, driver's licence, insurance, medical or employment data. |
| C. Protected classifications | No | — |
| D. Commercial information | Yes | Products viewed and purchased, order history, cart contents. |
| E. Biometric information | No | — |
| F. Internet or network activity | Yes | Pages and products viewed on this site, referring site, campaign parameters, device category. No browsing history from other sites. |
| G. Geolocation data | No | No precise or GPS location. A country-level signal is used momentarily to select the correct privacy notice and is not stored. A shipping address is a postal address, disclosed under A and B. |
| H. Sensory data | No | — |
| I. Professional or employment information | Staff only | Accounts for our private admin area. |
| J. Education information | No | — |
| K. Inferences | Minimal | We label each visit's traffic source (direct, search, social, referral, email) from the referring website. We build no profiles and make no predictions about you. |
Sensitive personal information as defined by California law: none.
We do not sell your personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months.
Our servers are in Michigan, USA. If you order from the EU, UK, Canada, Australia or Japan, the information needed to fulfil your order is transferred to the United States. We rely on the necessity of that transfer for the performance of your contract with us, and our processors' agreements incorporate the Standard Contractual Clauses and the UK International Data Transfer Addendum.
| Information | Retained for |
|---|---|
| Orders and shipping addresses | 7 years — tax and accounting records |
| Customer records with no orders | 24 months of inactivity |
| Analytics visits and events | 14 months, then deleted |
| Newsletter subscription | Until you unsubscribe |
| Record that you unsubscribed | Kept indefinitely — we need it to make sure you are not added back |
| Server and network access logs | About 30 days |
Some information we cannot delete on request. Tax and accounting law requires us to keep records of what we sold, to whom, and for how much. When you ask us to delete your data, we remove what we can — your name, your address, your contact details, your browsing history — and keep only the transaction record the law obliges us to keep.
Separately, we cannot delete payment records held by Stripe. Stripe retains those under its own schedule and legal obligations.
Traffic to this site is encrypted in transit. Payment card details never touch our servers. Access to customer information is limited to staff accounts protected by passwords stored only as salted hashes, and our database runs on hardware we control rather than a shared platform.
No method of transmission or storage is completely secure, and we do not claim otherwise. If we ever become aware of a breach affecting your information, we will notify you and the relevant authorities as required by law.
We extend the rights below to every customer, wherever you live, and whether or not the law requires it of us.
California residents have the right to know, delete and correct personal information; to opt out of its sale or sharing; to limit the use of sensitive personal information; to non-discrimination for exercising these rights; and to use an authorised agent. Because we do not sell or share personal information, there is nothing to opt out of, and because we collect no sensitive personal information, there is nothing to limit.
Residents of other states with comprehensive privacy laws have equivalent rights of access, correction, deletion and portability, plus the right to opt out of targeted advertising, sale, and profiling — none of which occur here. If we decline a request, you may appeal: reply to our decision and the owner will personally review it. If we deny your appeal, you may contact your state Attorney General.
You have the rights of access, rectification, erasure, restriction, portability and objection, including an absolute right to object to direct marketing. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of what we did before. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office; in the EU, your national data protection authority.
Canadian residents may access and correct their information and may direct questions to our named privacy contact above. Australian residents may access and correct their information under the Australian Privacy Principles. For residents of Japan, the purposes of use are those set out in this policy, and you may request disclosure, correction or suspension of use, including in respect of the cross-border transfer to the United States described above.
Email privacy@propercoffee.co, or use our contact form and choose Privacy Request from the subject list.
We will acknowledge your request within 10 business days and respond substantively within 45 days (or one month for EU and UK requests). If a request is complex we may extend that once and will tell you why.
To verify that a request really comes from you:
If we cannot verify that a request comes from you, we will decline it. We will not ask you for a copy of your ID.
This site is not directed to children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email privacy@propercoffee.co and we will delete it. California's opt-in requirement for selling the information of consumers under 16 does not arise, because we do not sell or share personal information at all.
We do not track you across other websites, so there is nothing for a Do Not Track signal to switch off. No third party collects information about your activity on this site. We nonetheless treat a Do Not Track or Global Privacy Control signal from your browser as a request to opt out of our own first-party analytics, and we honor it — automatically, with no banner and no further action from you.
If we change this policy we will post the revised version here with a new effective date. For material changes we will also ask you to review your privacy choices again the next time you visit. Every version of this policy is recorded in our source control history.
Privacy questions and rights requests: privacy@propercoffee.co
Everything else: info@propercoffee.co
Proper Coffee