Your details, in plain words

BeansDrop is run by [To confirm, name of the person or company running BeansDrop]. Questions and requests about your details go to [email protected].

On this page "you" means anyone whose details we keep. That's contributors (with an "I drink coffee" or "I roast coffee" account), cafés (with an "I run a café" account), and anyone who used the earlier pilot sign-up form. Where something is only about one of them, it names them. If you take on more than one role, you have an account for each, and we keep each account's details as set out for its role. Those accounts can share one email address, and each keeps its own copy of it with its own password.

Everyone with an account

• Your email address, which you sign in with.
• The language you last used the site in, so our emails reach you in it.
• Your password, stored scrambled so that nobody, including us, can read it.
• When you agreed to this notice and to the terms and conditions.

Contributors ("I drink coffee" and "I roast coffee")

• The contributor's name, or their roastery's name.
• Their phone number and a nickname for the menu, only if they give them.
• The bags they drop, with the coffee, roastery, weight, roast date and how many grams have been used.
• The bags they offer to cafés, with 1 to 3 photos of each bag or its shop listing, and the messages they and the café write about it.
• Their balance at each café. That's what they've earned, and what the café has paid back, as points they spent or as payments.
• For roasters, whether they're registered for VAT and, if so, their tax ID and registered name. And for each bag that came off a bar, what the café owes for it, and the invoice, receipt or tax invoice they upload.
• The cafés they follow, and their notifications. That's new coffee at those cafés and, for roasters, a bag ready to invoice or a café saying it paid, with whether they've read or archived each one.

Cafés ("I run a café")

• The café's name and page address, and its Google Maps link and location if it adds them.
• The bags on its guest bar and in its queue.
• The proof of payment it uploads for a roaster's invoice, such as a bank slip.

The earlier pilot sign-up form

If you signed up there, we kept which kind of account you were interested in, your name, your email and your phone number if you gave it.

Behind the scenes

• One cookie that keeps you signed in, one that remembers which accounts have signed in on this browser, and two that remember your language and your light or dark theme. No advertising or tracking cookies.
• When you sign in on a browser that hasn't signed in to your account before, we email you the time, the kind of browser and device, and your internet address, so you can spot a sign-in that wasn't you. They're only in that email, not saved to our database.
• When you sign in or register, your internet address is held in memory for up to an hour to stop repeated attempts. It isn't saved to our database.

• To run the pilot. That means logging the bags contributors drop, working out what each contributor is owed, and showing each café what it owes.
• To show what's on the guest bar right now on the website.
• To email you a link that confirms your address when you register.
• To email you when something happens to your account or your bags. A sign-in on a new browser, a bag offered, withdrawn, approved, accepted, declined or turned away, an approval that ran out, a café recording points used or a payment, a roaster's bag coming off the bar by itself or ready to invoice, an invoice, payment, receipt or "not received" uploaded, an invoice coming due, and at most once a day, what your bags earned.
• To contact you about your bags or the pilot.
• To learn whether the pilot works, from totals such as how many bags were dropped and how quickly they sold.

We keep it because you agreed to it when you registered. We don't sell it or use it for advertising.

• The BeansDrop team sees everything above, to run the pilot.
• The cafés a contributor drops at see the contributor's name, their nickname, the bags they dropped there and their balance there. A café finds a contributor's account when the contributor offers it a bag, when it scans the counter code the contributor shows it, or by the email the contributor gives it at the counter. Cafés don't see a contributor's password, phone number or balances at other cafés. A café sees the photos of bags offered to it, and nobody else does. A café sees how many people follow it, never who. A café and a roaster see each other's invoices, proof of payment and receipts for the bags between them, with the roaster's tax ID and registered name if it's VAT registered. Nobody else does.
• Everyone can see a café's name and page, where it is on the Discovery map if it added its location, the roastery's name next to its coffee, and a contributor's nickname if they chose one (otherwise the menu says "a regular"). Every roaster has a page of its own, with its name, the bags cafés have taken from it and the cafés pouring them now. A roaster that adds its location shows on the Discovery map once a café has taken one of its bags.
• CARTO serves the map pictures on the Discovery page, so it sees your IP address and which part of the map you look at. "Near me" asks your browser for your location only to move the map; we don't keep it.
• OpenRouter passes what a café asks for when it has AI draft a social post to the AI model that writes it: the café's name and brand voice, its own note, and the chosen coffees as the café's public page shows them (with a contributor's nickname only if they chose one). Photos the café adds stay on its device. We don't keep the drafts.
• Resend, the service that sends our emails, gets your email address to deliver them.
• Cloudflare Turnstile checks that a person, not a bot, is registering, signing in or asking for a new link. It sees your IP address and details about your browser and device, not what you type in the form.

Nobody else, unless Thai law requires us to share it.

For the pilot only. We delete your details within 3 months after the 4-week pilot ends, unless you keep using BeansDrop after it. Totals that can't identify anyone, like "40 bags poured", may be kept.

If you register but never confirm your email, we delete that account after 7 days.

When you delete your account, we delete your email and password straight away, and a contributor's name, nickname and phone too. The cafés a contributor dropped at keep the record of their bags and what was paid back, without the name, so the cafés' books still add up. The photos on their offers are deleted. A roaster's invoices and receipts, with the tax ID and registered name on them, and the cafés' proof of payment stay with those cafés, because they need them for their accounts.

You can

• download a copy of what we keep about you;
• change your email and password, and ask us to correct anything else that's wrong. Contributors can also change their nickname and phone number;
• delete your account, which withdraws your consent. A café closes its account the same way, once it owes nobody anything.

Contributors do this themselves on their Account page, cafés on the café Account page. You can also email [email protected] from the address you registered with, and we'll reply within 30 days. A suspended café can't reach its pages, so it emails us instead.

A contributor deleting their account should first spend any café points they have, or ask each café to settle what it owes them. Once the account is deleted, nobody can use those points, and BeansDrop stops tracking what's owed.

If you're unhappy with how we handle your details, you can complain to Thailand's Personal Data Protection Committee (PDPC).

If we change what we keep or who sees it, we'll update this page and the date at the top, and ask for your consent again where the law needs it.