Privacy policy
Last updated: 2026-10-06
This page explains what personal data Brew & Rate collects, why, who else handles it, how long it is kept, and the rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
The controller of your personal data is Gianmarco Cavallo, Italy. For any privacy question or request, write to [email protected].
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email address, password (stored only as a hash), profile picture if you add one | Creating and running your account, signing you in, sending one-time sign-in codes | Contract (Art. 6(1)(b)) |
| Content you publish: reviews, ratings, comments, favorites, follows, setups, proposals, edit suggestions, uploaded images, reports | Showing it on the site; reviews, comments and public setups are visible to everyone with your display name | Contract (Art. 6(1)(b)) |
| Contact form: name, email address, message | Answering you | Legitimate interest (Art. 6(1)(f)) |
| Sign-in sessions: IP address and browser type; IP address for short-term rate limiting | Keeping accounts secure and preventing abuse | Legitimate interest (Art. 6(1)(f)) |
| Usage analytics: pages viewed, clicks and actions on the site, device type, approximate location (country) derived from your IP address. Visitors are counted with an anonymous code that changes every day, and nothing is stored in your browser. Actions you take while signed in, such as posting a review, are recorded with your account ID | Understanding how the site is used and improving it | Legitimate interest (Art. 6(1)(f)) |
| Error reports: technical details of errors in your browser or on our server | Finding and fixing bugs | Legitimate interest (Art. 6(1)(f)) |
Cookies and browser storage
We do not use cookies for analytics or advertising, so there is no cookie banner. The site only stores what it needs to work:
| Name | Purpose | Needs consent |
|---|---|---|
| better-auth.session_token, better-auth.session_data | Keeps you signed in (up to 7 days) | No, strictly necessary |
| Preferences (theme, catalog layout, units, currency, comparison lists, setup draft) | Remembers choices you make on the site, stored only in your browser | No, requested by you |
Who else handles your data
The site runs on a server we operate in the European Union. We use these providers, who process data on our behalf under data processing agreements:
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Delivers the site securely (network and TLS), stores uploaded images and encrypted database backups | Global network; US company |
| PostHog Inc. | Usage analytics and error reports | EU (Frankfurt, Germany) |
| Resend, Inc. | Sends sign-in codes and account emails | EU (Ireland); US company |
| jsDelivr | Serves the world map data used on coffee origin maps, so your browser contacts it directly | Global network |
Transfers outside the EU
Some providers are US companies and may access data from outside the EU. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
Buy links take you to third-party shops. Once you leave Brew & Rate, their own privacy policies apply.
How long we keep data
| Data | Kept for |
|---|---|
| Account and published content | Until you delete your account |
| Sign-in sessions | Up to 7 days after your last activity |
| Contact messages | Up to 12 months |
| Analytics events | 1 year |
| Database backups | Up to 30 days |
| Rate-limiting IP addresses | Minutes, in memory only |
Your rights
You can ask to access, correct or delete your data, to receive it in a portable format, to restrict its processing, or object to processing based on legitimate interest. Write to us at the address above and we will reply within one month. To delete your account and everything you published, send the request from the email address of the account.
You can object at any time to the processing based on legitimate interest, including usage analytics; write to us and we will stop unless we have compelling grounds.
If you believe we handle your data unlawfully, you can complain to a data protection authority, in particular the Garante per la protezione dei dati personali (https://www.garanteprivacy.it) or the authority where you live.
Children
Brew & Rate is not meant for children under 16, and we do not knowingly collect their data.
Changes
We will update this page when what we collect or the providers we use change. The date at the top shows the latest version.