Privacy Policy

01Overview

This policy explains how Roastnet Ltd ("Roastnet", "we") collects and processes personal data when you visit roastnet.com, create a Roastnet workspace, use the Roastnet platform, the Factory desktop app or the mobile app, trade on the green market, or interact with a roastery's storefront or cafe portal hosted on Roastnet.

Two roles matter. For data about our direct customers, market members and site visitors (account details, billing, usage, orders), Roastnet is the data controller. For personal data our customers store in their workspaces (their contacts, wholesale customers, storefront buyers), the roastery is the controller and Roastnet processes that data on its behalf. The Data and GDPR page explains this in more detail.

02What we collect

• Account data: name, email, phone, company details, country, language.
• Market data: listings, sample requests, orders, delivery and collection addresses, contact names at those addresses, and claims.
• Billing data: plan, invoices and payment status. Card details are collected and stored by our payment processing provider, not by us.
• Usage data: product interactions, device and browser information, and server logs used for security and reliability.
• Customer Data: content your workspace stores in the Service, processed under your instructions.
• Support communications you send us.

03The Roastnet mobile app

The app signs in to your existing Roastnet workspace; accounts are set up on the web. It asks for device permissions only when you use the feature that needs them, and you can turn each one off in your phone settings:

• Location: only while taking an in-person card payment at a market stall, because the card networks require it to process the payment. We do not track your location.
• Microphone: only while you talk to the built-in assistant by voice.
• Camera: only to scan a QR code when you set up two-factor authentication. Images are not stored.
• Photos: only the photos you choose to attach to an assistant conversation.
• Contacts: only if you switch on contact sync in Settings, to copy your contacts into your own workspace.
• Notifications: a push token so we can tell you about your orders, listings, samples and deliveries.
• Card payments taken with the app are processed by our payment processing provider. Card numbers are never stored by Roastnet or on the phone.
• The assistant sends your messages, and voice audio when you use voice, to an AI service provider to produce its replies. The app asks for your consent before the first use.
• To ask for your account to be deleted, a workspace owner can use Settings in the app, or anyone can email [email protected].

04Why we process it (lawful bases)

• To provide the Service and run the market under our contract with you (Art. 6(1)(b) UK GDPR).
• To bill, secure and improve the Service, and to prevent fraud: our legitimate interests (Art. 6(1)(f)).
• To meet legal obligations such as accounting, tax and customs rules (Art. 6(1)(c)).
• With your consent where required, for example optional marketing emails (Art. 6(1)(a)); you can withdraw consent at any time.

05Sharing in the market

In trades where Roastnet is the seller of record we keep the buyer and seller private from each other. We share only what a carrier needs to collect and deliver. In importer trades, the buyer's business and delivery details are shared with the importer so that it can confirm, invoice and deliver the order.

06Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent. To exercise any of these rights, email [email protected] from the address associated with your account; we respond within one month. Where Roastnet acts as processor for a roastery's data, we will refer your request to the roastery and help it to respond.

You also have the right to complain to your supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

07Service providers

We do not sell personal data. We share it only with service providers who process it for us under contract, in these categories: cloud hosting and storage, content delivery and security, payment processing, email and messaging delivery, logistics and carriers for market deliveries, and, only for workspaces that enable AI features, AI service providers. Each is bound by data processing terms. The current list of providers is available on request from [email protected].

08Where data is stored

Production data is hosted in data centres in the United Kingdom. Where a transfer outside the UK or EEA occurs, for example to a provider that operates globally or to an importer or origin seller in another country, we rely on adequacy regulations or standard contractual clauses and the UK addendum.

09Retention

Account, order and billing records are kept for as long as your account exists and afterwards as required by law (typically 6 years for accounting records). Customer Data is retained while your workspace is active and is available for export for 30 days after termination, after which it is deleted from production systems; backups roll off on a fixed schedule.

10Cookies

The marketing site uses cookieless analytics and a single preference cookie for your language. The application uses strictly necessary cookies for sign-in and security. We do not use advertising cookies. See the Cookie Policy.

11Children

The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.

12Changes and contact

We will post updates to this policy here and, for material changes, notify you through the Service. The controller is Roastnet Ltd, a company registered in England and Wales with company number [PLACEHOLDER: company number], registered office [PLACEHOLDER: registered office address]. Contact our privacy team at [email protected].