Privacy Policy

1. Who we are and what this policy covers

This policy describes how California Roasting Collective (“CRC,” “we,” “us,” or “our”), located in San Marcos, California, handles personal information in connection with caroastingcollective.com, our customer app at app.caroastingcollective.com, and related inquiries, customer accounts, tours, bookings, orders, mailing-list subscriptions, and customer support.

Privacy questions and requests may be sent to hello [at] caroastingcollective [dot] com, or through our contact form. Third-party websites and services have their own privacy policies; this policy does not govern their independent practices.

2. Information collected and its sources

The information involved depends on which services you use. The proposed disclosures below include the following categories:

• Contact and business information: first and last name, email address, phone number, company name, and billing, shipping, or sample-delivery address.
• Inquiries and support: comments, questions, correspondence, support tickets, and attachments you choose to provide.
• Account information: sign-in credentials handled by the authentication service, customer profile details, account identifiers, and profile images.
• Commercial and service records: coffee and roast selections, sample requests, orders, invoices, payment status, bookings, tour requests, production and storage records, shipping details, and tracking information.
• Documents and service intake: uploaded artwork or documents, intake responses, waivers, and signatures when required for a service.
• Mailing-list information: first name, last name, email address, and subscription preferences.
• Technical information: IP address, browser and device information, access and error logs, session identifiers, and preferences that hosting or app services may process to operate and protect the services.

Sources include information you provide directly, your activity in our services, and service providers that return information such as payment status or shipping updates. Please do not include sensitive information that we have not requested in a message or upload.

The website contact form sends your inquiry to our business mailbox for handling through our customer-support system. The website does not maintain a separate submission database. Mailing-list signups are sent to MailerCloud.

3. How information is used

• Respond to inquiries, provide customer support, and fulfill sample requests.
• Create and manage accounts, tours, bookings, coffee orders, production services, storage, and related customer services.
• Process billing and payment updates, arrange fulfillment, and communicate about orders and services.
• Send roasting news and events to people who subscribe to our mailing list.
• Operate, troubleshoot, and protect the website and app, including screening contact-form spam.
• Maintain business records, comply with legal obligations, resolve disputes, and enforce agreements.

4. When information is disclosed

Information may be disclosed to service providers involved in the purposes above. Categories include hosting and data storage, account authentication, business email and support, newsletter delivery, payment processing, and shipping or fulfillment.

Services involved in the proposed disclosure include Lovable Cloud for hosting and app services, Google/Gmail for business email, MailerCloud for mailing-list management, Square for payment and invoice services, and ShipStation or shipping carriers for shipment-related services. Google Fonts supplies website fonts and may receive connection information when your browser loads them. Provider roles and their actual data handling must be confirmed before this draft is adopted.

Information may also be disclosed when required by law or legal process, to protect rights and safety, to professional advisers, with your direction or permission, or in connection with a business transfer subject to applicable law.

CRC does not sell personal information, share it for cross-context behavioral advertising, or use advertising tracking tools. Operational disclosures to providers are distinct from selling information or sharing it for targeted advertising.

5. Cookies, browser storage, and tracking choices

App services use browser storage or cookies for functions such as sign-in sessions and interface preferences. Hosting and connected services may process technical information as described above. Browser controls can limit cookies and storage, but doing so may affect sign-in or other app functions.

CRC does not use advertising trackers or track your activity across unrelated websites for targeted advertising. Links to Instagram, Facebook, payment services, and other external sites take you to services with their own practices.

Legacy “Do Not Track” signals do not currently change CRC’s website or app behavior. Global Privacy Control is a separate opt-out signal for sale, sharing, or targeted advertising where applicable. CRC does not engage in those activities, so there is no such processing to opt out of. Any future change would require review of applicable signal-handling and opt-out requirements before implementation.

6. Retention of information

CRC currently retains inquiries, customer records, and mailing-list records indefinitely, without a fixed automatic deletion schedule. Unsubscribing stops marketing messages but does not necessarily erase the subscription record. Provider logs and backups may have separate retention practices.

You may request deletion using the contact details below. Applicable legal requirements and exceptions may allow or require retention of some records, such as tax, accounting, transaction, dispute, or security records.

7. Mailing-list and account choices

You may ask us to stop marketing emails by contacting hello [at] caroastingcollective [dot] com or our contact form, or use an unsubscribe option provided in a marketing email. Service-related messages, such as booking confirmations, invoices, or replies to your inquiry, are separate from marketing subscriptions.

You may update information using available account settings or contact us for assistance. An inquiry does not, by itself, sign you up for the mailing list.

8. Privacy requests and U.S. state rights

Depending on your state of residence, the law’s applicability to CRC, and relevant exceptions, you may have rights to:

• Confirm processing and access or obtain a copy of your personal information, including a portable copy where required.
• Correct inaccurate information or request deletion.
• Opt out of sale, targeted advertising, or certain profiling with legal or similarly significant effects where applicable.
• Limit certain uses or disclosures of sensitive personal information where applicable.
• Appeal a denied request where your state law provides an appeal right, and exercise applicable rights without unlawful discrimination.

To submit a request, email hello [at] caroastingcollective [dot] com with “Privacy request” in the subject, or use our contact form. Describe the request and your state of residence. Do not send passwords, full payment-card details, or government identification in your initial email.

We may need information reasonably necessary to verify your identity or an authorized agent’s authority. If a request is denied, you may ask for an appeal by emailing the same address with “Privacy appeal” in the subject, where an appeal right applies. Applicable law determines response deadlines, verification requirements, exceptions, and further complaint rights with your state attorney general or privacy regulator.

California residents: the CCPA’s rights depend on whether CRC is a covered business. When applicable, these include access/knowledge, correction, deletion, sale/sharing opt-out, certain sensitive-information limits, and non-discrimination. CRC does not sell or share personal information for cross-context behavioral advertising. California residents may also contact us about direct-marketing disclosures covered by California Civil Code section 1798.83, where applicable.

9. Children’s privacy

The proposed policy is for business and general-audience coffee services, not services directed to children under 13. If you believe a child under 13 has provided personal information, please contact us so we can review and address the situation under applicable law. Any collection subject to children’s privacy laws requires the relevant safeguards and permissions; this policy is not a substitute for them.

10. Security and external services

No internet service can guarantee absolute security. Please protect your account credentials and contact us if you believe your account has been compromised. This policy does not promise specific certifications, security audit outcomes, or a particular geographic data-storage location.

Payment providers and other external services may collect information directly under their own notices. Their independent practices should be reviewed when using those services.

11. Policy changes and contact

This policy is effective November 5, 2026. Future changes will be posted on this page with an updated date. Material changes will be communicated through an appropriate notice, such as a website or app notice or email, and any additional notice or consent required by applicable law.

California Roasting Collective
San Marcos, California
hello [at] caroastingcollective [dot] com