Privacy Policy

Account Information

We collect account details when you register, including during checkout. An account may be created even if you do not complete a purchase. We store:

• Your name and email address
• A cryptographic hash of your password — never the password itself
• The storefront you signed up through
• When your account was created and last updated

Orders and Subscriptions

For each order and subscription we keep the record of what you bought and what happened to it:

• The coffees, quantities, grind, and prices on each order
• Your delivery choice, and your subscription's interval and next scheduled date
• Order status, fulfillment progress, and shipment tracking
• Payment and refund records, including amounts, dates, outcomes, and the reason a payment failed

Shipping Information

If your order ships, we collect and store the delivery address, along with the name, phone number, and email address attached to it. We also store what our address validator returns about that address, which is more than you typed:

• The standardized form of the address
• A place identifier, plus code, and approximate latitude and longitude
• Whether the address appears to be residential or commercial

Payment Information

We receive limited card information from Stripe, including the brand, last four digits, expiry month and year, and payment identifiers. We use and may store this information to display your saved payment method and manage payments. Your full card number and security code never pass through our servers and are not stored in our database. See “How Payments Work” below.

Checkout In Progress

While you are working through checkout, the contact and shipping details you have entered are held in a checkout session so you can come back to them. That record exists before there is an order, and it is deleted 30 days after an abandoned checkout. Account information may be retained separately; see “How Long We Keep Things” below.

Sign-In Records

When you sign in, we record the IP address and browser user-agent associated with that session. We use it to keep accounts secure and to end sessions when you reset your password.

Product Analytics

We use a product analytics service to understand how the site is used. It records page views and interactions automatically, along with a randomly generated identifier for your browser, technical details about that browser, and errors the page encounters. Once you are signed in, those events are associated with your account. See “Cookies, Storage, and Analytics” for what this means in practice.

Email Engagement

Marketing emails contain a tracking pixel and rewritten links, so we can tell that a message was opened or a link was clicked. Transactional emails — order confirmations, renewal reminders, payment notices — do not carry either.

Mailing Lists

A partner may give us a list of contacts to invite to their storefront, or you may sign up through a form. Those records hold an email address, a name if we were given one, where the address came from, and whether it has since unsubscribed or bounced. A mailing-list contact is not an account.

• Roast, pack, and ship your coffee, and tell you where it is
• Charge your card for the order and for each renewal you have authorized
• Send transactional email: order confirmations, renewal reminders, payment and refund notices, and password resets
• Recover failed payments and let you know when your bank needs you to re-authorize a charge
• Answer your questions and provide support
• Keep accounts and payments secure, detect fraud, and enforce our terms
• Understand how the product is used so we can improve it
• Meet our legal, tax, and accounting obligations

What We Do Not Do

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We run no advertising on our storefronts and we do not build advertising profiles.

What They Receive

Staff at the partner organization whose storefront you bought from can see, for their own storefront only:

• Your name, email address, and phone number, and when you signed up
• Your delivery address, where your order ships
• Your subscriptions: status, the coffees on them, the interval, the next scheduled date, and — if one was cancelled — the reason recorded
• Your orders: what you bought, what you paid, the date, and the fulfillment and delivery status

Payment Details Stay With Us

Partners never receive your card details. Your full card number and security code go directly to Stripe. The limited card information we receive is described under “How Payments Work” below.

One Partner, One Storefront

A partner's access to customer information is restricted to its own storefront.

Our Relationship With Partners

Each partner is a separate organization, and their use of what they can see is governed by their agreement with us. If you would rather take something up with us directly than with the storefront you bought through, write to privacy@zerocarbon.coffee.

What We Keep

We use and may store the card brand, last four digits, expiry month and year, and identifiers Stripe issues for you and your saved payment method. This information lets us display the card on file, process payments you have authorized, and help resolve payment issues.

Renewals and Re-Authentication

We use your saved payment identifiers to process authorized subscription renewals and payment recovery. We contact you about payment failures or additional verification your bank requires. Our Terms of Service explain subscription billing and payment recovery.

Service Providers

We share what a provider needs to do its job, and nothing further. The next section describes the services and providers we use.

Partner Organizations

The storefront you bought through receives the information listed under “What Your Partner Organization Receives” above.

Legal and Safety

We may disclose information where we are required to by law, or where we believe in good faith it is necessary to investigate fraud, enforce our terms, or protect the rights and safety of our customers, our partners, or the public.

Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, customer information may be part of what transfers. We would give notice before your information became subject to a different privacy policy.

• Stripe — payment processing. Receives your card details directly from your browser, plus your name, email address, and the amounts charged.
• Postmark — email delivery. Receives your email address, your name, and the contents of the messages we send you.
• Shippo, and through it the delivery carrier — shipping. Receives your name, your full delivery address, and the parcel details, and returns tracking.
• Google — address validation. Receives the delivery address you type, and returns the standardized form of it.
• Vercel — hosting, file storage, and website analytics.
• PostHog — product analytics, hosted in the United States.
• Upstash — rate limiting to prevent abuse. Receives visitor IP addresses, checkout-session identifiers, and storefront identifiers when checking limits on checkout requests.
• Inngest — background job processing. Handles the queued work behind emails, renewals, and fulfillment.

About Our AI Provider

We use OpenAI for a small number of internal features that help partners set up and describe their storefronts. It receives partner organization details and the content of partner websites. It does not receive customer personal information.

Cookies and Local Storage

• Sign-in cookies that keep you signed in to the storefront you use.
• Analytics identifiers that help us understand visits and interactions.
• Cookies set by Stripe on our payment pages, which Stripe uses for fraud prevention.
• Remembering your cart and discount codes while you shop.
• Your light or dark theme preference.

Analytics

We use product analytics for signed-in and signed-out visitors. It can collect page views and interactions automatically to help us understand and improve the service.

Your Choices

We do not currently offer an in-product analytics opt-out or a cookie consent banner. Today your options are your browser's own controls — blocking or clearing cookies and site data, or a tracker-blocking extension. Blocking the sign-in cookie will prevent you from staying signed in; blocking analytics will not affect anything else. If you want your analytics records deleted, write to privacy@zerocarbon.coffee and we will delete them.

Checkout and Sign-In Records

• An abandoned checkout session, and the contact and shipping details held in that session, is deleted 30 days after it is abandoned. Account records are retained separately as described below.
• Sign-in sessions expire or are revoked for security. Associated records, including IP addresses and browser details, may be retained for account security after a session ends.

Accounts

Account records, including your name, email address, and password hash, are kept separately from checkout sessions. They may remain after an abandoned checkout session is removed, even if you never complete an order. To request account deletion, write to privacy@zerocarbon.coffee.

Kept as Business Records

Orders, payments, refunds, and the administrative audit log are financial and business records. We keep them for as long as we need them for accounting, tax, and dispute purposes. We do not publish a fixed period for these, and we would rather say that than quote a number we do not actually enforce.

Access and Correction

You can see and update your account details, subscriptions, and saved payment method from your account area. For anything you cannot reach there, write to privacy@zerocarbon.coffee or support@zerocarbon.coffee and we will help.

Deletion

Write to privacy@zerocarbon.coffee to ask us to delete your information, and we will delete or de-identify what we can. We want to be straight about the limit: records tied to completed purchases — orders, payments, refunds — are retained as accounting and tax records, so a deletion request will not remove your purchase history.

California Residents

We do not sell personal information and we do not share it for cross-context behavioral advertising, so we have no “Do Not Sell or Share” process to offer. California residents may request access to, correction of, or deletion of their personal information at privacy@zerocarbon.coffee, subject to the retention limits above. We will not discriminate against you for making a request.

privacy@zerocarbon.coffee FLDWRK Coffee LLC DBA Zero Carbon Coffee 150 Paularino Ave, Bldg B Costa Mesa, CA 92626 (949) 919-7778