AVORA · LEGAL
Privacy
What this site collects, who else sees it, and why. Every paragraph below describes what the code running this shop actually does.
Not published
This page is not a policy yet
The structure is here, but the points below are decisions for the owner of the business and have not been made. Nothing on this page has been agreed, and nothing on it should be relied on.
Still to be decided
- The registered name of the company that sells this coffee — the one on the business registration, which may not be the word AVORA.
- That company's full registered address, including the country.
- Its tax registration number — the NIT, or a VAT number if it has one.
- The day these pages start to apply, as a calendar date.
- How many months order and contact records are kept after a customer's last purchase, before being deleted.
Until every point above has an answer, this page stays out of the sitemap and asks search engines not to list it.
The answers are written once, in lib/legal-answers.ts, and this notice removes itself.
When you buy
Your basket reaches us as a list of references — which coffee, which weight, how many — and every price and total is worked out on our server. Payment itself happens on Stripe’s own checkout page: we never see or store your card details. Stripe collects your email address and delivery address there and passes them back to us, and we store your order lines, the amounts charged, the delivery address, the status of the order and Stripe’s reference for the payment.
When you open an account
Accounts are run by Clerk. Clerk holds your sign-in details, your password included, and we never see them. When you sign up or change your details, Clerk sends us a signed message with three things — your Clerk identifier, your primary email address and the name you gave — and we store those so your orders can be attached to your account. Buying does not require an account.
When you write to us
The contact form stores your name, email address, subject and message in our database, sends them to our support inbox, and sends you an automatic acknowledgement that quotes your own message back to you.
When you join the newsletter
We store the email address you gave and which form it came from. Nothing else is kept alongside it, and the record carries a field for the day you unsubscribe.
What we measure
PostHog only runs once you accept it, and then records page views and a small set of events: adding a bag to the basket, starting checkout, finishing the quiz, and starting a subscription. A completed purchase — with the order reference, the total and the items — is recorded by our server when Stripe confirms the payment; if you declined, that sale is counted under an opaque row number that is not linked to your browsing. Vercel’s page-view counter runs on every page and stores nothing in your browser. Screens inside the operations panel are excluded from both, and identifiers are stripped out of every address reported to either, so an order reference is never reported from a screen showing a customer’s address.
Who else handles your data
Clerk for accounts, Stripe for payments, Resend for the emails we send you, Supabase for the database, Vercel for hosting and page-view counting, PostHog for product analytics, and Cloudinary for images and video, which your browser loads straight from their servers, so they see the request. These companies sit in several countries, so using this shop means your data crosses borders.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to us using it. Write to the address at the foot of this page from the email you ordered with, or tell us which order you mean, so we can find you without asking for more information than we already have.
Changes to this page
If what we do changes, this page changes with it, and so does the date at the top.
Questions about this page
If anything here is unclear, write to hello@avora-coffee.com.