Privacy Notice

1. Controller

El Café de los Sentidos, S. de R.L. de C.V., with its address at Avenida Miguel Ángel de Quevedo #621-A, Colonia Cuadrante de San Francisco, Alcaldía Coyoacán, C.P. 04320, Ciudad de México, México, is the controller of your personal data. Privacy contact: contacto@cafedelossentidos.com · WhatsApp +52 55 1452 8815.

2. When we are controller and when we are processor

• We are controller of your account, billing, security and support data, and of Marketplace profiles and listings as far as operating the Marketplace is concerned.
• We are processor of the data an organization (the “Customer”) enters in its workspace: for example, the names of its cuppers and guests, their scores, notes and photos, or producer and farm data in its logbooks. The Customer is then the controller and we process the data only on its behalf, under the Data Processing Agreement. To exercise your rights over that data, contact the organization; if you write to us, we will help route your request.

3. Personal data we process

• Identity and contact: name, email, profile photo (if you sign in with Google), language and time zone.
• Access and security: hashed password (never readable), sign-in method, active sessions with IP address and browser, platform staff passkeys, audit and rate-limit records.
• Workspace and professional activity: organization, role, memberships and invitations; cupping sessions, samples, scores, descriptors, notes, lots, origin logbooks (which may include producer names and farm locations), photos, documents, exports and AI Lab conversations.
• Guests: the name you type when taking part, your answers, and an identifier stored in your browser so you can continue your evaluation.
• Marketplace: the organization’s public profile, published lots, photos, messages between buyers and sellers, and any contact details you choose to share.
• Billing: billing name and email, Plan, payment status, Stripe identifiers and, if you request an invoice, your tax details. Card details are collected and processed directly by Stripe; we never receive the full number.
• Communications: support messages, product feedback and delivery events for the emails we send you.
• Technical data: IP address, browser and device type, aggregated page visits, server logs and error reports (with personal data removed before sending).

We do not request sensitive personal data. Please do not enter it in the Service unless strictly necessary and you have the legal basis to do so. The financial data processed for billing (Plan, payment status, tax details) requires your express consent, which you give by accepting this notice when you buy.

4. Why we use your data

Primary purposes (needed for the Service you request):

• create and manage your account and verify your identity when you sign in;
• provide the Service: workspaces, cupping sessions, guests, offline sync, exports, Marketplace, the AI features you use and the SCA uploads you choose to make;
• charge and manage subscriptions, issue receipts and handle billing questions;
• send you necessary Service emails: verification, sign-in links, invitations, security, billing and document-change notices;
• provide support and answer your requests;
• protect the Service: prevent fraud and abuse, enforce usage limits, detect errors and keep audit records;
• comply with legal obligations and requests from authorities, and exercise or defend our rights.

Secondary purpose (not needed for the Service):

• produce internal usage statistics and analyses to improve the Service.

If you do not want us to use your data for the secondary purpose, write to contacto@cafedelossentidos.com with the subject “Secondary purpose”; you can do so at any time and it will not affect the Service. We do not send advertising or sell your data. If we ever want to send you marketing communications, we will ask for your consent first.

5. Providers who help us (processors)

We share data with the following providers, who process it on our behalf under contract and only to provide the Service. These disclosures do not require your consent. The current list, with its change history, is at Subprocessors and data location.

6. Transfers

We only transfer personal data to third parties in these cases:

If you do not object to the last transfer by writing to contacto@cafedelossentidos.com, we will understand that you consent to it. We will notify you before it happens and you may delete your account if you disagree.

7. Where your data is stored

The primary database and its backups are in the United States (AWS us-east-1, Northern Virginia); the application runs in Vercel’s iad1 region (Washington, D.C.). Files are stored with Vercel in the United States. Details are at Subprocessors and data location. In offline mode your browser also keeps a working copy on your own device.

8. Your ARCO rights and how to exercise them

You have the right to access, rectify and cancel your data and to object to its processing (ARCO rights), and to revoke your consent.

In the app, right away:

• view and correct your name, language and profile data in Profile;
• download your information with the available exports;
• delete your account from your Profile (immediate);
• if you are an owner, request deletion of a workspace from its settings (erased after 30 days).

By email, writing to contacto@cafedelossentidos.com with:

• your name and your account email, so we can reply;
• a document proving your identity or, where applicable, legal representation;
• a clear description of the data and the right you want to exercise, and any document that helps locate the data.

We will reply within 20 business days of receiving the complete request and, if it is granted, carry it out within the following 15 business days. These periods may be extended once for an equal period when justified, and we will tell you. The process is free; only shipping or copying costs could apply.

9. Revoking consent and limiting use

• You may revoke your consent or ask us to limit the use or disclosure of your data through the same channel (contacto@cafedelossentidos.com), with the same requirements and periods. If revocation prevents us from providing the Service, we will explain why.
• If you register with PROFECO’s Public Registry to Avoid Advertising (REPEP), we will respect it; in any case, we do not send advertising.

10. Cookies and similar technologies

We use only cookies and storage that are necessary for the Service to work. We do not use advertising or third-party tracking cookies. Vercel web analytics does not use cookies and counts visits in aggregate.

You can delete or block cookies in your browser, but signing in and offline mode will stop working.

11. How long we keep data

• Account: while it is active. If you delete it, it is erased immediately and your contributions to other people’s workspaces are anonymized.
• Workspace: until its owner deletes it; deletion completes 30 days after the request.
• Backups: deleted data leaves backups within 35 days at most.
• Billing: 5 years, under the Mexican Federal Tax Code.
• Export files: 30 days; shared links expire after 7 or 30 days or when revoked.
• Marketplace AI features: submitted content 30 days; usage records 12 months.
• Email delivery events: 30 days.
• Security and audit records: while the account or workspace they belong to exists, and for the time needed to meet legal obligations or defend rights.

12. Security

We apply reasonable administrative, technical and physical measures: encryption in transit (HTTPS) and at rest in our providers’ infrastructure, role-based access control, strong verification for platform staff, audit records, backups, usage limits and removal of personal data from error reports. If a breach significantly affects your rights, we will tell you without delay.

13. Minors

The Service is intended for adults. We do not knowingly collect data from minors.

14. If you are in the European Economic Area, the United Kingdom or Switzerland

• Controller: El Café de los Sentidos, S. de R.L. de C.V., with the contact details in this notice.
• Legal bases: performance of the contract (account, Service and billing); our legitimate interest (security, abuse prevention, internal statistics and improving the Service); compliance with legal obligations; and your consent when we ask for it.
• Your rights: access, rectification, erasure, restriction, portability and objection, and withdrawing your consent at any time. Exercise them as described above; we will reply within one month, extendable in the cases the GDPR allows.
• International transfers: your data is processed in Mexico and the United States. We rely on the European Commission’s standard contractual clauses or the provider’s certification under the EU-U.S. Data Privacy Framework where available.
• Complaints: you may lodge a complaint with the data protection authority of your country.

15. Authority

If you believe your right to the protection of personal data has been violated, you may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno, which took over the former INAI’s functions in this area, or whichever authority replaces it.

16. Changes to this notice

We will publish any change on this page with its new version date. If a change is material (for example, new purposes or transfers), we will notify you by email or in the Service before it applies and, where the law requires, ask for your consent again.