Legal

Privacy notice

Last updated 31 October 2026. This is a demonstration notice and is not legal advice — have it reviewed before launch.

What we collect

When you submit the survey we store, once per roastery, your roasting location, local currency, annual purchasing-volume band and primary purchasing method. For each coffee you report we store which of the benchmarked coffees it is (from which the origin, region and grade are derived), its coffee type, processing method and cupping band; the purchase date, how the coffee was priced, the C-market contract month where applicable, the price, the currency, the unit and its size in kilograms; the pricing basis (fixed as ex-seller's-warehouse at origin); the quantity band and lot structure; any optional commercial details you choose to give; and any notes. We also record the exchange rate and the implied C-market differential as of the recorded purchase date — not the date of submission. Your account stores your email, a securely hashed password and, optionally, a company name.

How we use it

Individual submissions are used to compute the aggregate benchmark and are never published with your identity attached. We publish only aggregates grouped by origin, processing, coffee type and pricing basis — and only where enough responses exist to prevent any single contributor from being identified.

Exchange rates and privacy signals

To convert your price to US dollars and value its implied C-market differential, we call third-party market-data services (an exchange-rate provider and a futures-price provider). We send those services only a request for rates or prices — no information about you, your price or your submission leaves our systems in that call. We store a one-way HMAC hash of your IP address for abuse prevention; the hash cannot be reversed to recover the address.

Legal basis and retention

We process your data on the basis of your consent, which you give explicitly when you tick the consent box before submitting. Survey responses are retained to support the benchmark; your account data is retained while your account is open.

Your rights

You can request a copy of your data, its correction, or its deletion by emailing hello@roasterbenchmark.example. Deleting your account removes your account details and unlinks your individual submissions from you.

Security

Passwords are hashed with scrypt and a per-user salt. Sessions use HttpOnly, SameSite cookies; all state-changing requests require a CSRF token; and responses carry a strict Content-Security-Policy. We do not sell your data.