Privacy Policy

This Privacy Policy applies to the RoasterScore website and services. RoasterScore is an independent coffee discovery and rating platform serving users in Morocco, Saudi Arabia, the United Arab Emirates, and other supported markets.

By using the service, you acknowledge the practices described here. Where consent is required by applicable law, we will request it separately.

The information we collect depends on how you use RoasterScore.

• Account data, such as your email address, display name, authentication identifiers, profile details, and account type.
• Review and contribution data, including quantitative coffee scores, selected taste attributes, purchase details, timestamps, and uploaded coffee or receipt photos.
• Roaster and product data submitted by owners or community members, including business contact details, listings, logos, and product images.
• Approximate location and technical data, such as a country inferred from your IP address, language preference, browser and device details, request logs, and security events.
• Messages and support data you choose to send through our contact form.

We use personal data only for defined service, safety, and operational purposes, including to:

• create and secure accounts, authenticate users, and provide owner and reviewer features;
• route visitors to the appropriate country and language experience and display relevant currency and availability;
• publish eligible scorecards, calculate aggregated ratings, and operate coffee discovery features;
• verify uploaded review images, prevent fraud or manipulation, moderate contributions, and handle disputes;
• respond to support, privacy, account deletion, and product information requests;
• measure and improve performance, reliability, accessibility, and user experience; and
• comply with legal obligations and enforce our Terms of Use.

RoasterScore uses an approximate country signal derived from the network request, including infrastructure headers such as cf-ipcountry or x-vercel-ip-country, to select the most relevant regional route. This signal is not precise GPS location data.

For routing, we use the derived country code and store your language preference in a cookie. Our hosting and security providers may process IP addresses in ordinary request and security logs under their own retention practices.

Uploaded review photos are resized and stripped of embedded metadata before storage and verification. They may be assessed by an automated image service, including Cloudflare Workers AI, to check whether they are safe, coffee-related, and show a product label that matches the selected coffee or roaster.

Review proof images are kept in restricted storage. Approved images may be shown on public coffee, roaster, or reviewer pages through controlled links. Pending or rejected images remain non-public unless an administrator approves them. Automated checks can be reviewed by an administrator.

Do not upload faces, identification documents, payment details, addresses, or other unnecessary personal or confidential information.

RoasterScore uses essential cookies for authentication, security, and language preferences. These are necessary to provide requested features.

If Google Analytics is enabled, it may use first-party cookies such as _ga and collect device, browser, approximate location, and interaction data to produce usage statistics. Analytics storage will be subject to user choice where consent is legally required. You can also limit cookies through your browser settings, though doing so may affect site features.

The contact form uses Cloudflare Turnstile to prevent spam and abuse. Turnstile may process network, device, browser, and interaction signals needed to determine whether a request is legitimate.

We use service providers to operate RoasterScore, including Vercel for hosting and edge routing, Supabase for authentication, databases and storage, Cloudflare for image verification and Turnstile anti-abuse checks, Resend for transactional email, and Google Analytics if analytics is enabled. They process data on our instructions or under their applicable service terms.

These providers may process information in countries other than yours. Where required, we use available contractual, organizational, and technical safeguards for international transfers.

We do not sell personal data. We may disclose information when legally required, to protect users or the service, or as part of a business reorganization subject to appropriate safeguards.

We retain data for as long as needed to provide the service, maintain accurate ratings and moderation records, meet legal obligations, resolve disputes, and protect against abuse. Retention varies by data type. Backup or audit copies may remain for a limited period after deletion.

We use access controls, restricted storage, encrypted connections, and other reasonable safeguards. No internet service can guarantee absolute security, so please use a strong, unique password and contact us if you suspect unauthorized access.

Depending on your location and the circumstances, you may have rights to request access, correction, deletion, restriction, objection, or a copy of your personal data, and to withdraw consent where processing relies on consent. We may need to verify your identity before acting on a request.

Relevant frameworks may include Morocco’s Law No. 09-08 and oversight by the CNDP, Saudi Arabia’s Personal Data Protection Law, and the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection. The law that applies depends on the facts of each case; this policy is not legal advice or a claim of certification by a regulator.

Send a request through our contact form. You may also have the right to contact the competent data protection authority in your country.

RoasterScore is not directed to children under the minimum digital-consent age applicable in their country, and we do not knowingly collect their personal data. Contact us if you believe a child has provided data without appropriate authorization.

We may update this policy as the service or legal requirements change. We will revise the date above and provide additional notice when a material change requires it.