Privacy policy

Who processes your data

The data controller is RASEMAEG, S.L., tax ID ESB01882745, registered at Calle Cristóbal de Moura, 229, 1-4, 08019 Barcelona, España, owner of mycoffee.guide.

For anything about your data, write to hello@mycoffee.guide.

What we collect and why

We only ask for what each thing needs. You can browse the map, the listings, the city guides and the blog without an account and without giving us anything.

• Account: your email address and, if you sign in with Google, the name and picture Google shares with us. If you sign in by phone, your number. It identifies you and keeps your session.
• Name and city: we ask the first time you sign in, to greet you and to know where the guide is being used from.
• Favourites and lists: the coffee shops you save and the lists you create, linked to your account.
• Event sign-ups: name, email and — if the organiser asks for them — phone, party size or a message. We pass them to the coffee shop running the event, who is the one expecting you.
• Job applications: name, email and whatever the listing asks for (phone, CV, LinkedIn, portfolio or cover letter). We pass them to whoever posted the job.
• Business accounts: your venue's contact details, the documents you use to prove you run it, and the history of changes you request.
• Payments: paid plans are charged through Stripe. We store the customer reference, the subscription status and your billing details, but we never see or store your card number.
• Barista profiles: the public part — display name, city and travel radius, rate, skills, languages, experience, bio and photos — is shown once we verify the profile. The tax part — legal name, tax ID (NIF) or VAT number, country of tax residence, address, date of birth, IRPF withholding and whether you charge VAT — is never public. We also keep your mobile number for SMS notifications, if you give it to us, and your availability, shifts, disputes, reviews, invoices and payouts. We use this to publish your profile, manage shifts, issue your invoices, pay you and meet our obligations to the tax authorities.
• Coffee shops that book shifts: the business's tax details (registered name, tax ID and address), the notification mobile number for each shift, and the history of bookings, payments, disputes and reviews.
• Suggestions and contact forms: what you write to us and the address you write from.
• Site usage: we count views of a listing and clicks on its website, phone, directions, the events and job posts it publishes, and external event or job links. These are aggregate figures with no name and no IP address attached.

On what legal basis

• Performance of a contract: your account, sign-ups, applications, running your venue's listing and charging for paid plans.
• Consent: the emails you agree to receive and the optional details you choose to add to your profile or listing. You can withdraw it at any time.
• Legitimate interest: keeping the platform secure, preventing fraudulent claims, and understanding which parts of the guide get used — always with aggregate data.
• Legal obligation: keeping invoices and tax records for the periods the law requires, issuing shift invoices, keeping their invoicing records (Verifactu) and reporting to the Spanish tax authorities what baristas earn (DAC7, modelo 238).
• Shifts: managing them, charging for them, paying them out and issuing their invoices is performance of a contract. Verifying baristas, preventing fraud and detecting relationships of dependency between a barista and a coffee shop is legitimate interest, always with human review.

Who we share it with

We do not sell personal data and we do not hand it over for third-party advertising. We work with providers who process it on our behalf, solely to run the service:

• Supabase: database, accounts and files. Servers in Frankfurt (European Union).
• Vercel: hosting and delivery of the site.
• Stripe: charging for paid plans, featured listings and shifts, and baristas' identity verification and payout accounts (Stripe Connect). Bank details are stored by Stripe, not by us.
• Resend: service emails (sign-in links, sign-up and application notifications).
• Twilio: the verification code when you sign in or verify your venue by SMS, and SMS notifications about shifts.
• Google Maps Platform: public venue data (address, opening hours, rating and photos) and the place search used when adding a coffee shop.
• Mapbox: the maps you see on the site.
• Google Analytics and Google Tag Manager: measuring how the guide is used and which campaigns bring people here. Loaded only if you accept measurement or advertising cookies.
• Shopify: the shop and its orders, completed on its own domain.
• The other party to a shift: the coffee shop sees the barista's public profile, and their legal name and tax ID on the invoice; the barista sees the venue's details, and its registered name on the invoice. Neither sees more of the other's tax details than the invoice requires.
• Spanish Tax Agency (Agencia Tributaria): the DAC7 return and, where the law requires it, the invoicing records for shift invoices.
• European Commission (VIES): checking the VAT number of coffee shops outside Spain.
• Anthropic: machine translation of descriptions and of event and job texts into the guide's seven languages. It receives the text being published, not account data.

Where it is stored

The database and files are in the European Union (Frankfurt). Some of the providers above are US companies and may process data outside the European Economic Area; those transfers rely on the European Commission's standard contractual clauses and the EU–US Data Privacy Framework.

How long we keep it

• For as long as your account is open. If you delete it, we erase your personal data except what we must keep by law.
• Sign-ups and applications stay available to the venue that received them for as long as they are useful; you can ask us to delete them.
• Invoices and tax records, for the years accounting and tax rules require. This includes the invoices we issue on behalf of baristas and the data we report under DAC7, even if the account is deleted.
• Shift reviews are deleted along with the account of whoever receives them or whoever wrote them.
• Usage figures, always aggregated and without identifying you.

Your rights

You can ask us to access, correct, erase, restrict or object to the processing of your data, and to port it elsewhere. Write to hello@mycoffee.guide and we will reply within one month.

From your account you can edit your details and delete it entirely without asking us. If you think we have got something wrong, you can complain to the Spanish Data Protection Agency (aepd.es).

Automated decisions

We do not make automated decisions about baristas or coffee shops. Verifying a profile, suspending it, withholding a payout and resolving a dispute are decided by a person on our team. Shift search results are sorted by date and time, and reviews have no automatic effect.

Children

The guide is not aimed at children under 14 and we do not knowingly create accounts for them. If we find one, we delete it.

Changes to this policy

If we change something material we will publish it here and update the review date. If a change affects you significantly, we will tell you by email.