Privacy Policy

1. Who is responsible for your data

Hockey Ye, an individual operator based in mainland China trading as Beanloom, is responsible for personal information processed by www.beanloom.app. Contact hockeyye2003@gmail.com for privacy questions or to exercise your rights. We have not appointed a separate data protection officer.

This policy covers the website, accounts, Coffee Profiles, Cards and generation service. It explains our processing; it is not a blanket request for consent. Where consent is required, we must obtain it separately. The service is also governed by our Terms of Service.

2. Information we collect

• Account data: email address, account identifier, authentication and account status. We use email verification codes rather than a Beanloom password; authentication is provided by Supabase.
• Creative content: coffee names, origin, processing, varieties, flavor notes and other facts you enter; reusable Coffee Profiles; Card snapshots, display settings, titles, generated images and associated job and asset records. Avoid submitting personal or sensitive information in coffee fields.
• Credit and transaction records: grants, reservations, consumption and adjustments. When purchases become available, we receive the transaction references, amounts, currency, payment status and information needed to fulfill orders, refunds and disputes. We do not store full payment card numbers or security codes.
• Support records: your emails, reports, privacy requests and information you choose to include when contacting us.
• Technical and security data: IP addresses processed for network delivery and abuse prevention, session identifiers, request times, error codes, job status and operational logs. Hosting and security providers may process browser, device and network information. Distributed rate-limit records use hashed identifiers. Vercel Web Analytics separately records page views and aggregate reporting dimensions for selected public routes; query strings and fragments are removed, and private Workspace and Card routes are excluded.
• Product events: a limited list of actions such as visits, generation, sign-in, downloads and contact clicks, with event times and, where available, account, browser-session, Card, job or request identifiers. We also record the first page path in a tab session, a broad acquisition category, the referring website’s host name, and sanitized campaign source, medium and campaign tags when present. We do not store the full referrer URL, its path or search query as event attribution. These records can be linked to an account; they are not all anonymous. Product event payloads exclude email addresses, coffee facts, prompts and generated image URLs.

Guest Flavor Gradient input and image data are processed to return a preview, without saving that draft or image to our application database or image storage. They remain in browser memory and are lost on refresh or closure. If you sign in and save the current draft, it becomes account content. Separate guest session and limited operational/event records may remain.

3. Why we use information

We use account and content data to authenticate you, save your work, generate and deliver images and provide support. Credit and transaction data fulfill purchases, reconcile generation costs, process refunds and maintain records. Technical data helps secure the service, prevent fraud, troubleshoot failures and maintain availability. Limited product events help us understand feature usage and improve the service.

Where the GDPR or similar rules apply, our bases are performance of your requested service or contract; legitimate interests in proportionate service security, support and improvement where permitted; and applicable legal obligations for required records and lawful requests. Where local law requires consent, including for particular tracking or cross-border processing, we rely on consent only after obtaining it. You may object to processing based on legitimate interests.

Beanloom does not use your coffee facts or generated cards to train its own AI models. Information sent to an external AI provider is also subject to that provider’s processing terms; this is not a promise about every provider’s model training practices. We do not currently send promotional campaigns; service emails such as verification codes and replies to your requests are necessary communications.

4. Cookies and product analytics

First-party cookies beanloom_access_token and beanloom_refresh_token maintain account sessions and are configured with a 7-day browser lifetime. The signed beanloom_guest_session cookie supports guest request limits, normally for 24 hours. Authentication cookies are HTTP-only and use secure transport in production. Signing out clears account cookies; browser settings let you remove or block cookies, but blocking essential cookies may prevent sign-in or generation.

Acquisition attribution uses a random first-party browser-session identifier held in sessionStorage for the current tab session. It is not a persistent cookie or a third-party advertising tracker. Closing the tab normally ends that browser session, subject to browser session-restoration behavior.

We store limited product events in Supabase. Separately, Vercel Web Analytics records page views on selected public routes and aggregate dimensions such as referrer, country, browser and operating system. We strip query strings and fragments, exclude private Workspace and Card routes, and do not send custom product events to Vercel. Vercel says Web Analytics does not use cookies and uses a request-derived visitor hash that resets daily and cannot link visitors across days or websites. See Vercel Web Analytics documentation. The first-party product-event system does not have a separate analytics opt-out switch at present. You can contact us to object to processing or request deletion of identifiable product-event records, subject to applicable exceptions. We do not use advertising pixels or sell data for targeted advertising.

Cloudflare Turnstile is used for email verification abuse protection and may process browser and network signals when loaded. Read Cloudflare’s Privacy Policy for its processing.

5. Third-party sharing and disclosure

We do not sell your personal information or share it for cross-context behavioral advertising. We share information necessary for the following services:

• Vercel: website hosting, server processing, operational logs and aggregate Web Analytics page-view metrics for selected public routes. Query strings and fragments are removed from page-view URLs, and private Workspace and Card routes are excluded. See Vercel’s Privacy Policy.
• Supabase: email authentication, account and application database records, product events and private image storage. See Supabase’s Privacy Policy.
• Cloudflare Turnstile: network and device signals for anti-abuse verification, as described above.
• Kie.ai and its underlying AI service providers: generation prompts compiled from relevant coffee facts and design settings for Flavor Monster and Mono Color, task references and generated images. The configured image model is GPT Image 2 (gpt-image-2-text-to-image). We do not intentionally include your login email or payment card data in generation prompts. Flavor Gradient does not use this AI service. See Kie.ai’s Privacy Policy.
• Waffo Pancake, when checkout is enabled: payment and fraud-prevention information needed for a purchase. As Merchant of Record, the seller identified at checkout handles card information, receipts, tax and transaction compliance under its own notices. Beanloom receives the records necessary for Credit delivery, reconciliation and support.
• Email service providers: delivery of verification messages through our authentication service and processing of support correspondence sent to our Gmail contact address. See Google’s Privacy Policy for Gmail.

We may disclose relevant records in response to a lawful request, to protect rights or investigate fraud, or with your specific authorization. In a business transfer, information may be transferred with continuing privacy obligations and notice where required. Saved user Cards are private account content; we do not automatically publish them to a public community gallery.

6. Storage and security

Account data, coffee records and generation metadata are held in Supabase’s hosted database. Saved image files are kept in private object storage. We use HTTPS, database row-level access controls, server-side authorization and time-limited image download links. Privileged credentials stay on the server, and operational logging filters sensitive fields such as emails, prompts, tokens and signed image URLs.

Access is limited to the operator and providers that need it for service delivery, support, security or legal duties. No system can eliminate all risks; protect your mailbox and avoid sharing authenticated links. If a personal data breach occurs, we investigate, contain it and make notices required by applicable law. Where GDPR’s notification requirement applies, we notify the supervisory authority within 72 hours of awareness where feasible and affected individuals without undue delay when legally required.

7. Retention and deletion

Account data and saved content remain while your account is open so you can return to your work. Guest drafts and previews are not persisted in application storage. Replaced image assets have a 24-hour recovery window before they become eligible for cleanup; active jobs, reconciliation, legal holds or cleanup failures can delay removal.

The Card delete action hides a Card from Workspace; it does not immediately erase related generation, asset and Credit audit records. For permanent content erasure or account closure, email hockeyye2003@gmail.com. We aim to complete verified requests within 30 calendar days, explaining any lawful exception or permitted extension. Deletion is handled by the operator; there is no self-service account erasure feature.

Generation audit records, Credit ledgers and identifiable product events currently have no automatic age-based purge. You can request deletion of records that are no longer needed. We may retain the minimum records required for unresolved jobs, security incidents, refunds, disputes or legal obligations, and will explain such retention when handling your request. We do not describe these records as anonymous simply because direct identifiers are absent.

Provider-managed logs, backups and payment records follow the providers’ retention schedules and applicable legal obligations. Removing live application data may not immediately remove backup copies. Where retained for recovery, data must remain protected and should not be restored to ordinary use after an erasure request without reapplying that request.

8. Your data rights

Depending on the laws that apply to you, you may request information about processing, access or a copy of personal data, correction, erasure, restriction, a portable machine-readable copy, or object to certain processing. You may withdraw consent where consent is the basis, without affecting prior lawful processing. You may also challenge decisions and ask for human review where legally applicable.

Edit available Coffee Profile and Card fields in the product, or email hockeyye2003@gmail.com from your account address with the subject “Privacy request”. For account closure use “Delete my account”. Describe what you want us to do. We verify identity proportionately and will not ask for a payment card security code or login code. We aim to respond within 30 calendar days, or a shorter period required by law, and explain any refusal or lawful extension.

For California residents, applicable rights may include knowing, accessing, correcting and deleting personal information, and opting out of its sale or sharing. We do not sell or share it for behavioral advertising. You may use an authorized agent subject to verification. We do not discriminate against you for exercising privacy rights. You can complain to the data protection authority or regulator with jurisdiction over your situation.

9. International processing

The operator is in mainland China; hosting, authentication, AI, security, email and future payment services use international infrastructure. Your data may be processed outside your country of residence and may be accessed by the operator in mainland China. Provider locations depend on the service and deployed infrastructure.

International transfers must meet applicable legal requirements, including legally required consent or a valid transfer safeguard such as standard contractual clauses where applicable. This policy does not itself create such a safeguard or replace any required authorization. Contact us for information about processing locations and safeguards applicable to your data.

10. Age limits and external services

Beanloom is intended for people aged 18 or older. We do not knowingly collect children’s personal information. If a child has provided data, contact us so we can investigate and remove it where required.

External links and independently operated checkout services have their own privacy notices. This policy describes Beanloom’s processing; review the relevant provider notice before providing information directly to an external service.

11. Updates and contact

We will announce material changes on the website or by email at least 15 days before they take effect, except where urgent legal or security requirements require earlier action. The date above identifies this version. Any new processing requiring consent will be subject to a separate consent request.

For privacy, deletion, support or security matters, contact Hockey Ye at hockeyye2003@gmail.com. Please include only the information needed to handle your request.