Privacy Policy

Barista Gigs (“we”, “us”) operates a marketplace that connects specialty cafés with freelance baristas for one-off shifts. This policy explains what personal data we collect, why, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR), which is the strictest regime we operate under; where your local law grants you additional rights, those apply too.

Data controller: Barista Gigs [operator legal name and address — to be completed]. Contact: privacy@baristagigs.dev.

• Account data — email address, display name, account type (café or barista), and your chosen city. Legal basis: performance of a contract.
• Profile data you choose to share — for baristas: bio, skills, years of experience, rates, availability, portfolio photos, signature drink, Instagram handle, and a profile photo. For cafés: café name, address, description, machines, website, and phone number. This data is visible to other users in your city as part of how the marketplace works. Legal basis: performance of a contract.
• Barista payment details — a free-text field (e.g. IBAN, payment link) you may fill in so cafés can pay you. It is stored separately from your public profile and disclosed only to cafés that have accepted you for a gig. We never use it ourselves. Legal basis: performance of a contract.
• Activity data — gigs you post or apply to, applications and their outcomes, recommendations, messages between matched cafés and baristas, and in-app notifications. Legal basis: performance of a contract.
• Café billing data — subscription status and billing identifiers. Card details are collected and processed by Stripe; we never see your full card number. Legal basis: performance of a contract and legal obligations (accounting).
• Technical data— the session cookies needed to keep you logged in, and a temporary referral cookie if you arrive via a café’s referral link. Legal basis: legitimate interest in operating a secure service.

• We don't sell your personal data, and we don't share it with advertisers.
• We don't run third-party analytics, advertising trackers, or social media pixels.
• We don't make automated decisions with legal or similarly significant effects about you.
• We don't process wages or hold money between cafés and baristas.

We use a small number of processors to run the service:

• Supabase — database, authentication, and file storage (portfolio and profile images).
• Stripe — café subscription payments.
• Resend — sends account and notification emails on our behalf.
• OpenStreetMap / Nominatim — we send café addresses (never personal names) to the Nominatim geocoding service to place cafés on a map, and map tiles are loaded from OpenStreetMap when you use the map view.
• Our hosting provider — serves the application and receives the technical request data (such as IP addresses) inherent in serving any website.

Where these providers process data outside the EU/EEA, transfers are covered by the providers’ Standard Contractual Clauses or an adequacy decision.

We only use cookies that are necessary for the service to function: authentication session cookies, and a referral cookie (30 days) if you open a café’s invite link, used solely to credit that café when you sign up. We do not use advertising or analytics cookies, which is why you don’t see a cookie banner.

Your data is kept while your account exists. If you delete your account, your profile, applications, messages, notifications, and payment details are deleted with it. Billing records are kept as long as tax and accounting law requires. Backup copies expire on a rolling basis within a reasonable period.

Depending on where you live, you have the right to access, correct, export, restrict, or delete your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time where processing is based on consent. You can edit most of your data directly in the app; for anything else, email privacy@baristagigs.dev. If you are in the EU/EEA you can also lodge a complaint with your local supervisory authority.

If we change this policy in a way that matters, we’ll notify you in the app before the change takes effect. See also our Terms of Service and Disclaimers.