BARISTA MATTERS / DOCUMENTS

Personal data
privacy policy.

International version of Barista Matters - baristamatters.com. Updated 3 October 2026.

Your data at a glance

1. Controller and contact

The controller of personal data is Aeroplan Coffee LLC. For questions about processing, access, correction and deletion: privet@baristamatters.ru.

Registered name: OOO AEROPLAN KOFE (Aeroplan Coffee LLC). Taxpayer identification number (INN): 9705207392; tax registration reason code (KPP): 770501001; primary state registration number (OGRN): 1237700600345.

Registered address: 115035, Moscow, Zamoskvorechye municipal district, Sadovnicheskaya Street, 80, premises 18/1, Russia.

2. What data we process and why

This policy applies to website visitors, guests, baristas and users managing a team.

• Sign-in and account security: email, account identifier, service name, session information, IP address and browser. Sign-in uses a one-time code; we do not ask for your email password.
• Guest visit history and preferences: your selected experience option, optional details, barista identifier, date, preferences and changes to them. Without sign-in, feedback is linked to a browser identifier; after sign-in, new feedback is linked to your account. Transferring earlier feedback to an account requires a separate action by you.
• Barista pages and team management: name, description, photo, connection to the profile creator or owner, guest access settings, records of permission to publish the photo and invitations.
• Recognition summary: positive feedback is used to count guests and summarise details available to the barista and the profile creator.
• Responses to enquiries: contact details and information you send us to help resolve your enquiry.

Photos are converted to black and white, resized and stored without the colour original. We do not use facial recognition. Data is not used for advertising, public ratings or automated decisions with legal effects. Personal recommendations are not yet available in this version.

3. Grounds and methods of processing

We process account, profile and feedback data to provide the service you request; security information to protect the service and prevent abuse; and information required to meet applicable legal obligations. Where consent is required, including for publication of a portrait or homepage display, we ask for it separately. This policy describes processing and is not itself your consent.

Processing is mainly automated: collection, recording, organisation, storage, correction, retrieval, use, disclosure within the access described here, restriction and deletion. The controller’s staff may handle enquiries manually.

4. Who has access

Your personal history and preferences are accessible to your account. The barista and profile creator see a summary of positive feedback without guests’ names or individual responses. “Not for me at all” is not shown in this summary.

A barista page starts closed. When guest access is enabled, the name, description and photo become available to anyone with the link or QR code. Guest access can be closed. Uploading a photo requires confirmation of permission to publish it. Showing a name and portrait on the homepage requires separate consent and can be disabled.

Authorised personnel of the controller and infrastructure providers may have technical access when needed to operate the service. Railway hosts the international application, database and portraits. Email and backup providers, including their locations, are listed in the service infrastructure notice below. Your email provider also processes delivery of the sign-in message. The controller is based in Russia, and handling a support request may involve access from Russia.

5. Storage and protection

The primary database and portraits are hosted on Railway in Amsterdam, the Netherlands. Access to personal data is restricted by account and role, and website connections use HTTPS. The service infrastructure notice below describes the configured backups and retention.

Profiles, history and preferences are kept to provide the service until you delete them or the relevant processing purpose ends, unless retention is required by law. A sign-in session lasts up to 30 days and a sign-in code lasts 10 minutes. The guest service cookie lasts up to a year and helps link responses from one browser and limit repeated responses within a day. Deleting the cookie does not delete feedback already submitted.

Deletion in the application does not automatically remove data from backups already made. Contact the controller about deletion from those copies. Backups are used to restore the service, not for routine access to the history of deleted accounts.

6. Your data controls and rights

In Account you can clear your history or delete your data. Feedback left without signing in is identified using the current browser. Deleting a barista profile deletes its photos and associated feedback; profiles handed over to other baristas remain with their owners.

You can request information about the processing of your data, correction, restriction or deletion, and withdraw consent where processing relies on it. Write to privet@baristamatters.ru. To protect your data, the controller may request information needed to confirm ownership of the account or feedback. Depending on the law that applies to you, you may also have rights to object, receive a portable copy of your data and complain to your local data protection authority. We will handle requests within the applicable legal time limits.

7. Changes to this policy

The current version appears on this page with its update date. Significant changes to processing purposes or conditions require a separate review of the grounds for processing and, where necessary, new consent.