Coffee-Note — independent publisher
Email: contact@coffee-note.fr

Coffee-Note collects only the data necessary to run the service:

• Email address — for magic-link sign-in or via Google OAuth
• Google profile information — name, email address, profile photo (only if signing in with Google)
• Tasting data — notes, places, dates, photos, aromas and appraisals entered voluntarily by the user
• Session data — authentication token stored in a secure cookie (httpOnly)

No browsing data, advertising or commercial profiling is collected.

• Authentication and secure access to the account
• Storage and display of your personal tastings
• Sending sign-in links by email (magic link)

Legal basis: performance of the contract (Article 6(1)(b) GDPR) for the data necessary to run the service, and consent (Article 6(1)(a)) for signing in with Google.

Your data is shared with the following processors solely within the scope of the service:

SCC = Standard Contractual Clauses approved by the European Commission, ensuring an adequate level of protection.

• Account data — kept until the account is deleted
• Tasting data — kept until the account or the entry is deleted
• Sign-in logs — 30 days (managed by Supabase)

Under the GDPR, you have the following rights:

• Right of access — obtain a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your account and all your data
• Right to portability — receive your data in a structured format
• Right to object — object to certain processing
• Right to withdraw consent — at any time, without retroactive effect

To exercise these rights, contact us at: contact@coffee-note.fr

You also have the right to lodge a complaint with the competent supervisory authority. As the publisher is established in Spain, the competent authority is the AEPD (Agencia Española de Protección de Datos): aepd.es — C/ Jorge Juan, 6, 28001 Madrid. Users established in another EU Member State may also contact the supervisory authority of their country of residence.

Coffee-Note uses only strictly necessary cookies to run the service:

• Supabase session cookie — keeps you authenticated (duration: session)

No advertising, analytics or third-party tracking cookies are used. As they are strictly necessary to run the service, they do not require prior consent under the ePrivacy Directive and the AEPD guidelines.

Your data is protected by:

• HTTPS encryption on all exchanges
• Passwordless authentication (magic link), reducing the risk of compromise
• Row Level Security (RLS) on Supabase — each user accesses only their own data
• Signed, time-limited JWT tokens