Privacy Policy

How the marketplace affects privacy

Each product on Who’s Brew is sold and shipped by an independent roaster. Order information and shipping details are shared with the independent roaster fulfilling the order so they can pack and ship the product. Who’s Brew does not sell customer data to third-party advertisers.

What information is collected

The marketplace collects information from customers, roasters, and visitors as needed to operate the site and process orders.

• Customer account information: name, email address, password (stored hashed), and account preferences
• Order information: items ordered, shipping address, billing address, and order history
• Payment information: processed by Stripe; full card numbers are not stored on Who’s Brew servers
• Customer communications: support messages and order-related correspondence
• Roaster account information: business name, contact details, address, payout details (handled by Stripe Connect), product listings, and fulfillment activity
• Automatically collected data: IP address, browser and device information, referring URLs, and cookies used for session, cart, and analytics

How information is used

Information is used to operate the marketplace, process and deliver orders, and meet legal obligations.

• Process payments and route order details to the roaster fulfilling the order
• Generate shipping labels and provide tracking information
• Communicate order, account, and support updates by email
• Operate marketplace features such as search, recommendations, and product discovery
• Detect fraud, abuse, and security issues
• Improve site performance and user experience
• Comply with legal, tax, and accounting obligations

What is shared with roasters

Order information and shipping details are shared with the independent roaster fulfilling the order. This is required for the roaster to pack and ship the product.

• Customer name as it appears on the order
• Shipping address and any delivery notes
• Items ordered and any product-level options
• Order number and order date
• Customer email address used for order-related communication

Roaster responsibilities

Roasters are responsible for protecting customer information they receive through the marketplace and may only use it to fulfill the order, provide customer support for that order, and meet legal obligations. Roasters may not use customer information for outside marketing or sell it to third parties.

Third-party services

Who’s Brew uses established third-party services to operate the marketplace. Each service has its own privacy policy.

• Stripe and Stripe Connect — payment processing and roaster payouts
• PayPal — alternative payment method
• Shippo — shipping label generation and tracking
• Amazon Web Services — hosting, file storage, email delivery, and address validation
• Google Analytics (Google) — aggregate traffic and site-usage measurement
• Microsoft Clarity (Microsoft) — session replay and heatmaps; Microsoft acts as an independent data controller for this information rather than as a processor acting on Who’s Brew’s behalf

How information is not used

Who’s Brew does not sell customer data to third-party advertisers. Customer information is not rented, traded, or licensed to outside marketing companies.

Cookies and tracking

Who’s Brew uses cookies and similar technologies to operate the marketplace. Cookies fall into a few categories.

• Essential cookies — required for user sessions, account login, the multi-roaster cart, checkout, and order tracking
• Analytics cookies — set by Google Analytics to measure traffic and how the marketplace is used
• Session recording cookies — set by Microsoft Clarity to join the pages of one visit into a single replayable session
• Advertising cookies — set by the Meta Pixel (_fbp, and _fbc when a visit arrives from a Facebook or Instagram ad) to measure which ads lead to purchases; these are set only after the cookie banner is accepted, and never on staff console pages
• Functional cookies — remember preferences such as recently viewed products and saved settings
• Third-party cookies — set by integrated services such as Stripe, Google Analytics, Microsoft Clarity, and Meta; Microsoft documents some of the cookies Clarity relies on, including MUID, as serving advertising, site analytics, and other operational purposes

Analytics and session recording

Who’s Brew uses two third-party services to understand how the marketplace is used and to find parts of the site that are broken or confusing. One of them records how pages are used rather than only which pages are visited, so it is described here in full.

• Google Analytics — measures aggregate traffic: pages viewed, referring sites, approximate location derived from IP address, and device and browser type
• Microsoft Clarity — records session replays and builds heatmaps, capturing pages viewed, clicks, scrolling, and mouse movement so a visit can be replayed as a reconstruction of the pages
• Text typed into form fields is masked before it leaves the browser and is never uploaded to Clarity — Microsoft masks input boxes and drop-down menus in every masking mode, and pages holding personal information, such as address forms and order details, are masked explicitly on this site
• Payment card details are entered in Stripe’s own hosted payment fields, which run in a separate frame that Clarity cannot read, so card numbers are never captured at all
• Microsoft is an independent data controller for Clarity data — that information is shared with Microsoft and handled under the Microsoft Privacy Statement, not processed on Who’s Brew’s behalf
• Microsoft retains Clarity playback data for approximately 30 days, and sessions that are labeled or favorited in the Clarity dashboard for up to approximately 9 months
• Declining in the cookie banner turns off Microsoft Clarity’s session recording, Google Analytics measurement, and the Meta Pixel; the marketplace’s own attribution cookie is gated the same way
• The Meta Pixel is stricter than the rest: it stays off everywhere — including outside the EU/EEA, the UK, and Switzerland — until the cookie banner is accepted
• For visitors in the EU/EEA, the United Kingdom, and Switzerland, analytics and session recording are off by default and are enabled only if consent is given; elsewhere they are on by default and can be turned off at any time by declining in the cookie banner
• Clarity also honors the Global Privacy Control signal, and Google Analytics can additionally be blocked through browser settings or Google’s opt-out browser add-on

Managing cookies

Users can manage or disable cookies through browser settings. Disabling certain cookies may affect checkout and account functionality.

Data security

Who’s Brew uses technical and organizational measures to protect personal information, including encryption in transit, access controls on internal systems, and secure handling of payment data through compliant payment processors. No system is fully immune to risk; account holders are responsible for protecting their login credentials.

Data retention

Information is retained only as long as necessary to operate the marketplace, support customers and roasters, and meet legal, tax, and accounting obligations. Account information may be retained while an account is active and for a reasonable period after closure.

User rights

Depending on location, customers and roasters may have rights regarding their personal information.

One limit applies to the session recording data described under Analytics and session recording. Microsoft Clarity offers no way to delete a single person’s data — Microsoft’s documented method for erasing data from a Clarity project is deleting the entire project — so a deletion request cannot be carried out for one individual inside Clarity. That data instead expires on the retention schedule described above. Deletion requests covering information held by Who’s Brew are handled as set out below.

• Access the personal information held about them
• Request correction of inaccurate information
• Request deletion of personal information, subject to legal and accounting requirements
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent
• Lodge a complaint with a relevant supervisory authority

Children’s privacy

Who’s Brew is not intended for use by children under 13, and accounts are not knowingly created for children. If information is collected from a child without parental consent, it will be deleted on request.

Changes to this policy

This policy may be updated to reflect changes in services, legal requirements, or marketplace operations. Material changes will be reflected in the last updated date at the top of this page.

Contact information

Questions about this privacy policy or a request related to personal information can be sent to Support@WhosBrewShop.com.