Privacy.

• To fulfil your order: your name, email, phone number, billing and delivery addresses, what you ordered and, where you give them, the vessel and VAT number needed to invoice you correctly. We cannot ship or invoice without these.
• To take payment: Stripe processes your card. We receive confirmation that a payment succeeded and a reference; we never receive or store your card number.
• To meet our legal obligations: invoices and the accounting records behind them, which French law requires us to keep for ten years.
• To email you about coffee: only if you asked us to. Every marketing email carries a one-click unsubscribe link that works immediately.

Only the processors we need to run the business: Stripe (payments), our carriers (delivery; they receive your name and the delivery address), Supabase and Railway (hosting, within the EU), and our email provider. We never sell or rent your data to anyone.

Our accountants receive invoice data as part of filing our returns.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it, though we cannot delete an invoice we are legally required to keep. You can withdraw consent to marketing at any time. Email info@onshoreroasters.com and we will answer within a month. If you are not satisfied, you may complain to the CNIL, the French data protection authority.

Some cookies are strictly necessary and need no consent: one remembers the language you choose, one remembers your cookie choice for six months, and your cart is kept in your own browser's local storage so it survives a refresh.

• Analytics (only if you accept): Google Analytics, operated by Google, measures which pages are visited and how the site performs.
• Advertising (only if you accept): Google Ads and Meta (Facebook and Instagram) measure which adverts lead to an order and show relevant adverts. If you accept, and you then place an order, we also tell Meta about that order from our server (a hashed email address, phone number and country, the order value, and the click identifier from the advert), and we keep the advert click identifiers with the order.
• Campaign links: if you arrive through a link carrying utm_ parameters, we remember them for the visit so that our own order records say where an order came from. They describe our campaign, not you, and are not shared with anyone.

No analytics or advertising script is loaded until you choose. "Reject all" is as easy as "Accept all". Your choice lasts six months, and you can change it at any time with Cookie settings in the page footer. Withdrawing consent deletes the cookies those services set. See Google's and Meta's own privacy policies for how they use data.