Privacy notice.

Who we are

HEFT is a UK coffee brand that hasn't launched yet. The data controller is Will, HEFT's founder. You can reach us at hello@heftcoffee.co. Our ICO registration number will be added here once it's issued.

What we collect when you join a list

• Your email address.
• Which list you joined (coffee, matcha or decaf), when, and your place on it.
• Where you joined from: the page, and any campaign or referral tag in the link you followed.
• Your referral code, and who referred you, if anyone.
• Your answers to the optional questions on your founding page.
• A scrambled version of your IP address. It's a one-way code that changes every day, used only to stop spam and abuse. We can't turn it back into your IP address.
• When you confirmed your email, and which version of our consent wording you saw.

What we do with it, and why we're allowed to

• We email you about HEFT: the launch, the build log and your founding offer if you joined the coffee list, or news about matcha or decaf if you voted for them. Our lawful basis is your consent, and you can withdraw it any time with the unsubscribe link or by emailing us.
• We run the founding list: your number, your personal link and any referral reward. Lawful basis: your consent, and our legitimate interest in running the list fairly.
• We stop spam and abuse with rate limits and duplicate checks. Lawful basis: legitimate interests.
• We look at answers and votes in total, never person by person, to decide what to make and who it's for. Lawful basis: legitimate interests.
• We don't sell your data, share it with advertisers or use it to build a profile of you.

Who else handles it

• Cloudflare, which hosts this site and the database the list lives in, and helps keep out bots. Cloudflare may process data outside the UK, including in the US, under safeguards approved for UK data transfers.
• MailerLite, which sends our emails, once it's connected. MailerLite is based in the EU.

That's everyone. If that changes, this page changes first.

Cookies and tracking

This site doesn't set cookies for tracking or advertising, and doesn't store anything in your browser. We count visits with Cloudflare Web Analytics, which doesn't use cookies and doesn't identify you. If the link you followed carried a referral or campaign tag, we keep it in the page address while you browse and send it with your sign-up. Cloudflare may set a strictly necessary security cookie if it needs to check you're not a bot.

How long we keep it

Until you unsubscribe or ask us to delete it. If we've emailed you a confirmation link and you don't use it within 30 days, we delete your details. Scrambled IP codes are removed after 30 days. If HEFT never launches, we'll tell you and delete the list.

Your rights

You can ask for a copy of your data, ask us to correct it or delete it, object to how we use it, or ask us to limit it. Email hello@heftcoffee.co and we'll reply within a month. Joining with an email address that's already on the list shows that address's place and link, and our rate limits exist to stop anyone checking addresses in bulk.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

HEFT isn't for children. The founding list is for people aged 18 and over.

Changes

If we change how we use your data, we'll update this page, and if it matters, we'll email you first.