Privacy Policy

Roast & Recover LLC operates roastandrecover.com. We are a US limited liability company. When we say "we," "us," or "our," we mean Roast & Recover LLC. Contact us at ritual@roastandrecover.com.

We collect the following categories of data:

Data you provide directly:

• Name, email address, and password (via Clerk authentication)
• Shipping address(es) and billing information
• Company name (if provided)
• Messages sent via contact forms or email
• Reviews and ratings submitted on product pages

Data collected automatically:

• Browser type, operating system, IP address (via standard server logs)
• Pages visited, time spent, referral source
• Authentication events (login, logout, session tokens) via Clerk

Data from third-party services:

• Payment method information — we do not store your credit card number. Payment data is handled entirely by Stripe and subject to Stripe's Privacy Policy.
• Order history and transaction records from Stripe

• Fulfilling orders — processing payments, communicating order status, coordinating shipping, and providing after-sales support
• Account management — authenticating your account, storing your order history and equipment registry
• Communication — sending transactional emails (order confirmation, shipping updates, balance payment requests) via Resend
• Service improvement — analyzing usage patterns to improve the Platform
• Legal compliance — retaining records as required by applicable law

We do not use your data for advertising targeting. We do not sell your data to third parties. We do not send marketing emails without your explicit opt-in.

Your account and order data is stored in a PostgreSQL database hosted by Neon (neon.tech), with servers located in the United States. Neon complies with SOC 2 Type II standards.

Authentication data is managed by Clerk (clerk.com), a US-based authentication service. Clerk is SOC 2 Type II certified.

Product images are stored via Uploadthing, with servers in the United States.

Transactional emails are sent via Resend (resend.com), a US-based email service.

We share data with the following third parties only to the extent necessary to operate the Platform:

• Stripe — payment processing. Stripe receives your payment card information, billing address, and order amount.
• Clerk — authentication. Clerk stores your email and authentication credentials.
• Resend — transactional email delivery. Resend receives your email address and the content of transactional emails we send to you.
• Neon — database hosting. Neon hosts your stored account and order data.
• Uploadthing — file storage. Used for product images (not personal data).

We do not share your data with any other third parties, including our manufacturing partners in China. Order information shared with manufacturing partners is limited to product specifications and shipping destination — no personal financial data is shared.

We retain your account data for as long as your account is active. Order records are retained for 7 years for accounting and legal compliance purposes. If you close your account, we will delete your personal profile data within 30 days, while retaining order records as required by law.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and personal data (subject to legal retention obligations)
• Portability — request your data in a machine-readable format
• Objection — object to certain processing of your data

To exercise any of these rights, contact us at ritual@roastandrecover.com. We will respond within 30 days.

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your data is:

• Contract performance — processing necessary to fulfill your order
• Legal obligation — processing required by law (e.g., tax records)
• Legitimate interests — fraud prevention, security, service improvement

If you have a GDPR complaint, you have the right to lodge a complaint with your local data protection authority.

We use only essential cookies necessary to operate the Platform (authentication session tokens). We do not use advertising, analytics, or tracking cookies. No consent banner is required for essential cookies under applicable law.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. Continued use of the Platform after changes constitutes acceptance of the updated policy.