Privacy

Demo Roasters is a portfolio demo run by Cam, who decides what it stores (the data controller). It is not a business and sells nothing. This page explains what it stores about you, why, and for how long. If anything here is unclear, email tarnfield.studio@gmail.com.

In your own browser

These stay on your device and are not sent to us, except your basket when you press Checkout.

• Theme (“theme”): light or dark, if you switch.
• Basket (“basket”): what you have added, until you check out or remove it.
• Checkout reference (“checkout-reference”): the reference of your latest test checkout, so the basket can empty itself once that order is paid.
• Sign-in cookie: one strictly necessary cookie keeps you signed in for up to 7 days. It is not used for anything else.

There is no advertising, no analytics and no tracking cookie, so there is no cookie banner.

On our servers

• Your account, if you make one: your first name, your email address (any address works; we never email you), a scrambled (hashed) form of your password, and your sign-in sessions. No IP address and no browser details are kept with your account. Accounts are deleted automatically on or just after day 30, or straight away if you delete yours from your account page.
• Test orders: what was ordered, the grind, the prices and when. An order is linked to your account while the account exists; when the account is deleted, the order stays without any link to you. Unfinished checkouts are deleted after 30 days and paid test orders after 365 days.
• Search: each search records how many results it returned, how long it took and which part of the search ran. Never the words you typed, and nothing that identifies you. These records are deleted after 90 days.
• Limits against abuse: a scrambled (hashed) form of your connection address, counted for up to a day so one visitor cannot overload the demo by searching, signing in, signing up or checking out again and again. Old counts are deleted every night.
• Request logs kept by our host, Vercel, such as your IP address and the address of the page you asked for (which includes any search words, because they are part of the search page’s address). They are kept for a short time under Vercel’s own rules so the site can run and be protected from abuse. We do not use them to follow you.
• Backups: our database provider keeps a short restore history, so deleted data can remain there for a limited time before it is gone for good.

Test payments

Checkout runs on Stripe’s own page in test mode. We send Stripe the items, the prices, the order reference and a made-up email address (demo-customer@example.com), never yours. Only Stripe’s published test card numbers work: never enter a real card. On its page Stripe collects what you type there (such as a name and postcode) and device details it uses against fraud, under its own privacy notice at stripe.com/gb/privacy. We keep only whether the test payment went through.

Why we may use it

Our lawful basis is legitimate interests: running a working demo shop that people can try, and keeping it secure and free of abuse. We keep only what that needs, for the times above. You can object to this at any time by emailing us; the simplest way to stop it is to delete your account and clear this site’s storage in your browser.

Who helps run the demo

• Vercel Inc. hosts the website; the site’s server code runs in London.
• Neon Inc. hosts the database in London.
• Stripe Payments Europe Ltd handles test payments; no real money moves.

Vercel and Neon are US companies, so your data may be reached from the United States, under the transfer safeguards in their data processing terms.

Your rights

You can ask to see, correct or delete anything stored about you, or object to its use, by emailing tarnfield.studio@gmail.com. If you are unhappy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk.