Privacy policy.

01 — Who we are

Arhetyp Coffee SRL ("Arhetyp", "we", "us") is the controller of personal data processed through arhetyp.ro and any related order, support, or newsletter activity.

Registered address: Strada Lipscani 12, 030031 București, România.
Tax/VAT: RO00000000 (pending registration — replace after activation).
Contact: contact@arhetyp.ro.

02 — What we collect

We collect the minimum personal data needed to deliver coffee and run an online shop:

• Account & order data: name, email, shipping address, billing address, phone (if provided), order history.
• Payment data: handled directly by Stripe — we never see your full card number. We store only the last 4 digits and the brand for receipt purposes.
• Customer communications: emails and chat messages you send us, and our responses.
• Newsletter: if you opt in, your email and the locale you subscribed from.
• Cookies and analytics: see Section 06 below.
• B2B accounts: company name, VAT number, contact details of authorised buyers, internal price-list tier.

03 — Why we collect it (legal bases)

• Performance of contract (GDPR Art. 6(1)(b)): we use your data to fulfil orders, ship products, and handle returns or refunds.
• Legal obligation (Art. 6(1)(c)): we keep invoices and tax records for the period required by Romanian and EU law (typically 10 years for fiscal documents).
• Legitimate interest (Art. 6(1)(f)): fraud prevention, network security, internal record-keeping.
• Consent (Art. 6(1)(a)): newsletter sign-ups, optional analytics and advertising cookies.

04 — Who has access

Your data is processed by a small number of carefully selected service providers, each bound by GDPR-compliant data-processing agreements:

• Stripe (Ireland): payment processing.
• Vercel (USA, EU data residency for our project): hosting the storefront.
• Google Cloud (europe-west1, Belgium): hosting the order backend and database (Cloud Run + Cloud SQL).
• Resend (Ireland): transactional email delivery (order confirmations, shipping notices).
• DPD / GLS / national couriers: shipping and delivery.
• Anthropic (USA): generation of editorial product descriptions and translations — we do not pass customer data to Anthropic.

We never sell your data to third parties.

05 — How long we keep it

• Order & invoice data: 10 years (Romanian fiscal law).
• Account data: for the lifetime of your account + 12 months after deletion, unless legally required to keep longer.
• Newsletter: until you unsubscribe (link at the bottom of every email).
• Support emails: 3 years from last contact.
• Cookies: see Section 06.

06 — Cookies & analytics

We use two layers of cookies:

• Strictly necessary cookies (cart, locale, checkout session, consent choice). These cannot be disabled. They expire when you close the browser or after 365 days at most.
• Analytics and advertising cookies (Google Analytics 4, Plausible, Meta Pixel, Google Ads). These only fire after you click "Accept all" on the cookie banner. You can change your choice anytime from the footer.

Plausible is cookieless and GDPR-exempt under Recital 26 — we use it whether or not you accept analytics cookies, because no personal data leaves your browser.

07 — Your rights (GDPR)

You have the right to:

• Access the data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data, subject to legal retention obligations (Art. 17).
• Restrict processing (Art. 18).
• Port your data to another provider (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time (Art. 7(3)).
• Lodge a complaint with the Romanian Data Protection Authority (dataprotection.ro) or your local DPA.

To exercise any of these rights, write to contact@arhetyp.ro. We answer within 30 days.

08 — International transfers

Some of our service providers (Stripe, Vercel, Anthropic) are headquartered in the USA. Where data leaves the EU, it travels under the EU Standard Contractual Clauses or under the EU-US Data Privacy Framework. We do not transfer data to any country without an adequate level of protection.

09 — Children

We do not knowingly collect data from anyone under 16. Coffee is sold to adults.

10 — Changes

We will revise this page when our practices materially change. Significant updates are announced by email to active customers. The "Last updated" date at the top of the page reflects the latest revision.

— Arhetyp