Privacy Policy
Last updated: 01.05.2026
1. Who is responsible for your data
CafCha ("we", "us") is the data controller for personal data processed through cafcha.com. Contact: support [at] cafcha.com.
2. What data we collect
Account data — username, email address, password (stored hashed), account status and tier.
Content you submit — cafes, shops, coffees, recipes, lists, and any files or photos you upload, plus any text (names, descriptions, notes) you enter.
Ratings — scores you give to cafes, shops, coffees, downloads, or recipes.
Technical data — IP address, browser/device information, and session cookies needed to keep you logged in.
Change history — some content (cafes, coffees, recipes, ratings) is logged automatically when created or edited, recording who made the change and when, for moderation and audit purposes.
We do not collect payment or financial information; CafCha does not process payments directly.
3. Why we process your data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Performance of a contract |
| Moderating content and preventing abuse | Legitimate interest |
| Keeping an audit trail of content changes | Legitimate interest |
| Site security and fraud prevention | Legitimate interest |
We do not use your data for automated decision-making that produces legal effects, and we do not sell your data.
4. How long we keep your data
Account and content data: kept while your account is active.
If you delete your account, some content you submitted (the one you made public - cafes, shops, coffees, recipes, ratings) may remain visible under an anonymized identity unless you remove it yourself before deleting your account.
Server and email logs: kept for a limited period for security and troubleshooting, then deleted (90 days]).
5. Who we share your data with
Hosting/infrastructure provider — to run the servers CafCha runs on.
Email delivery provider (SMTP) — to send activation and account-related emails.
We do not share your personal data with advertisers or data brokers. We may disclose data if required by law or to protect our legal rights.
If any of these providers are located outside the EEA/UK, transfers are made under appropriate safeguards (e.g. Standard Contractual Clauses).
6. Cookies
We use a session cookie to keep you logged in. This is strictly necessary for the site to function and does not require consent under GDPR.
7. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data (most account/content fields are editable directly in your profile).
- Delete your data ("right to be forgotten") — available via the account deletion option, subject to section 4 above.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, contact us at support [at] cafcha.com.
8. Security
We use standard technical measures (password hashing, access controls, file-content validation on uploads) to protect your data. No system is 100% secure, and we cannot guarantee absolute security.
9. Children
CafCha is not directed at children under 16. We do not knowingly collect data from children under this age.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email or a site notice. Continued use of CafCha after changes take effect means you accept the updated policy.