Privacy policy

Who we are

Vereda is a specialty-coffee discovery app operated by Vereda ("Vereda", "we", "us"), based in Cluj-Napoca, Romania. We help you find cafés and roasters, log your coffee, and build a personal coffee passport. This policy explains what we collect, why, and the choices you have. We act as the data controller for your personal data under the EU General Data Protection Regulation (GDPR).

What we collect

• Account details: your email, display name, handle, and—if you add them—a profile photo, home city, and phone number.
• Content you create: reviews, ratings, tasting notes, photos, check-ins, suggested edits, and saved cafés and roasters.
• Location: only when you check in or use the map. You control check-in precision in Settings, and you can keep check-ins location-free.
• Device & usage data: app version, device type, language, crash logs, and basic interaction events that help us fix bugs and improve features.
• Push tokens: if you enable notifications, so we can deliver them.
• Partner billing: if you manage a café or roaster, our payment processor handles your card details. We never see or store full card numbers.

How we use it

• To provide the app: your passport, check-ins, reviews, and recommendations.
• To operate accounts, authenticate you, and keep the service secure.
• To show your public profile and contributions according to your visibility settings.
• To send service messages and, where enabled, push notifications.
• To understand usage in aggregate and improve Vereda.
• To process partner subscriptions and prevent fraud and abuse.

Legal bases (GDPR)

We process your data to perform our contract with you (providing the app), on the basis of your consent (e.g. precise location, notifications), to comply with legal obligations, and for our legitimate interests in running, securing, and improving Vereda. You can withdraw consent at any time in Settings.

Sharing

We don't sell your personal data. We share limited data with service providers who help us run Vereda, under contracts that require them to protect it:

• Cloud hosting, database, and image storage/CDN providers.
• Google Maps & Places, to power maps and venue search.
• Our payment processor (Stripe), for partner subscriptions.
• An email delivery provider, for account and transactional emails.
• Analytics and crash-reporting tools, in a limited, privacy-respecting way.

Café and roaster owners can always see reviews and check-ins you post about their venue, regardless of your visibility setting. Public content may also appear to other Vereda users.

Cookies & analytics

On the web we use a small number of strictly necessary cookies, plus optional analytics you control. Necessary storage keeps you signed in (vereda.session), remembers the city you're browsing (vereda.city), your light/dark preference, and your cookie choice itself (vereda.consent) — these can't be switched off because the site doesn't work without them.

Analytics is optional and off until you accept it. If you do, we use Mixpanel (hosted in the EU) to understand which features get used and where people get stuck, which includes session replays of your visit. Nothing analytics-related loads before you accept, and you can change your mind at any time in Settings → Privacy → Manage cookie preferences, or from the cookie banner.

Your choices

• Profile visibility: choose Public, Followers only, or Private in Settings.
• Cookies & analytics: accept or decline analytics in the cookie banner, and change it later in Settings → Privacy.
• Notifications: control these in Settings and your device settings.
• Edit or delete content: you can edit your profile and remove your reviews, photos, and check-ins.
• Delete your account: Settings → Account → Delete account permanently removes your account and personal data.

Your rights

Subject to law, you can request access to, correction of, or deletion of your personal data; object to or restrict certain processing; and request a copy of your data in a portable format. To exercise these rights, email hello@vereda.guide. You also have the right to lodge a complaint with your local data-protection authority (in Romania, the ANSPDCP).

Retention

We keep your data while your account is active. When you delete your account, we remove your profile and personal data and disassociate or delete your contributions. We may retain limited records where required for legal, security, or accounting purposes, and keep aggregated, non-identifying statistics.

Security

We use encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you and regulators of significant incidents where required.

Children

Vereda isn't directed to children. You must be at least 16 years old (or the minimum digital-consent age in your country) to use it. If you believe a child has provided us data, contact us and we'll delete it.

International transfers

Some providers may process data outside your country, including outside the EEA. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Changes

We may update this policy as Vereda evolves. We'll update the date above and, for material changes, give you notice in the app. Continuing to use Vereda after an update means you accept the revised policy.