Privacy Policy

Last updated: October 16, 2026

Who we are

Guatemala's Coffee ("we", "us") sells coffee grown on the Molina family farms in Guatemala through guatemalascoffee.com. The business responsible for your data is Guatemalas Coffee, Fraijanes, Guatemala. For anything about your personal data, email guatemalascoffee@gmail.com or use the contact page.

This policy explains what we collect when you use the site, why, who helps us process it, how long we keep it, and your choices. It covers the website only.

What we collect and why

  1. Orders. When you buy, you give us your name, email, phone number, shipping address, and your choices (bag size, roast, grind, delivery schedule, gift message). We use these to charge you, roast and ship your coffee, send order emails, and answer questions. Payment is handled by Stripe: your card number goes directly to Stripe and never touches our servers; we only see the last four digits, the card brand and the result of the payment.
  2. Subscriptions. For a recurring order we also keep your plan, your next delivery date and your billing history, so we can charge you on schedule and so you can change or cancel your plan from your account page.
  3. Account sign-in. There are no passwords. When you ask for a sign-in link we use your email address to send a one-time link that opens your Stripe-hosted account page. The link expires after 30 minutes.
  4. Forms. The contact, wholesale, Guatemala order and survey forms send us what you type (name, email, phone, message, company details) so we can reply. Wholesale orders are then arranged by email and invoiced separately. The newsletter form sends your email address to Mailchimp, which manages our mailing list; every newsletter has an unsubscribe link.
  5. Technical data. Like any website, our hosting provider records server logs (IP address, browser type, pages requested, date and time) to run the site and protect it from abuse. These logs are not combined with your order data.
  6. Analytics (only with your consent). If you accept analytics cookies we use Google Analytics 4 to learn which pages are visited and how people reach the site. IP addresses are anonymised and we do not use analytics data for advertising. You can refuse or withdraw this at any time (see Cookies below). Separately, our host Cloudflare counts page views using a cookieless beacon that does not identify you.

Legal bases (for visitors in the EU/UK)

Orders, subscriptions, account sign-in and form replies: performance of a contract or steps you ask us to take before one. Fraud prevention, security logs and keeping accounting records: our legitimate interests and legal obligations. Analytics and the newsletter: your consent, which you can withdraw at any time.

Who helps us (service providers)

We share data only with companies that process it for us, under their own privacy and security commitments:

  • Stripe, Inc. — payments, subscriptions, fraud prevention, and the account page where you manage your plan. On the checkout page Stripe also uses hCaptcha (bot protection) and Google Maps (address suggestions). Stripe's privacy policy.
  • Cloudflare, Inc. — hosting of the website and its server code, DNS, security filtering, and cookieless page-view counts.
  • Resend, Inc. — sends our transactional emails (order confirmations, sign-in links, subscription notices) from orders@guatemalascoffee.com.
  • Microsoft 365 — the business mailbox where your messages and order notifications arrive and where we reply from.
  • Google — Analytics (only with your consent).
  • Mailchimp (Intuit) — the newsletter list, only if you sign up.
  • FedEx — receives your name, address and phone number to deliver your order.

We do not sell your personal data and we do not share it with advertisers.

Where your data is processed

We ship to the United States, Canada, Mexico and Europe. Our providers are based in the United States and process data there. For visitors in the EU/UK, transfers rely on the providers' standard contractual clauses or equivalent safeguards.

How long we keep it

Order and payment records: as long as needed for accounting and tax purposes (generally 7 years). Subscription data: while your subscription is active, then as part of the order records. Form messages: until your question is resolved, then up to 2 years in our mailbox. Analytics data: 14 months in Google Analytics. Server logs: a short rolling period set by Cloudflare. Newsletter address: until you unsubscribe.

Your rights and choices

You can ask us to show you the personal data we hold about you, correct it, delete it (except what we must keep for accounting), or send you a copy. You can object to or restrict processing based on legitimate interests, and withdraw consent for analytics or the newsletter at any time. Email guatemalascoffee@gmail.com and we will respond within 30 days. EU/UK residents may also complain to their data protection authority. California residents: we do not sell or share personal information for cross-context advertising, and the rights above cover the access, deletion and correction rights under the CCPA/CPRA; we will not treat you differently for exercising them.

Cookies

A cookie is a small file your browser stores for a website. Here is everything this site uses, found by auditing the live site on October 16, 2026.

Necessary (always on; the shop does not work without them)

  • gc_consent — remembers your cookie choices. 6 months. Set by us.
  • gc-cart-v1 — your shopping cart. This is browser storage, not a cookie, and never leaves your device until you check out. Set by us.
  • __stripe_mid (1 year), __stripe_sid (30 minutes) — fraud prevention during payment. Set by Stripe, only on the checkout and account pages.
  • __cf_bm (30 minutes) — bot protection for the hCaptcha check that Stripe runs on the checkout page. Set by hCaptcha/Cloudflare, checkout only.

Analytics (off until you accept)

  • _ga (2 years), _ga_BSRXV43WQ3 (2 years) — Google Analytics 4: distinguishes visitors and sessions so we can count visits and see which pages are read. IP addresses are anonymised. Set by Google only after you click "Accept all" or enable Analytics in Cookie settings.

Not cookies, but good to know: fonts and scripts are served from our own site, and our host counts page views with a cookieless beacon that stores nothing on your device. The newsletter popup remembers that you closed it in browser storage for 7 days.

Managing cookies: use the Cookie settings link (also in the footer) at any time to change your choice; refusing analytics does not affect the shop. You can also delete cookies in your browser settings.

Children

The site sells coffee and is not directed at children under 16. We do not knowingly collect their data.

Security

Pages and payments are served over HTTPS. Card details are handled entirely by Stripe (PCI DSS Level 1). Access to order data is limited to the people who roast, pack and ship your coffee and answer your emails.

Changes to this policy

We will post any changes here with a new "last updated" date. For significant changes we will say so on the site.

Contact

Guatemala's Coffee — guatemalascoffee@gmail.com — guatemalascoffee.com/contact