← Back to Vantabean

Privacy Policy

Product and business privacy draft · 6 September 2026, location section updated 30 September 2026, retention section updated 1 October 2026, map services, device storage and notifications updated 4 October 2026

Vantabean is a coffee journal and community. This policy explains what we collect, why we use it, how long we keep it and the choices available to you.

Who is responsible for your data

Vantabean is operated by VEDØY VENTURES, Norwegian organisation number 933 383 571. VEDØY VENTURES is the data controller for personal data processed through Vantabean. Privacy questions and requests can be sent to hello@vantabean.com.

Information we store

Vantabean accounts are for people aged 16 or over. We do not ask for your date of birth; at sign-up you confirm that you are at least 16, and that confirmation is stored with your account. If we learn that an account belongs to someone younger, we close it and delete its data.

When you create an account, we store your email address and authentication records. If you complete your profile or use the product, we store profile details, coffee preferences, follows, notifications, comments, kudos, saved items, beans, recipes, brew logs, visibility choices and safety preferences such as blocked or muted accounts.

Images uploaded to Vantabean are stored in managed storage. Submission images remain private until they have been approved for public use. A coffee-bag scan, or a request to turn your bag photo into a clean bag image, sends that image and related prompt data to an AI provider for the requested analysis or rendering.

If you ask for nearby cafés or to find your current café, your browser provides your position for that lookup only. To find the cafés and addresses around you, your browser sends that position directly to OpenStreetMap services (Nominatim and the Overpass API) and, in Norway, to Kartverket's address service (Geonorge). An address or place you type into a map search is sent to Nominatim in the same way. These services receive your IP address with the request and handle it under their own privacy terms. Vantabean does not store your device location. A brew logged at a café keeps the café's name and, where the café is in our catalogue, the café's own published position. Café brews start as visible only to you; if you choose to share one, other people see the café and the day, not the exact time.

If you tell us you saw a coffee at a café, we store the coffee, the café, the date you saw it and whether it was served or for sale. When you log a brew at a café with a coffee from our catalogue, that brew counts the same way, as the coffee being served there on that day; it follows the brew if you change or delete it. Before it shows on the café's page it is confirmed: the business that runs the café on Vantabean, or Vantabean's admins if nobody has claimed it, sees your display name, the coffee and the date, and is asked whether it is right. They do not see the brew itself. Once confirmed, other members see the coffee, when it was last and first seen, how many people saw it and how many brews were logged with it there, not who reported or brewed it, and not the brew itself unless you share it. Reports that such an entry is wrong are handled like other reports.

If you turn on push notifications, we store your browser's push subscription so we can send them. Notifications are delivered through your browser maker's push service, such as Google, Apple or Mozilla. Turning notifications off or deleting your account removes the subscription.

If you claim or manage a business, we store the organisation, your role, business contact details, verification evidence, team invitations, profile revisions and an audit history. For Business Pro we store Stripe customer and subscription identifiers, entitlement status and billing-period information, but not complete payment-card details.

For promoted placements we store the creative, coarse targeting choices, budget, review decision and aggregated counts such as impressions, profile opens, saves and website clicks. Advertisers do not receive private user-level brew histories.

Purposes and legal bases

We do not sell personal data.

Public content

Profile information and brew logs marked public can be viewed by other visitors. Do not publish information you want to keep private. Followers-only brews are limited by the selected visibility and private brews remain account-only.

Service providers and transfers

Vantabean uses Supabase for authentication, database and storage; Vercel for hosting, consent-based web analytics and performance measurement; Stripe for Business Pro checkout and subscriptions; and Google Gemini for the optional coffee-bag scan. Café and map information uses OpenStreetMap data and Norwegian public map data. The map itself is drawn from OpenStreetMap's tile servers, which receive your IP address and the map area you view; nearby-café and address lookups go to the OpenStreetMap and Kartverket services described above. These providers receive only the information needed for the feature you use.

Some providers may process information outside Norway or the EEA. Where required, transfers must rely on an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism. The applicable provider arrangements and transfer assessment remain part of Vantabean's internal vendor record.

Stored on your device

Vantabean keeps some things in your browser's storage so the features you use work: your sign-in session, unsent drafts, display choices such as list or grid view, recently loaded data that makes pages faster, and your analytics choice. Measurement data, such as which link brought you to Vantabean and when you first logged a brew, is kept on your device only after you choose “Yes” to analytics, and is removed again if you change that answer. Clearing your browser's site data removes all of it.

Advertising and personalisation

Organic recommendations use coffee relevance, recency, follows, saves, explicit filters and content diversity. Sponsored placement is handled separately. Vantabean does not use sensitive personal data for ad targeting and does not target advertising through profiling where we know with reasonable certainty that the recipient is a minor. “Why this ad?” explains the business and the coarse context used for a placement.

Who can see information

Public profiles and public brews can be seen by visitors. Verified business profile facts and approved promotions are public. Organisation members see only the workspace information allowed by their owner, admin, editor or analyst role. Moderators can access reports and evidence needed to make and audit a decision. Service providers process data under their agreements with Vantabean.

Retention and deletion

Account and active service content is normally retained while your account exists. You can export your data or request permanent account deletion through Manage account. Deleted production content is removed or de-identified; residual encrypted backups expire on their normal restricted backup cycle. Photos stop being shown as soon as the brew or account they belong to is deleted, and the files are removed from storage within seven days. A bag photo you shared under these terms stops being published when you delete your account.

Support requests are normally retained for up to 24 months. A report and its details are kept for six months after it is decided, or twelve months when it led to moderation. After that we keep only a minimal decision record for up to three years: the type of report, when it was made and decided, and what was done, without the report text or who sent it. Reports about café details are kept for six months. Records needed for an ongoing legal claim are kept until it ends. Business verification and payment records may be retained for the applicable statutory accounting period or longer where needed to establish authority, prevent fraud or resolve a dispute. Your analytics choice and other device storage stay in your browser until you clear them. More exact backup, analytics and statutory retention settings are maintained in Vantabean's internal retention schedule and remain subject to final legal and vendor review.

Your choices and rights

You can edit your profile, choose post visibility, change notifications, hide posts, mute or block people, clear those safety lists, export your data, reset your password or delete your account. Subject to legal conditions, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.

Send a request to hello@vantabean.com. We may need enough information to verify that the request concerns your account. You may also complain to Datatilsynet.

Security

Vantabean uses access controls, row-level database policies, private storage, audit logs and role checks. No online service can promise absolute security. Please report suspected account misuse through support and keep your login method secure.

Changes

We may update this policy as the service changes. The date above shows the current draft version. Material changes will be presented before they take effect where required.

Terms · Community Guidelines · Copyright · Contact