Privacy policy

Replenish (replenish.coffee) is run by Svpply&.co Limited, a company registered in England and Wales, based in Plumstead, London. We are the data controller for the information described here. Contact: hello@replenish.coffee.

When you pay, the roaster you are ordering from is the seller. Your name, email, delivery address and order details pass to that roaster so they can roast and post it. Card details go straight to Stripe and never reach us or the roaster.

We keep a copy of the order (what, when, how much, where it was sent) to show you your order history, handle problems, calculate our fee and the charity donation, and meet our accounting obligations.

If you sign in, we also keep a list of the coffees you have ordered, any ratings or notes you add, and the brewing preferences you choose. If you tell us a postcode, we store its rough location to show nearby roasters. It lives in your browser until you sign in, then with your account.

Our directory lists independent UK roasters using public information: business name, town, website and social links, and Companies House records. You can correct or remove your listing at any time by emailing us.

If you claim your listing we store your email address and the details you add. If you connect Shopify, we receive an access token for your store with the permissions you approve (read products and inventory, create orders, read shipping). We use it only to show the coffees in the collection you choose and to create Replenish orders in your store. If you connect Stripe, Stripe holds your business and bank details; we store only your Stripe account ID and whether it can take payments.

Only the people needed to make an order happen, all of whom process data under their own privacy terms or ours:

• The roaster you order from (your order and delivery details).
• Stripe, for payments.
• Shopify, where a roaster uses it, so the order appears in their shop.
• Supabase (database and sign-in) and Vercel (hosting), both in the EU or UK where available.
• Our email provider, to send sign-in links and order emails.

We do not sell personal data and we do not run third-party advertising trackers.

We process order data to perform the contract you make with the roaster and to meet legal obligations (orders and financial records are kept for six years). Account data, collections and preferences are kept until you delete your account. Directory listings rely on our legitimate interest in helping people find independent roasters.

When a roaster uninstalls Replenish from Shopify, we stop using the access token immediately. Within 48 hours of Shopify telling us a store has been removed, we delete that store’s connection and cached product data. Replenish does not read customer records from a roaster’s Shopify store. If Shopify forwards a customer data request or erasure request, we respond with or delete any order data we hold for that customer.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email hello@replenish.coffee and we will reply within a month. If you are unhappy with our answer you can complain to the Information Commissioner’s Office (ico.org.uk).

We use a sign-in cookie when you sign in, and small first-party cookies to remember your basket, rough location and brewing choices. Card payments happen on Stripe, which sets its own cookies for fraud prevention. No advertising cookies.