Privacy Policy

Caffèdex ("Caffèdex", "we", "our", or "us") is an in-house product of DevDroids Ltd, a private limited company registered in England and Wales. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Caffèdex website and any associated services.

This policy is issued under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and (where applicable) the EU GDPR. We also comply with the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Our Role

For the purposes of Data Protection Laws, DevDroids Ltd is the data controller of all personal data processed through Caffèdex. We determine the purposes and means of processing your data and are responsible for handling it in accordance with this policy.

2. Information We Collect

We believe in data minimisation and collect only what we need to operate the platform.

• Account credentials: your email address and password. Passwords are stored and managed by our identity provider, Amazon Web Services (AWS) Cognito; we never store raw passwords ourselves.
• Date of birth: provided at signup, as required by our identity provider, to confirm you meet the minimum account age of 13.
• Profile information: an optional "screenname" you can choose to display alongside your contributions. If you don't choose one, your public identity defaults to anonymous or a system-generated label.
• User-generated content: coffee reviews, ratings, photos, and any other content you choose to submit.
• Image check results: for each photo you upload, the result of the automated check described in Section 4 (the categories it detected, with confidence scores) and a short fingerprint of the image, used to recognise copies of images we have removed.
• Abuse-prevention data: when you report content or upload a photo, we store a one-way, keyed hash of your IP address that changes every day, never the IP address itself, to apply limits and to tell reports from different people apart.
• Technical data (server logs): your IP address, the browser and device details your browser sends (browser type and version, operating system), the page requested, the referring page, and the time of each request.
• Cookies and similar technologies: see Section 5.
• Donation data (planned): we plan to offer a voluntary donation feature, processed by Stripe. Donations are not available yet. When they are and you choose to donate, we will receive a confirmation of the transaction (amount, timestamp, anonymised reference) but never your card details or banking information.
• Affiliate link clicks: while affiliate links are switched on for Caffèdex, a public review page may show a "Find it online" link to an Amazon UK search for the product. It opens through our own redirect (an address on Caffèdex starting with /go/), which adds our Amazon Associates tag at the moment you click. For each click we only count the click (the site, the day and whether the link was an affiliate link), with no personal data. We do not receive identifying information about purchases made on the retailer's site.
• Communications: any messages you send us through support channels or the Contact form.
• Visit statistics: the pages you open and some actions you complete, counted without cookies (see "Visit statistics" below).
• Support requests: your name, email address and messages when you contact us or reply to our support emails (see "Support requests and emails" below).
• Email records: the address each of our emails went to, its type and whether it was delivered.

Support requests and emails

Messages you send us through the contact form, and your answers through the reply link in our emails, go to our support inbox, where our staff handle them as tickets. A ticket holds your name, your email address, the messages in both directions, our internal notes and the type of request (a question, a complaint, an appeal against a moderation decision or a request about your data), and, when you are signed in or the request is about your account or a decision we made, a link to that account or decision. We use it to answer you and, for complaints and appeals, to meet our duties under the Online Safety Act 2023. Our replies come from the Caffèdex support address; the reply link in them works for 30 days.

For each email we send you (for example a moderation decision, a data export link, an account deletion notice or a support reply), we record the address it went to, the type of email, when it was sent and whether it was delivered, bounced or marked as spam, so we can show that it arrived and stop sending to addresses that cannot receive it.

3. Lawful Bases for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Contract: processing necessary to create and operate your account, display your contributions, and provide platform features.
• Legitimate interests: securing the platform against fraud and abuse, keeping server logs to run and secure the site, counting visits without identifying anyone (see "Visit statistics"), handling support requests, and maintaining the integrity of our community index. Our legitimate interests are balanced against your rights and freedoms.
• Consent: advertising cookies used to personalise ads, the daily code of our visit statistics (see "Visit statistics"), and any optional uses we flag at the point of collection. You can withdraw consent at any time.
• Legal obligation: responding to lawful requests from authorities, retaining limited records to comply with tax and accounting requirements, and meeting our duties under the Online Safety Act 2023 and other applicable laws.

4. How We Use Your Information

• Register and authenticate your account, including the date-of-birth check at signup.
• Display your reviews, ratings, and screenname (where provided) within the Caffèdex platform.
• Operate, maintain, and secure the Website.
• Detect, prevent, and address technical issues, fraud, abuse, or malicious activity.
• Respond to reports of illegal or inappropriate content and comply with our duties under the Online Safety Act 2023.
• Communicate with you about your account, service changes, or your support requests.
• Comply with legal, tax, and regulatory obligations.

Image checks. Every photo uploaded to Caffèdex is checked by an automated system, Amazon Rekognition (run by Amazon Web Services in its London region, eu-west-2), before anyone else can see it. The check sees a reduced copy of the photo with its embedded data (such as location) removed, and none of your account details. Depending on the result, the photo is published, held for a member of our staff to review, or rejected. We do this to keep the platform safe and to meet our duties under the Online Safety Act 2023 (legitimate interests and legal obligation).

Staff review and reported content. Our staff may review any photo or review that the check holds back or that someone reports. Reported content may be hidden from other users while we review it.

Decisions and appeals. If we remove a photo you uploaded or suspend your account, we email you the reason category. You can appeal through the Contact Us page, and a person will look at it again. An automated rejection affects only that photo, never your account.

Child sexual abuse material. Images we serve are compared with lists of known child sexual abuse material using Cloudflare's CSAM Scanning Tool. Matches are blocked and reported to the authorities. We report any other material we suspect to the Internet Watch Foundation, the US National Center for Missing & Exploited Children and, where needed, the police.

5. Cookies, Advertising and Consent

Caffèdex uses cookies, browser storage (localStorage) and similar technologies. We group them as follows:

• Strictly necessary: required to run the site securely, keep you signed in (after you sign in with AWS Cognito, our own server sets a session cookie, dd_session, that holds only a random session identifier, cannot be read by scripts in the page and expires after 30 days without a visit or 90 days at most, plus a small marker that tells the page you are signed in; your sign-in tokens themselves are kept on our server, not in your browser), protect forms against forgery (CSRF tokens) and record your privacy choices. These do not need your consent and cannot be switched off without breaking the site. If you choose a light or dark theme with the theme button, that choice is stored on your device (localStorage key dd_theme) so the site remembers it; it contains no personal data and you can clear it in your browser settings.
• Preferences: other choices, such as the grid or list view of reviews and the email address kept when you tick "Remember me" on the sign-in form, are kept on your device only if you agree, in Google's consent message, to information being stored on your device; otherwise they last only until you close the tab.
• Advertising (Google AdSense): Caffèdex shows adverts served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
• Analytics (our own, no cookies): we count visits with our own statistics tool, which sets no cookies and stores nothing on your device; see "Visit statistics" below. We do not use Google Analytics.

Your consent choices. If you visit from the UK, the European Economic Area or Switzerland, Google's consent message (from Google's Privacy & messaging tool, a consent management platform certified under the IAB Transparency and Consent Framework) asks for your choice before advertising cookies are used to personalise ads. If you do not consent, Google may still show non-personalised or limited ads, chosen from the page you are viewing rather than your browsing history. You can change or withdraw your choice at any time with the cookie button in the site footer, which reopens Google's consent message. Withdrawing consent does not affect processing carried out before you withdrew it.

Opting out of personalised advertising. Wherever you are, you can turn off personalised advertising from Google in Ads Settings (My Ad Center) at adssettings.google.com. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info or, in Europe, at www.youronlinechoices.eu. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Pages without adverts. We do not show adverts on the sign-in and account pages or on pages that do not exist.

Signed-in users under 18. When you are signed in and the date of birth on your account shows you are under 18, we ask Google to show you only non-personalised ads and tag the ad requests for child-appropriate treatment. We cannot know the age of visitors who are not signed in; for them, the consent choices above apply.

Visit statistics

We count visits to Caffèdex with our own statistics tool. It runs on Cloudflare, on the Caffèdex website itself, sets no cookies and stores nothing on your device. It works in one of two ways, depending on your choice:

• Without your consent to analytics (the default): we only count. Each page you open, and some actions you complete (such as signing up or sending us a message), is recorded with the page address (without anything you searched for or any link details), the website you came from (its address only), your country, your type of device (phone, tablet or computer) and the site. Nothing that identifies you or your device is recorded, so we cannot tell whether two visits came from the same person.
• With your consent to analytics: we also count how many different visitors we have each day and how visits move from page to page. For this, our tool combines your IP address, your browser's user agent, the site and a secret value that changes every day into a one-way code (a hash). Your IP address and user agent are not stored, only the code. The secret value is replaced every day and the old one destroyed, so once the day is over the code cannot be traced back to you or linked to your visits on any other day. We only do this if you agree, in Google's consent message, to all four measurement purposes (measuring advertising performance, measuring content performance, understanding audiences through statistics, and developing and improving services).

If your browser sends a Do Not Track or Global Privacy Control signal, we always count your visits the first way, whatever you chose. The individual records are deleted after 90 days; after that we keep only daily totals (for example, views per page per day), which contain no personal data. Lawful basis: legitimate interests for counting without an identifier, and consent for the daily code. You can change your choice at any time with the cookie button in the site footer, which reopens Google's consent message.

6. Data Retention and Account Deletion

• Active accounts: personal data is retained for as long as your account remains active.
• Account deletion: you can delete your account yourself from the Security page of your profile, or ask us through the Contact Us page. A deletion you request yourself happens 14 days later: we email you a link to cancel it, and you can also cancel it from your profile until then. We then delete your sign-in (AWS Cognito), your profile and everything you added (your reviews and ratings), including any photos. One account serves every DevDroids site you use with it (Birradex, Caffèdex and Giftydex), so this deletes it, and what you added, on all of them. Reports you made, our moderation records and the records of emails we sent you are kept without your name or contact details, for the periods below. If you ask us through a support request, we delete your account straight away once we have confirmed your identity.
• Your reviews: reviews, ratings and photos you added are deleted with your account (see "Account deletion" above).
• Server logs (IP address, browser, page requested, referring page, time): up to 12 months, to secure the site and investigate abuse, then deleted automatically.
• Donation records (when donations are available): transaction records are retained for 6 years from the end of the relevant financial year to meet HMRC requirements.
• Affiliate click counts: each click on a shop link is only counted (the site, the day and whether the link became an affiliate link), with no personal data; the counts are kept as daily totals.
• Reports: records relating to reports of illegal or inappropriate content are retained for up to 24 months in line with our Online Safety Act duties.
• Rejected photos: kept out of view for 30 days after the decision, so an appeal can be reviewed, then deleted. Photos rejected as suspected illegal material are kept out of view for 90 days, as evidence for the authorities, then deleted. You cannot delete a rejected photo yourself during this time.
• Moderation log: we keep a record of every moderation decision (which item, what was decided, when, by whom and why, and the automated check result). It holds identifiers, not the content itself, and is kept for as long as we run the platform, to handle appeals, repeated abuse and our legal duties.
• IP address hashes: the daily hashes described in Section 2 are kept with the report or upload record they belong to. Because the hash changes every day, it cannot be used to follow you from one day to the next.
• Visit statistics: individual records (with no identifier, or with the daily code when you consented) are deleted after 90 days; daily totals with no personal data are kept.
• Support requests: tickets, with the messages in them, are kept for up to 24 months after the request is closed, then deleted, unless we need them for a legal claim or a complaint to a regulator.
• Email records: the email address is removed from our email log after 90 days. The rest of the record (type of email, date and delivery status, with a one-way hash of the address in place of the address) is kept for up to 24 months. Addresses that bounced permanently or marked our email as spam stay on a do-not-send list until you ask us to remove yours.
• Data exports: the copy of your data you asked for is kept for 7 days, the life of its download link, then deleted.
• Account requests: a record of each export, deletion request, cancellation and deletion (what was done, when and by whom, without your content) is kept for as long as we run the platform, as proof that we acted on your request.
• Legal holds: we may retain limited data beyond these periods where required by law or for the establishment, exercise, or defence of legal claims.

7. Third-Party Service Providers and Data Sharing

We do not sell, trade, or rent your personal data. We share it only with the following categories of recipients:

• Authentication (AWS Cognito): your account credentials are stored and processed by Amazon Web Services under their enterprise terms. Lawful basis: contract.
• Email delivery (Amazon SES): the emails we send you (sign-in codes come from AWS Cognito) go through Amazon Simple Email Service in the London region (eu-west-2), which tells us whether each one was delivered, bounced or marked as spam. Lawful basis: contract and legitimate interests.
• Image checks (Amazon Rekognition): a reduced copy of each uploaded photo, without your account details, is processed by Amazon Web Services in London (eu-west-2) for the automated check described in Section 4. Lawful basis: legitimate interests and legal obligation.
• Visit statistics (Cloudflare): our own statistics tool runs on Cloudflare (Workers and Workers Analytics Engine). It receives the page view or action, your IP address and user agent (to work out your country and type of device and, with your consent, the daily code) and keeps the records described under "Visit statistics" for 90 days. We use no other analytics provider. Lawful basis: legitimate interests, and consent for the daily code.
• Advertising (Google AdSense and its partners): Google and its advertising partners receive cookie and device identifiers, your IP address and the pages you view, to serve and measure adverts and, where you consent, to personalise them (see the cookies section above). Lawful basis: consent where the law requires it.
• Payments (Stripe, planned): when donations are available, donation payments will be processed entirely by Stripe under its own privacy policy. DevDroids Ltd will not see or store your card or banking data. Lawful basis: contract (where you choose to donate).
• Affiliate programmes (Amazon Associates, and an affiliate network such as Skimlinks or Sovrn Commerce for other shops): when you follow an affiliate link, your browser goes to Amazon, the shop or the network's redirect, which receives the link, your IP address and the usual browser details, and may set its own cookies on its own website to credit a purchase to us. Their own privacy and cookie policies apply. The price is the same for you, and we share no personal data with them. Lawful basis: legitimate interests.
• Infrastructure providers: cloud hosting, email, and security providers used to operate the site, under written terms imposing confidentiality and data protection obligations.
• Network and security (Cloudflare): all traffic to the site passes through Cloudflare, which delivers and protects it and so processes your IP address and the requests your browser makes. Cloudflare Turnstile checks that the sign-in, sign-up, contact and report forms are used by a person, not a bot, and Cloudflare's CSAM Scanning Tool compares the images we serve with known child sexual abuse material. Lawful basis: legitimate interests and legal obligation.
• Professional advisors: accountants, auditors, and legal advisors where reasonably necessary.
• Legal disclosures: where required by UK law, court order, regulator, or law enforcement.
• Corporate transactions: in connection with a merger, acquisition, or sale of substantially all of our business assets, subject to confidentiality protections.

8. International Transfers

Some of our service providers (notably AWS, Google and Cloudflare, Amazon and the affiliate networks we work with, and Stripe once donations are available) operate global infrastructure and may process data outside the UK or EEA. Where personal data is transferred to a country not covered by a UK adequacy decision, we rely on appropriate safeguards including:

• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).
• Equivalent adequacy frameworks recognised by the UK government.
• Supplementary technical measures such as encryption in transit and at rest, where appropriate.

You may request information about the safeguards applicable to a specific transfer by contacting us as directed in Section 15.

9. Data Security

We implement technical and organisational measures appropriate to the risks involved, including encryption in transit (HTTPS/TLS), encryption at rest for sensitive data, isolated and access-controlled cloud environments, multi-factor authentication for administrative access, principle-of-least-privilege internal access controls, and regular security patching. No method of internet transmission or electronic storage is fully secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware where required by law. Where the breach is likely to result in a high risk to you, we will also notify affected users directly without undue delay, with information about the nature of the breach and recommended protective steps.

11. Children's Data

Anyone may read public reviews on Caffèdex, but accounts are only available from the age of 13. We do not knowingly collect personal data from anyone under 13: account signup asks for a date of birth, and we will refuse or close accounts where the user is identified as under 13. Signed-in users under 18 are only shown non-personalised ads (see Section 5). If you believe we hold data about a person under 13, please contact us via the Contact Us page (link also available in the footer) and we will delete it promptly.

12. Your Legal Rights

Under the UK GDPR (and, where applicable, the EU GDPR), you have the following rights in relation to your personal data:

• Right of access: obtain confirmation that we process your data and request a copy.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion where there is no overriding lawful ground to retain the data.
• Right to restriction: request that we limit how we process your data in defined circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making: we do not make decisions about you using solely automated processing that produces legal or similarly significant effects. The automated image check can reject a photo, but it never suspends an account, and you can ask for a person to review any rejection.
• Right to withdraw consent: withdraw any consent you previously gave, at any time, without affecting prior lawful processing.

Getting a copy of your data and deleting your account. When you are signed in, open the Security page of your profile. "Download my data" prepares a copy of the data we hold about your account (your account details, everything you added with it on any DevDroids site and any photos, with a README that explains each file) as a ZIP file, and emails you a download link that works for 7 days. "Delete my account" deletes your account 14 days later, as described under Data Retention and Account Deletion. You can also make either request through the Contact Us page; we may ask you to confirm your identity before we act on it.

To exercise any of these rights, contact us as directed in Section 15. We will respond within one calendar month. If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

13. AI-Assisted Development

DevDroids Ltd uses AI-assisted developer tooling (currently IDE suggestions through a paid commercial Google Gemini account) in the course of building and maintaining Caffèdex. This tooling operates under enterprise terms that prohibit the use of submitted content to train the underlying foundation models. We do not knowingly submit user personal data to AI tooling.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be communicated through the Website or, where appropriate, by email to registered users.

15. Contact Us

For questions, requests to exercise your rights, or formal data protection inquiries, please contact DevDroids Ltd via the Contact Us page found in the footer.