Privacy Policy

Last Updated: July 29, 2026

This Privacy Policy describes how we collect, use, and disclose your Personal Information when you visit or make a purchase from our website (the “Site”), buy from us in person or through our self-checkout kiosk, purchase our products through a marketplace such as Etsy, subscribe to our coffee deliveries, submit a review, or otherwise interact with Der Hoffskeller. By using the Site, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use or access the Site.

We are a small, family-run Wisconsin roastery. We collect what we need to sell you coffee, deliver it, keep the lights on, and market our own products. We do not sell your personal data to data brokers, and we never will.

1. Collecting Personal Information

When you visit the Site, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases. We may also collect additional information if you contact us for customer support. In this Privacy Policy, we refer to any information that can uniquely identify an individual as “Personal Information”. See the list below for more information about what Personal Information we collect and why.

Device & Technical Information

  • Examples of Personal Information collected: version of web browser, IP address, time zone, cookie information, what sites or products you view, search terms, how you interact with the Site, and — when you arrive from an advertisement — the advertising click identifier appended to the address by the ad platform (for example, Google’s gclid, Meta’s fbclid, or X/Twitter’s twclid).
  • Purpose of collection: to load the Site accurately for you, to perform analytics on Site usage to optimize our Site, to attribute sales to the advertising that produced them, and to protect our platform from fraudulent activity.
  • Source of collection: Collected automatically when you access our Site using cookies, log files, web beacons, tags, or pixels.

Order & Contact Information

  • Examples of Personal Information collected: name, billing address, shipping address, payment information (processed by our secure payment processor and digital-wallet providers such as Apple Pay or Google Pay — we do not store raw card numbers), email address, phone number, order and subscription history, and, for in-person sales, information you enter into our self-checkout kiosk (such as an email for a receipt).
  • Purpose of collection: to provide products or services to you to fulfill our contract, to process your payment information, arrange for shipping, manage subscriptions and renewals, and provide you with invoices and/or order confirmations, communicate with you, screen our orders for potential risk or fraud, and when in line with the preferences you have shared with us, provide you with information or advertising relating to our products or services.
  • Source of collection: collected directly from you (online, in person at markets/events, or through a marketplace as described below).
  • Customer profiles: We maintain an internal record for each customer — name, email, default address, order history, and lifetime purchase totals — so we can recognize returning customers, provide support, and understand our business. This record is internal; it is never published.

Subscription & Self-Service Data

  • Examples of Personal Information collected: your subscription contents, billing schedule and renewal dates, pause and resume history, product changes, date-move and early-delivery requests, cancellation requests, and a log of changes made to your subscription (including whether a change was made by you or by us, and when).
  • Purpose of collection: to run your recurring deliveries correctly, apply the changes you request, honor cancellation requests, send you accurate confirmations, and keep an audit trail so billing disputes can be resolved from records instead of memory.
  • Secure links: Access to the Manage Subscription page is granted through single-purpose tokens emailed to you. Tokens expire quickly (typically within one hour) and are stored server-side only long enough to do their job.

Marketplace Orders (Etsy)

  • Examples of Personal Information collected: when you buy our products on Etsy, we receive the order information Etsy provides to us as the seller — your name, shipping address, the items and amounts, order and transaction identifiers, and the contact email Etsy exposes for buyer communication.
  • Purpose of collection: to import your marketplace order into our own order and shipping systems so we can roast, pack, ship, and track it exactly like a website order, and to keep a complete record of our sales for accounting and taxes.
  • Source of collection: Etsy, which processes your purchase under its own privacy policy. We do not receive your payment card details from Etsy under any circumstances.

What We Deliberately Do Not Collect

  • We never collect or store raw payment card numbers, CVVs, or bank account numbers — those exist only inside our payment processors.
  • We do not collect Social Security numbers, government IDs, passwords, health information, or biometric data, and we ask you not to send them to us (including in the chat assistant or review forms).
  • We do not collect precise GPS location. The only location processing we do is converting a mailing address you gave us into approximate coordinates for market alerts, as described below.
  • We do not access your contacts, camera, microphone, or files, and our kiosk does not photograph or record you.

1a. Categories of Information at a Glance

For readers who think in statutory categories (such as those in the California Consumer Privacy Act), the Personal Information described in this policy falls into: identifiers (name, email, postal address, IP address, advertising click IDs); commercial information (orders, subscriptions, purchase history, cart contents); internet activity (page journeys, session data, email-open events); approximate geolocation (coordinates derived from an address you provided); audio/visual content you volunteer (review photos); and inferences limited to ordinary retail judgments (for example, “this customer buys monthly and likes whole bean”). We collect no sensitive-category data as defined by those laws, we disclose categories only to the service providers and advertising partners described in Sections 4 and 5, and we do not sell Personal Information for money.

2. Session Monitoring & Exit-Intent Tracking

To optimize our customer experience and recover abandoned checkouts, we utilize session-tracking technology to monitor your interaction with our site.

  • Data Capture: We automatically capture and save information you enter into our checkout fields (such as your name, email, and address) along with your cart contents, your page journey through the site, your device type, and your session duration. This information is captured whether you successfully complete checkout or if you abandon your cart/close the browser window prior to completion.
  • Consent: By interacting with our website, typing into our forms, or proceeding to the checkout stage, you explicitly consent to the recording, collection, and transmission of your inputs and interactions to us and our authorized service providers for marketing, cart recovery, and analytics purposes.
  • Housekeeping: Tracked sessions that never produce an email address or an order are routinely purged (typically within about a week). Sessions connected to an order or a known customer are retained with that customer’s record.
  • Aggregate Displays: We may compute anonymous, aggregate statistics from order data — for example, a count of buyers over the last 30 days shown on a product page as social proof. These displays never identify you.

2a. AI Chat Assistant

Our website may offer an AI-powered chat assistant to answer questions about our products.

  • Data processed: The messages you type into the chat, along with limited store context needed to answer you, are transmitted to and processed by third-party AI providers (such as Anthropic or OpenAI) to generate responses, and may be logged by us for quality and support purposes.
  • Your choice: Use of the chat is entirely optional. Please do not enter payment card numbers, passwords, government IDs, health information, or other sensitive data into the chat.

2b. Product Reviews

If you submit a product review, we collect the name, email address, rating, review text, and any photo you provide.

  • Email verification is required. After you submit a review, we email you a verification link. Until you click it, your review is held unpublished and is not used for anything; the verification token exists only to prove you control the email address you entered. Submissions that are never verified are deleted automatically — including any uploaded photo — after approximately 30 days.
  • Public display. Once verified and approved, your name (as submitted), rating, review text, and photo may be displayed publicly — on product pages, our reviews page and review pop-ups, themed review showcase pages, photo galleries that combine customer and shop photography, and in our marketing. Your email address is never displayed publicly.
  • Removal. You may request removal of your review (or just its photo) at any time by contacting us, and we will remove it from future display within a reasonable time.

2c. Email Marketing & Local Market Alerts

  • Marketing email: If you provide your email address (including during a checkout you do not complete), we may send you marketing email such as offers, win-back messages, abandoned-cart reminders, newsletters, and announcements. Every marketing email contains an unsubscribe link; unsubscribing never affects order confirmations, receipts, or other transactional messages.
  • Unsubscribe is permanent: When you unsubscribe (or ask us directly to stop), your address goes onto a suppression list that permanently blocks it from re-entering our marketing audience — even if our systems later re-import customer data — unless you explicitly opt in again.
  • Frequency controls: Our campaign system enforces cooldown periods between promotional sends to the same address, and promotional discount codes embedded in campaign email are single-use and tied to the send.
  • Newsletter signups: If you subscribe to our newsletter, we store your email with its signup source and send you a welcome message; the same unsubscribe rules apply from the first email onward.
  • Engagement tracking: Our marketing emails may contain standard open-tracking technology so we can measure engagement and stop emailing people who aren’t interested. Transactional email is not used for marketing analytics.
  • Separate sending streams: Transactional email (receipts, tracking, subscription notices) and marketing email are sent on separate delivery streams — marketing mail is sent from a dedicated marketing subdomain — so your receipts are never affected by marketing-list management.
  • Geocoding for market alerts: If you have provided a physical address, we may convert it to approximate geographic coordinates using a third-party geocoding service (such as OpenStreetMap’s Nominatim) so we can invite you to farmers markets and events near you. Only the address is sent for geocoding — never your name, email, or order history.

2d. AI-Assisted Business Operations

Beyond the customer-facing chat assistant, we use AI tools (such as Anthropic’s Claude) to help run the business itself — for example, summarizing daily store activity, assisting with bookkeeping, drafting customer-service responses, and helping administer orders and subscriptions.

  • Data processed: In the course of that work, AI tools acting on our behalf may process order, subscription, and customer-record data (such as names, emails, addresses, order contents, and amounts) under the providers’ business terms, which restrict use of the data to providing the service to us.
  • What they never process: Raw payment card numbers are held only by our payment processor and are not available to us or to any AI tool.
  • Human responsibility: AI tools assist; decisions with legal or billing effect on you (such as charging a saved card at your request, or canceling a subscription) are carried out through our normal order systems and are logged and reviewable.

3. Minors

The Site is not intended for individuals under the age of 18. We do not intentionally collect Personal Information from children. If you are the parent or guardian and believe your child has provided us with Personal Information, please contact us at the address below to request deletion.

4. Sharing Personal Information

We share your Personal Information with service providers to help us provide our services and fulfill our contracts with you. We do not sell your personal data to data brokers. Each provider receives only what its job requires:

  • Hosting & storefront: Our online store runs on WordPress with our own storefront software, hosted with our web hosting provider (SiteGround). Order and customer records live in that hosted database, and mirror copies of orders may be kept in standard commerce software on the same site for record-keeping.
  • Payments: We share information with our payment processors (e.g., Stripe). Stripe stores subscription payment credentials and processes every online charge; limited order metadata (such as your shipping address) may be attached to your Stripe customer record so renewals ship to the right place. We do not view, process, or store your raw credit card numbers on our own servers. In-person Venmo payments are processed by Venmo/PayPal under their own policies.
  • Shipping: We share your name, address, and package details with shipping carriers (e.g., USPS) and with the shipping-label service we use to purchase postage (e.g., PirateShip), solely to deliver your products and generate tracking.
  • Email delivery: We use a transactional email delivery service (e.g., Postmark) to send order confirmations, shipping notices, and marketing email on our behalf; recipient addresses and message content are processed by that service to deliver the mail.
  • Marketplaces: When you buy through Etsy, Etsy shares your order information with us (see Section 1), and we share fulfillment information back with Etsy — most notably the tracking number for your shipment, which we post to your Etsy order.
  • AI providers & geocoding: Chat messages you send to our AI assistant are processed by third-party AI providers, business-operations data may be processed by AI providers as described in Section 2d, and addresses may be sent to a geocoding service, each as described above.
  • Advertising platforms: as described in Section 5 below.
  • Legal Compliance: We may share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful requests for information we receive, or to otherwise protect our rights — including providing order and communication records to payment processors and card networks when defending a payment dispute.
  • Business transfers: If Der Hoffskeller is ever sold, merged, or reorganized, customer records may transfer to the successor under this same policy.

5. Behavioral Advertising & Marketing

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you.

  • We use Google Analytics to help us understand how our customers use the Site. You can read more about how Google uses your Personal Information here: Google Privacy Policy. You can also opt-out of Google Analytics here: Google Analytics Opt-out.
  • Conversion pixels & click identifiers: We use conversion-tracking technologies from Meta (Facebook), Google Ads, X (Twitter) Ads, and Microsoft Advertising. When you arrive from one of their ads, we capture the platform’s click identifier and, if you purchase, report the conversion (typically the order value and a hashed identifier) back to that platform so we know which advertising works.
  • We may share information about your use of the Site, your purchases, and your interaction with our ads on other websites with our advertising partners.
  • Custom Audiences & Server-Side Conversions: We may share identifiers such as your email address, name, city/state, and zip code — in hashed form where the platform supports it — with advertising platforms including Meta (Facebook), Google Ads, X (Twitter), and Microsoft Advertising, to build customer-match advertising audiences, measure conversions server-side, and show our ads to existing customers or similar audiences. These platforms act under their own privacy policies. You can opt out of this sharing using the “Privacy Choices” link described below, and unsubscribing from our marketing email removes you from future audience uploads we generate.
  • Marketplace buyers are excluded from marketing: Contact information we receive from Etsy is used for fulfilling and supporting your Etsy order (including its transactional emails), not for our marketing lists or advertising audiences, consistent with marketplace policies.
  • Google Customer Reviews: If you opt in to Google’s Customer Reviews survey after an order, we share your email address and order details with Google so it can send you a review request. This is voluntary and handled under Google’s own policies.

Opting Out: You can opt out of targeted advertising by using the following links:

6. Your Privacy Rights

We are a business operating in Wisconsin. Depending on where you reside (such as California, Colorado, Connecticut, Virginia, Utah, or the EEA/UK), applicable privacy laws may grant you specific rights regarding your Personal Information. Even if you are outside these jurisdictions, we strive to honor these rights for everyone.

  • Right to Know & Access: You may request a copy of the personal data we have collected about you.
  • Right to Deletion: You may request that we delete the personal data we have collected from you, subject to certain exceptions (for example, we must retain records of completed orders for tax, accounting, and dispute-defense purposes, and suppression-list entries must be kept to honor your unsubscribe).
  • Right to Correction: You may request that we correct inaccurate personal data. Subscribers can correct name, address, and payment details directly on the Manage Subscription page at any time.
  • Right to Opt Out of Targeted Advertising: Use the “Privacy Choices” link described in Section 5, unsubscribe from marketing email, or contact us.
  • Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. Coffee prices do not change based on privacy choices.

Legal bases (EEA/UK visitors): where the GDPR or UK GDPR applies, we process your data (a) to perform our contract with you — orders, subscriptions, shipping, and their required communications; (b) under our legitimate interests in running, securing, and marketing a small retail business — session analytics, fraud screening, first-party marketing, and advertising measurement — balanced against your rights and always subject to the opt-outs in this policy; (c) with your consent where we ask for it — for example, marketing email from a form you submit — which you may withdraw at any time; and (d) to comply with legal obligations such as tax record-keeping.

How to exercise these rights: contact us by email using the details on our contact page, and tell us what you are asking for. We will verify the request against the email address and order details we have on file (we may ask you to confirm from the email address on your record — this protects you from someone else requesting your data). We respond within the timeframe applicable law requires (typically within 45 days). You may use an authorized agent where the law provides for it; we will still verify with you directly. If we decline a request, we will explain why, and where local law provides an appeal process, you may appeal by replying to our decision.

7. Data Retention & Security

  • Orders and customer records: retained for as long as we operate, and at minimum as long as tax, accounting, and legal obligations require, unless and until you ask us to erase what we are permitted to erase.
  • Subscription records: retained while the subscription is active and afterward as part of the order history, including the change/audit log.
  • Tracked sessions: sessions with no email and no order are purged routinely (typically about 7 days); the remainder are kept with the related customer record.
  • Email logs: our internal log of sent email (recipient, subject, content, delivery status) is purged on a rolling basis, typically after about 30 days.
  • Unverified review submissions: deleted, with any photos, after approximately 30 days.
  • Management links and verification tokens: management links expire in about an hour; verification tokens persist only until used or their submission is purged.
  • Suppression list: kept permanently, because forgetting it would mean accidentally emailing people who told us to stop.

We utilize industry-standard encryption and secure server architectures to protect your data during transit and at rest: TLS on every page, encrypted payment flows handled entirely by our payment processor, restricted-permission API keys for the services we integrate, and administrative access limited to the people who run the roastery. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. If we learn of a data breach affecting your Personal Information, we will notify you and the relevant authorities as required by applicable law, without unreasonable delay.

8. Cookies & Do Not Track

A cookie is a small amount of information that’s downloaded to your computer or device when you visit our Site. We use a number of different cookies, including functional, performance, advertising, and social media or content cookies. Ours include, for example:

  • Cart and session cookies that keep your cart contents and session together while you shop;
  • A review cookie set after you submit a product review (valid for about one year) that prevents duplicate submissions from the same browser;
  • Advertising cookies and identifiers set by the ad platforms described in Section 5 when their pixels load.

Cookie Consent: We do not employ interruptive cookie consent pop-ups. By continuing to browse and use our Site, you implicitly consent to our use of cookies as described here. You can manage or disable cookies at any time through your web browser settings; the store will still work, though your cart may not persist.

Please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser, and we likewise do not currently respond to Global Privacy Control (GPC) signals automatically — instead, the “Privacy Choices” page described in Section 5 gives you a direct, working opt-out that we honor.

8a. Your Communications With Us

When you email us, reply to one of our messages, message us through a marketplace, or speak with us at a market, we keep the correspondence connected to your customer record so we have context the next time you need help. Support correspondence is retained on the same schedule as customer records. If you ask us to delete your data, related correspondence is included except where we must keep it (for example, records of a dispute or of the deletion request itself).

8b. Social Media & Third-Party Links

Our site links to our pages on platforms such as Facebook, Instagram, X, and YouTube, and to third-party stores (Etsy, our print-on-demand gift shop) and services. Following those links takes you to services with their own privacy policies that we do not control. Interacting with our pages on those platforms (likes, follows, comments, messages) is governed by the platform’s policy; we see what the platform shows to page owners, which is typically aggregate statistics plus the content you post publicly or send to us directly.

9. Where Your Data Lives

We are a United States business; our systems and service providers process and store data in the United States. If you access the Site from outside the U.S., you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your jurisdiction.

10. Changes

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons. The “Last Updated” date at the top of this page shows the current revision; material changes will be reflected there, and your continued use of the Site after a change constitutes acceptance of the revised policy.

11. Contact Us

For more information about our privacy practices, if you have questions, if you would like to exercise any of the rights described above, or if you would like to make a complaint, please contact us by e-mail or by mail using the details provided on our website’s contact page. If you are in a jurisdiction with a data-protection authority and believe we have not resolved your concern, you may also lodge a complaint with your local authority.