Privacy Policy
Last updated: 5 August 2026
1. Data controller
Identity: Alejandro José Sobrino Beltrán
Location: Esporles, Illes Balears, Spain
Contact: legal@sub9bar.com
This policy governs the processing of personal data carried out through sub9bar.com in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. Data we process and purposes
2.1 Account data
When you register, we collect your email address and password (stored only as a hash). You may optionally add a display name and profile picture. This data is required to identify you and provide the service.
2.2 Service usage data
We store the shot logs (dose, yield, time, temperature, taste scores, notes), coffee beans and equipment you enter in the app. This information is the core of the service and is not shared with third parties except for the AI analysis described below.
2.3 AI analysis
The parameters of each shot are sent to the Google Gemini API to generate calibration suggestions. Google processes this data as a data processor under contract and does not use it to train its models, in accordance with its API terms of service. No personally identifying information (name, email) is sent to Gemini.
2.4 Payment data
Payments are processed entirely through Stripe. We do not store card data. We only retain the Stripe customer identifier and subscription identifier to manage access to paid features.
2.5 Technical data
To ensure the security and stability of the service, we process technical data such as IP addresses (in server logs), error traces (via Sentry) and backend performance metrics (via Logfire). This data is retained for a maximum of 90 days and used solely for diagnostic purposes.
3. Legal basis for processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Account management and service provision | Performance of a contract (Art. 6.1.b) |
| Payment processing | Performance of a contract + legal obligation (Art. 6.1.b and 6.1.c) |
| Security, error monitoring and technical observability | Legitimate interest (Art. 6.1.f) |
| AI analysis for calibration | Performance of a contract (Art. 6.1.b) |
4. Data retention
Account and usage data is retained for as long as your account is active. When you delete your account, all your data (shots, beans, equipment, profile) is permanently and immediately erased. Technical logs (server logs, errors) are automatically deleted after 90 days. Billing data is retained by Stripe in accordance with their legal obligations.
5. Recipients and data processors
We work with the following service providers as data processors, all under contracts that ensure GDPR compliance:
| Provider | Purpose | Country |
|---|---|---|
| Supabase Inc. | Authentication and database | EU (Frankfurt, Germany) |
| Vercel Inc. | Frontend hosting and CDN | EU (Frankfurt, Germany) / global CDN |
| Railway Corp. | Backend API hosting | EU (Netherlands) |
| Stripe Inc. | Payment processing | USA / EU |
| Google LLC | Gemini AI API for shot analysis | USA |
| Sentry Inc. | Error monitoring | USA |
| Pydantic / Logfire | Backend observability | USA |
6. International transfers
Your primary data — account information, shots, beans and equipment — is stored and processed within the European Economic Area (EEA): authentication and database on Supabase (Frankfurt, Germany) and the backend API on Railway (Netherlands).
Some ancillary processors are located outside the EEA, primarily in the United States: Google LLC (Gemini AI analysis), Sentry (error monitoring) and Logfire (backend observability). These transfers are covered by Standard Contractual Clauses approved by the European Commission (Art. 46.2.c GDPR), which ensure a level of protection equivalent to that required within the EU.
7. Your rights
You may exercise the following rights at any time by contacting us at legal@sub9bar.com:
- Access — find out what personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data ("right to be forgotten").
- Restriction — ask us to suspend processing while a dispute is resolved.
- Portability — receive your data in a structured, commonly used format.
- Objection — object to processing based on legitimate interest.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe that the processing of your data does not comply with the applicable regulations.
Note that you can delete your account and all your data at any time from Account → Danger zone within the app itself.
8. Security
We apply appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), hashed password storage, httpOnly and Secure session cookies, database access restricted via Row-Level Security, and continuous error monitoring.
9. Changes to this policy
We may update this policy to reflect regulatory changes or changes to the service. Any material changes will be communicated by email with at least 30 days' notice. The date of the last update always appears at the top of this document.