Privacy notice

Who we are

Tulip Coffee Company ("Tulip", "we", "us") builds software and free learning for the coffee industry. We are based in Adelaide, South Australia. This notice covers the preview website at tulipcoffee.org and www.tulipcoffee.org, including the waitlist form and related confirmation emails.

Contact us at [email protected] or [email protected]. Tulip does not sell or roast coffee. This notice is meant to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, for visitors in the European Economic Area, the United Kingdom, and Switzerland, the GDPR and UK GDPR.

What we collect

If you join the waitlist we collect your email address, your affirmative consent and the exact consent sentence shown when you joined, the time of that consent, your language preference (English or Spanish), and an optional description of the part of the industry you work in.

We also store an approximate country derived from the network request (for example CloudFront-Viewer-Country), a salted cryptographic hash of the IP address (never the raw address), the browser user agent, a reCAPTCHA score and related verification outcome, and optional campaign parameters (source, medium, campaign) and the referring page. We use those to protect the form from abuse and to understand which introductions are useful.

If you accept analytics cookies, Google Analytics 4 receives page and event data such as language and which button you used. We never send your email address or other contact details to Google Analytics.

We do not knowingly collect personal information from children under 16. If you believe a child has submitted an address, email us and we will delete it.

Why we collect it

We use the waitlist to confirm your subscription and to send product updates and learning content from Tulip. The legal basis is your consent. You can withdraw that consent at any time.

Bot protection, rate limiting, and security logging keep the waitlist trustworthy and protect our systems. Analytics, when you allow them, help us understand visits, language mix, and which calls to action are useful.

We do not use waitlist information for automated decisions that produce legal or similarly significant effects about you. reCAPTCHA scores are used only to decide whether a signup request looks like abuse.

Who processes it

The site is hosted on Amazon Web Services (Elastic Container Service) in the Asia Pacific (Sydney) region. The waitlist database is Neon Postgres. Amazon Simple Email Service (SES) sends waitlist confirmation and related transactional messages. Google provides reCAPTCHA and, if you accept, Google Analytics. Those processors may handle data in Australia and in other countries, including the United States.

Where personal information is transferred outside Australia or the EEA/UK, we rely on the processors’ contracts and, for GDPR, appropriate safeguards such as standard contractual clauses offered by those providers, together with the technical measures described below.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose personal information only to the processors named here, when required by law, or to protect Tulip, our users, or the public from fraud, abuse, or security threats.

Emails and how long we keep data

After you join, we may send a confirmation email that restates your subscription and what to expect. Confirmation messages are transactional. Later marketing or product emails will include a clear way to unsubscribe, as required by the Australian Spam Act 2003 and the GDPR. You can also ask us to remove your address by emailing [email protected] or [email protected].

We keep a waitlist record until you unsubscribe or ask us to delete it, or for 24 months after the last time we hear from that address, whichever comes first. Rate-limit counters expire within a day. The analytics cookie choice (tulip_consent) is stored for six months. Security and operational logs are retained only as long as needed for security and troubleshooting.

When retention ends we delete or irreversibly de-identify the record, except where we must keep a limited record to show that we respected an unsubscribe or deletion request.

Cookies and similar technologies

Essential cookies and storage keep the site working: language preference (NEXT_LOCALE), your analytics choice (tulip_consent), and short-lived session storage for campaign attribution on the waitlist. These are not used for advertising.

If you accept analytics, Google Analytics may set cookies according to Google’s policies. You can change your choice at any time with Cookie settings in the footer. Declining analytics does not stop you using the site or joining the waitlist.

Security

We use HTTPS, access controls on hosting and the database, salted hashing of IP addresses, origin checks, honeypot and rate-limit controls on the waitlist, and reCAPTCHA to reduce automated abuse. No method of transmission or storage is perfectly secure; if we become aware of a breach that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by Australian law.

Your rights

You can ask for access, correction, or deletion of your personal information, and you can withdraw consent to marketing emails. Email [email protected] or [email protected]. We will delete the waitlist row for that address and confirm when it is gone. We may need to verify that the request comes from the account holder.

If you are in the EEA, UK, or Switzerland you may also have rights to restrict or object to certain processing and to data portability, and you may lodge a complaint with your local supervisory authority. In Australia you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). We ask that you contact us first so we can try to fix the issue.

Changes to this notice

We may update this notice when our practices or the law change. The “Last updated” date at the top will change. Material changes that affect the waitlist will be reflected on this page before they apply to new signups. Continued use of the site after an update means you have read the revised notice.