Privacy Policy

Last updated: June 2026

1. Who we are

Welcome to the Indie Coffee London directory website (published at indiecoffee.london). We are dedicated to promoting and highlighting independent coffee shops and cafes across London.

2. What data we collect

We may collect and process the following data about you:

  • Account information: Your email address, display name, and (if using email sign-up) a securely hashed password. If signing in with Google, we receive your name, email, and profile picture from Google.
  • Favourites and preferences: Cafes you favourite, boroughs you follow, postcode (if provided), and newsletter subscription preferences.
  • Contact form submissions: Your name, email address, and the contents of your message.
  • Newsletter data: Your email address and a record of newsletters sent to you.
  • Session data: A secure session token stored in a cookie to keep you logged in.
  • Location data: Only collected when you explicitly permit your browser to share your location for the "nearby cafe" features. This data is processed locally and not stored on our servers.

3. How we use your data

Your data is used solely for the following purposes:

  • To provide and personalise the directory (e.g., favourites, followed boroughs, nearby cafes).
  • To authenticate you and maintain your session.
  • To send newsletters (only if you opt in).
  • To respond to your contact enquiries or feedback.
  • To maintain the security and administration of the directory.

4. Lawful basis for processing

We process your personal data under the following lawful bases:

  • Consent: For account creation and newsletter subscription.
  • Legitimate interests: For operating and improving the directory service.

We do not sell or share your personal data with third parties for marketing purposes.

5. Cookies

We believe in your privacy. We use a single essential session cookie to keep you logged in. It is a secure, HTTP-only cookie that expires after 30 days.

We do not use tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required as our cookies are strictly necessary for the functioning of the service.

6. Third-party services

To provide the best possible experience, we utilize the following third-party services:

  • Google Sign-In (OAuth 2.0): If you choose to sign in with Google, we receive your basic profile information (name, email, profile picture) from Google. Google's privacy policy applies to their processing of your data.
  • Google Places API & OpenStreetMap (Leaflet): For mapping, cafe information, and cafe images.
  • Floot: Our secure hosting and platform provider.

7. Data retention

We do not hold your data for longer than necessary:

  • Account data: Retained for as long as your account is active. You can delete your account at any time from your account settings page, which permanently removes all your data.
  • Session data: Sessions expire after 30 days of inactivity.
  • Contact form data: Retained only until your enquiry has been fully resolved.
  • Newsletter data: Retained until you unsubscribe or delete your account.

8. Your rights under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have several rights regarding your personal data, including:

  • The right to access your personal data.
  • The right to rectification of inaccurate data.
  • The right to erasure ("right to be forgotten"). Note that you can exercise your right to erasure by deleting your account from the account settings page.
  • The right to restrict processing.
  • The right to data portability.
  • The right to object to processing.

9. Data security

We take the security of your data seriously:

  • Passwords are securely hashed using industry-standard algorithms (bcrypt) — we never store passwords in plain text.
  • Sessions use cryptographically random tokens.
  • All data is transmitted securely over HTTPS.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will be changed accordingly.

11. Contact us

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please get in touch with us via our Contact page.