Privacy Policy

The controller responsible for your personal data is NIR COFFEE LLC, a Wyoming (USA) limited liability company with registered address at 30 N Gould St, Sheridan, WY 82801, United States. For all privacy-related enquiries please write to hello@nircoffee.id.

We process the following categories of personal data:

• Account data: name, email address, hashed password, phone number, account preferences.
• Transaction data: shipping and billing addresses, order history, payment method references (Stripe transaction and payment-method references; we do NOT store full card numbers), purchase amounts.
• Device and usage data: IP address, browser type and version, device identifiers, operating system, referring URL, pages viewed, timestamps, approximate location derived from IP (city level).
• Marketing data: marketing-email opt-in status, newsletter engagement metrics (opens, clicks) where you have consented.
• Communications: support tickets, emails, and any information you voluntarily share when contacting us.

We collect personal data from three sources:

• Directly from you when you create an account, place an order, subscribe to our newsletter, or contact us.
• Automatically when you use the Site, via cookies and similar technologies (see our Cookie Policy).
• From third parties: payment confirmations from Stripe (card payments); dispatch and delivery status updates from our fulfillment partner and its logistics carriers; aggregated audience metrics from Google and Meta where you have consented to those categories.

Where the law of your country requires a legal basis for processing (for example GDPR Art. 6), we rely on:

• Consent — for analytics cookies, marketing pixels, and direct marketing emails. You can withdraw at any time.
• Performance of a contract — to fulfill orders, deliver products, process payments, and provide customer support.
• Legal obligation — to retain transactional records for tax and accounting compliance.
• Legitimate interest — to detect and prevent fraud, secure our systems, and improve our products and services, balanced against your rights.

Personal data is processed for the following purposes:

• Order fulfillment: process payment, ship goods internationally, send transactional emails (order confirmation, shipping updates, delivery confirmation).
• Account management: authenticate you, store your preferences, allow you to view past orders.
• Marketing (only with your consent): send newsletters, promotional offers, and personalized product recommendations; measure ad campaign performance.
• Analytics: understand aggregate usage patterns, improve site performance, and inform product decisions.
• Fraud prevention and security: detect suspicious activity, protect against unauthorized access, defend our systems and customers.
• Legal compliance: respond to lawful requests from authorities; meet tax, accounting, customs, and consumer-protection obligations.

We share personal data with the following recipients, each bound to confidentiality and security obligations:

• Stripe, Inc. — credit / debit card payment processing, fraud prevention, and card refunds. Jurisdiction: United States.
• CV. Ngalam Indonesia Reserve Coffee — our fulfillment partner in Malang, Indonesia, which roasts, packs, and dispatches your order. It receives your name, delivery address, phone number, and order contents for fulfillment and carriage purposes.
• International logistics carriers — engaged by our fulfillment partner to carry your parcel from Indonesia to your country (including Rayspeed and destination-country delivery networks). They receive consignee name, address, phone number, and customs-declaration details.
• Google LLC — Google Analytics 4 (analytics), loaded only with your consent. Jurisdiction: United States.
• Meta Platforms, Inc. — Meta Pixel (advertising measurement), loaded only with your consent. Jurisdiction: United States.
• Amazon Web Services, Inc. — infrastructure hosting (compute, database, storage, content delivery). Jurisdiction: United States, with regional infrastructure in Indonesia and Singapore.

Because we sell internationally, your personal data necessarily crosses borders: it is processed in the United States (Stripe, AWS, our corporate systems), in Indonesia (regional hosting, order fulfillment and dispatch), in Singapore (AWS regional hosting), and in your own country (last-mile delivery). We transfer only what each recipient needs for its role, under contractual commitments to protect it. You can request more detail about our cross-border transfer arrangements by emailing hello@nircoffee.id.

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law:

• Order and invoice records: 7 years from the date of the transaction (tax, accounting, and customs requirements).
• Account data: until you request deletion. After a deletion request, identifiable data is anonymized within 30 days; aggregated, non-identifiable analytics may be retained.
• Marketing data: 2 years after your last interaction (open, click, purchase). Inactive subscribers are removed automatically.
• Consent records: kept for as long as the underlying account or transaction is retained, plus the legally required retention period.
• Support correspondence: 3 years from the last interaction.

Regardless of where you live, we offer you the following rights with respect to your personal data. Depending on your country's law (PDPA, APPI, PIPA, PIPL, GDPR, and others), some or all of these may also be legal entitlements:

• Right of access — obtain confirmation of whether we process your data, and a copy of that data.
• Right of rectification — request that inaccurate or incomplete data be corrected.
• Right of erasure — request deletion of your data, subject to legal retention obligations.
• Right to restrict processing — ask us to limit how we use your data while a complaint is investigated.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint — with the data-protection authority in your country of residence.

To exercise any of the rights above, please email hello@nircoffee.id with the subject line [DATA REQUEST] followed by the type of request (e.g. [DATA REQUEST] Access). We will acknowledge receipt within 7 working days and respond substantively within 30 days. We may need to verify your identity before fulfilling certain requests; see our Data Requests page for the full process.

We use industry-standard technical and organizational measures to protect personal data, including encryption in transit (TLS 1.2+), access controls, principle-of-least-privilege for staff accounts, audit logging, and regular review of our processors. Card details are entered directly into Stripe's secure elements and never touch our servers. No system is perfectly secure; if we discover a breach affecting your personal data, we will notify you and the relevant authority as required by the law that applies to you.

Our services are intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If we learn that we have collected such data, we will delete it promptly. If you believe a child has provided personal data to us, please contact hello@nircoffee.id.

We may update this Privacy Policy from time to time. Material changes are signalled by bumping the version date at the top of this page; existing users will be prompted to re-consent on next sign-in or next visit. Non-material changes (e.g. typo fixes, contact-detail updates) take effect immediately.

Questions, complaints, or requests regarding this Privacy Policy should be addressed to: NIR COFFEE LLC, 30 N Gould St, Sheridan, WY 82801, United States. Email: hello@nircoffee.id.

This Privacy Policy is effective as of 06-09-2026.