Privacy.

This notice describes how BORIA (“BORIA,” “we,” “us”) handles personal information on boriacafe.com. It matches the website as it works today: a public house and menu, and an email list for launch and appearance updates. It is not a café reservation, payment, or loyalty system.

Who we are

BORIA is a yerba mate café being prepared in the Bay Area, California. Privacy questions and rights requests: hello@boriacafe.com.

Notice at collection

If you join the list, we collect your email address, the fact that you agreed to hear from us, a timestamp, and a version tag for that agreement. We also pass the referring site and any campaign tags associated with your signup to Beehiiv. We use this information only to send occasional notes about BORIA openings and appearances, to keep a consent record, and to let you unsubscribe. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Information we collect

You give us

• Email address, when you submit the JOIN form with the required consent checkbox.
• Consent: we store that you agreed, when you agreed, and the consent version 2026-09-public-notice.
• Referring-site and campaign-tag information associated with your signup, when present. This is sent to Beehiiv with your subscription.

We create in order to run the form

• A random unsubscribe token, used only to honor a removal request.
• A short-lived rate-limit counter derived from a hashed IP address and a ten-minute time bucket. That hash is not stored on your subscriber record and expires within about twenty minutes.

The browser may keep

• sessionStorage key boria-entered, so the opening animation plays once per browser tab session. It is not an email identifier and is not sent to BORIA.

We do not ask for your name, phone number, payment card, date of birth, precise location, or account password. We do not operate a customer login.

Cloudflare, which hosts this site, may process standard request logs (such as IP address, user agent, and timestamps) to deliver the pages and protect the service. Those logs are not used by BORIA to build a marketing profile.

How we use information

• Send launch and appearance updates you asked for.
• Keep a durable record that you consented, and to which version.
• Remove you when you unsubscribe.
• Limit abusive signup attempts.
• Respond if you email us.

California law: these uses are for our business purposes of providing the list you requested, security, and communicating with you. We do not use sensitive personal information, and we do not use automated decision-making to deny a good or service.

Who receives it

• Cloudflare. Hosts the website and the D1 database that stores your consent record. See Cloudflare’s privacy policy.
• Beehiiv. Sends the newsletter. We create or update a Beehiiv subscription with your email and signup attribution when you join, and we ask Beehiiv to unsubscribe you when you leave. Beehiiv processes subscriber and email-delivery data under its own privacy policy. If BORIA enables campaign open or click measurement, we will update this notice before doing so. Beehiiv’s public mailing-address footer will appear on campaigns once sending begins. See Beehiiv’s privacy policy.

We do not sell your email. We do not share it with advertisers. We may disclose information if required by law. If we ever appoint another vendor to operate this same list, we will update this notice first.

Cookies and similar technology

The public site does not set advertising cookies and does not load a marketing analytics pixel. The JOIN form does not require a tracking cookie. The entrance animation uses session storage as described above. Because we do not use non-essential tracking cookies, this site does not show a cookie-consent banner.

How long we keep it

Your active BORIA email and consent record remain until you unsubscribe, or until we delete the list if the project ends. When you unsubscribe through BORIA’s tokenized link, we ask Beehiiv to unsubscribe you and delete the active D1 consent record. Rate-limit hashes expire in minutes. Provider logs and backups may be retained under the relevant provider’s retention practices or as required by law.

Your choices

• Do not submit the form if you do not want to join the list. Browsing the house and menu does not require an email.
• Unsubscribe at any time with the link in a BORIA email, or at boriacafe.com/unsubscribe using that token. That removes you from Beehiiv and deletes our D1 record.
• Email hello@boriacafe.com to ask what we hold, to correct it, or to ask us to delete it. We will need enough detail to find the right address. We will not fulfill a request by publishing a list of subscribers.

California privacy rights

If BORIA is subject to the California Consumer Privacy Act (as amended by the CPRA), California residents may request to know, delete, or correct personal information, and to opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, so there is no “Do Not Sell or Share” control on this site. Global Privacy Control (GPC) signals are treated the same way: there is no sale or share to opt out of. We will not discriminate against you for exercising a privacy right. You may designate an authorized agent to email us on your behalf. We may take reasonable steps to verify a request.

Categories collected from list members: identifiers (email). Categories collected from visitors generally: internet or electronic activity that Cloudflare may log to operate the site. We do not collect commercial purchase history, biometric, or geolocation data through this website.

Security

We limit what we store, keep the Beehiiv API key off the public site, and do not expose a public list of subscribers. Rate limits use a hashed IP bucket rather than attaching an IP address to your email record. Transmission to this site uses HTTPS.

Children

The list is not directed to children under 13, and we do not knowingly collect their email addresses.

Other regions

The site is operated from California for a Bay Area café. If you write to us from elsewhere, we still use your email only for the list you joined, on the basis of your consent, and you may withdraw that consent by unsubscribing.

Changes

If we collect new categories of information or start using a new vendor for the list, we will update this page and, where the change is material to the list, the consent version on the JOIN form. The effective date at the top will change.

Related notices

Use of this website is also covered by our Terms of Use.

Contact

BORIA
Bay Area, California
hello@boriacafe.com