Privacy Policy

1. Overview

Value Way Inc. ("Value Way," "we," "us," or "our") operates the Value Way platform at app.valueway.coffee. This privacy policy describes how we collect, use, store, and protect your personal information when you use our services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Display name (optional)
• Profile photo (optional)
• Role selection (e.g., Farmer, Exporter, Roaster, Importer)

2.2 Contact Form Submissions

When you submit our contact form, we collect:

• Name, email address, and company name
• Your role in the coffee supply chain
• Your message and project timeline

2.3 Application Data

When you use our platform, we collect data you provide about your coffee lots, including:

• Lot identifiers, origin, producer, and processing details
• Carbon footprint calculation inputs and results
• Traceability and compliance documentation

2.4 Payment Information

Payment processing is handled by Stripe, Inc. We do not store credit card numbers or bank account details on our servers. Stripe collects and processes payment information in accordance with their privacy policy.

2.5 Automatically Collected Information

We automatically collect certain technical information:

• Authentication session tokens (via cookies)
• Internal analytics events (e.g., feature usage for product improvement)

We do not use third-party analytics services such as Google Analytics.

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our platform and services
• Authenticate your identity and manage your account
• Process payments and manage subscriptions
• Respond to your inquiries and support requests
• Calculate and display carbon footprint data for your coffee lots
• Generate compliance reports (e.g., EUDR)
• Send service-related notifications

4. Third-Party Services

We share data with the following third-party service providers:

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

5. Cookies and Local Storage

We use the following cookies and browser storage:

We do not use advertising cookies or third-party tracking cookies.

6. Data Retention

• Account data: Retained while your account is active and for 30 days after deletion request.
• Contact submissions: Retained for 2 years, then archived or deleted.
• Payment records: Retained as required by applicable tax and financial regulations.
• Lot and CFP data: Retained while your account is active. Exported upon request.

7. Business contact details we obtain from public sources

When we contact a company for the first time about our services, the contact details we use are usually not given to us by the individual concerned. We obtain them from sources that the company itself has made public. The General Data Protection Regulation requires us to tell you the following about that processing.

7.1 What we collect

A business email address or a business social-media account name; the company name, country and website; the person's role where the company publishes it. We do not collect special categories of personal data, and we do not build behavioural profiles. We do not make any decision about you by automated means.

7.2 Where we get it

From the company's own public website (contact page, footer, imprint or team page), its public business social-media profile, or a public trade directory. We record the exact source address for each contact we hold, and we will tell you what it was if you ask.

7.3 Why we process it, and on what legal basis

Our legal basis is legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is to introduce a business service — lot-level carbon footprint calculation for green coffee — to companies whose published activity indicates the service may be relevant to them. We have carried out and documented a balancing assessment. We contact each company once. We do not send follow-up messages unless the recipient replies. We do not track whether a message is opened or a link is clicked.

7.4 How long we keep it

If you do not reply, we delete your contact details within 12 months of the first message. If you object, or ask to be removed, we delete them immediately and keep only the minimum record needed to make sure we do not contact you again (your email address or account name, and the date of the objection).

7.5 Who else receives it, and international transfer

Two providers handle these messages for us. Cloudflare, Inc. (United States) runs the small program that prepares and relays each message, and Plus Five Five, Inc. (United States), trading as Resend, delivers it. Both act as our processors for the content of the message and the address we send it to, and neither is permitted to use that content for its own purposes. Resend additionally processes delivery data — which includes the address each message was sent to — as its own controller rather than ours, to provide, optimise and maintain its service and for its own business purposes such as fraud and abuse prevention, identity verification, accounting and legal compliance. Apart from these two providers, we do not disclose these contact details to anyone, and we never sell or rent them.

Value Way Inc. is established in Japan, and Cloudflare and Resend are established in the United States. If you are in the European Economic Area this section is given under the General Data Protection Regulation; if you are in the United Kingdom it is given under the UK GDPR. Both apply to us when we contact you.

Transfers to us in Japan. From the European Economic Area, these are covered by the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419, as amended). From the United Kingdom, they are covered by the UK's adequacy regulations for Japan, which apply to recipients that handle personal information under Japan's Act on the Protection of Personal Information. We are such a recipient.

Transfers to Cloudflare and Resend in the United States. From the European Economic Area, these are made under the European Commission's standard contractual clauses. From the United Kingdom, they are made under those same clauses as amended by the UK International Data Transfer Addendum. These clauses are incorporated into our data processing agreement with each of these two providers.

7.6 Your rights in respect of this processing

You have the right to object at any time to this processing (Article 21). If you object, we will stop and delete your details — we do not weigh it against our interest. You also have the right to be given access to the data we hold about you (Article 15), to have it corrected (Article 16) or erased (Article 17), to ask us to restrict our use of it while a question about it is resolved (Article 18), and to lodge a complaint with the supervisory authority in the country where you live or work (Article 77). In the United Kingdom that authority is the Information Commissioner's Office. To exercise any of these, write to contact@valueway.coffee. We do not require a particular form of words; "unsubscribe" is enough.

The right to data portability (Article 20) does not apply to this processing, because we rely on legitimate interests rather than your consent or a contract with you.

7.7 Who we are

Value Way Inc., Kigyo Plaza Hyogo, 56 Naniwa-cho, Chuo-ku, Kobe, Hyogo 650-0035, Japan. Contact: contact@valueway.coffee.

8. Your Rights

You have the right to:

• Access your personal data we hold
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Export your data in a portable format
• Withdraw consent for optional data processing
• Object to processing carried out on the basis of our legitimate interests, including direct marketing (Article 21 GDPR)
• Restrict our processing of your data while a question about its accuracy or lawfulness is resolved (Article 18 GDPR)
• Lodge a complaint with your national data protection authority (Article 77 GDPR)

To exercise these rights, contact us at contact@valueway.coffee.

9. Data Security

We implement industry-standard security measures to protect your data, including:

• HTTPS encryption for all data in transit
• Encrypted database connections
• HTTP-only, secure cookies for authentication
• Role-based access controls
• Regular security audits

10. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate — see section 4 for who they are. We ensure appropriate safeguards are in place for cross-border data transfers in compliance with applicable data protection laws. For the outbound business messages described in section 7, the specific transfers and the safeguards that cover them are set out in section 7.5.

11. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.

13. Contact Us

If you have questions about this privacy policy or our data practices, please contact us: