Privacy Policy

Effective Date: July 10, 2026

Barista, Inc. (“Barista,” “we,” “us”) provides an AI-powered PR intelligence platform. This policy explains how we handle personal information when you visit getbarista.ai, sign up for or use the Barista service (the “Service”), or communicate with us.

One important distinction up front. When our customers upload data to their workspaces — such as media contact lists, notes, and documents — the customer controls that data and we process it on their behalf under our Data Processing Addendum. This policy covers the data for which Barista is responsible as a controller: your account data, website data, and our media contact database. If you have questions about data a Barista customer holds about you in their workspace, contact that customer.

1. Information we collect

Account and service data (from you):name, business email, company, role, authentication data, billing details (processed by Stripe — we don't store card numbers), settings, and support communications.

Usage data (automatic): device and browser information, pages visited, feature usage, and log data used to operate, secure, and improve the Service.

Media contact data (from public sources): we maintain a database of professional information about journalists and media contacts — name, outlet, role, beat, business contact details, professional social handles, and published work — collected from publicly available sources. This is described fully in our Journalist & Media Contact Data Notice, including how to opt out.

2. How we use it, and our lawful bases

Where UK or EU data protection law applies, we rely on the following lawful bases:

  • Performance of contract: creating and managing your account, providing the Service, billing, and support.
  • Legitimate interests: operating our media contact database (see the Journalist Data Notice and our documented assessment); securing the Service and preventing abuse; understanding usage to improve the product; communicating with beta participants about the program.
  • Legal obligation: tax, accounting, and compliance records.
  • Consent: marketing emails where required, which you can withdraw at any time via the unsubscribe link.

We do not sell personal information, and we do not use the content of customer workspaces to train AI models.

3. How we share it

We share personal information only with service providers that help us run Barista, under contracts restricting their use of the data: Supabase (database and authentication), Vercel (hosting and AI gateway), Anthropic and OpenAI (AI processing via API, on terms under which they do not train on the data), Stripe (payments), Resend (email delivery), and Braintrust (AI observability). The current list is maintained in Annex 3 of our DPA.

We may also disclose information if required by law, or in connection with a corporate transaction (in which case this policy continues to apply until updated).

4. International transfers

We are a U.S. company and process data in the United States. Where we transfer personal data from the UK, EEA, or Switzerland, we rely on the EU Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum, as set out in our DPA.

5. Retention

Account data is retained for the life of your account and deleted or anonymized within 90 days of account closure, except where law requires longer retention. Media contact database records are retained while current and relevant, and refreshed or removed when stale. Backups are deleted on our standard rotation cycle.

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, and to withdraw consent. UK and EU residents may complain to their supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk); California and Oregon residents have corresponding rights under the CCPA and OCPA, and we do not sell or share personal information as those laws define it.

To exercise any right, email tech@getbarista.ai. We respond within one month. Journalists and media contacts wishing to be removed from our database can use the same address or see the Journalist Data Notice.

7. Security

We protect personal data with measures including encryption in transit and at rest, workspace-level data isolation enforced at the database layer, role-based and least-privilege access controls, and logging and monitoring. Details are in Annex 2 of our DPA.

8. Children

The Service is for business use and not directed at anyone under 18. We do not knowingly collect data about minors.

9. Changes

We'll post updates here with a new effective date, and notify account holders of material changes by email.

10. Contact

Barista, Inc.
550 NW Franklin Ave STE 218, Bend OR 97703
tech@getbarista.ai