Privacy Policy
Root Beer Social Club
Data controller: Root Beer Social Club LLC (Oregon, USA)
Version 1.0 | Effective July 10, 2026
1. Who we are and what this policy covers
This Privacy Policy explains what information Root Beer Social Club LLC, an Oregon limited liability company with a mailing address at 5441 S Macadam Ave, Ste N, Portland, Oregon 97239 (the “Company,” “we,” “us,” and “our”), collects when you use rootbeersocialclub.com and related pages (the “Site”), how we use it, and the rights and choices you have. Where the EU or UK General Data Protection Regulation applies to you, we are the data controller for the personal information described here. Questions or requests: contact@rootbeersocialclub.com.
2. Information we collect
2.1 Information you give us
- Account and profile: your email address when you join the newsletter or create an account; your name and basic profile if you sign in with Google.
- Your contributions: the ratings, reviews, tasting notes, saved recipes, and saved palate profiles (taste-preference settings) you submit or create, and any beverages or details you submit to our catalog.
- Purchases: when you buy from our store, checkout is handled by Shopify; we do not collect or store your full payment-card details.
2.2 Information collected automatically
If you consent, we use Google Analytics 4 to understand how the Site is used, including pages viewed, device and browser type, and cookie identifiers. Google Analytics 4 does not log or store your IP address in a way we can access, and analytics cookies stay off until you opt in through our cookie banner.
Separately from analytics, our infrastructure providers (Google Firebase / Google Cloud) keep short-lived technical logs, such as request metadata, that we use only to keep the service secure and to prevent abuse.
2.3 Where your information is held
We hold account and contribution data in Google Firebase Authentication and Cloud Firestore (in collections for profile, roles, ratings, saved recipes, newsletter subscribers, and submissions). Analytics data is processed by Google Analytics only with your consent. See our cookie policy for the specific cookies and similar local-storage entries we use.
3. Legal bases for processing (EU / UK GDPR)
Where the EU or UK GDPR applies, we rely on the following legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Accounts, sign-in, saved palate profiles, and reviews | Email, name, your ratings and recipes | Performance of a contract (GDPR Art. 6(1)(b)) |
| Newsletter list | Email address | Your consent (Art. 6(1)(a)) |
| Analytics (Google Analytics) | Usage data, cookie identifiers | Your consent (ePrivacy / Art. 6(1)(a)) |
| Store checkout and fulfillment | Handled by Shopify | Performance of a contract (Art. 6(1)(b)) |
| Paid membership billing (when launched) | Handled by our payment processor | Performance of a contract (Art. 6(1)(b)) |
| Site security and abuse prevention | Technical and usage data | Legitimate interests: keeping the service secure (Art. 6(1)(f)) |
You are not required by law or by contract to provide personal data; however, without an email address we cannot create your account, save your contributions, or send you the newsletter.
4. How we use your information
We use your information to operate and improve the Site, send the newsletter you asked for, enable accounts and saved palate profiles, process and fulfill store orders, provide any paid membership, respond to your requests, and keep the service secure. We do not sell your personal information, and we do not make automated decisions that produce legal or similarly significant effects about you.
5. Cookies and analytics
We use strictly necessary cookies and similar local-storage technologies (for sign-in, your cart, and remembering your choices) and, only with your consent, Google Analytics. We apply "Basic" Google Consent Mode, which means analytics does not load until you opt in. You can manage or withdraw consent at any time using “Cookie settings” in the footer. Full details, including an itemized cookie list, are in our cookie policy.
6. Who we share information with
We share personal information only with service providers that run the Site on our behalf, and where required by law. These providers process data under their own terms and our instructions:
- Google (Firebase Authentication, Cloud Firestore, and, with consent, Google Analytics);
- Shopify (store checkout, payment processing, and order fulfillment);
- Our payment processor (for paid membership billing, when that launches);
- An email/newsletter provider (when we adopt one to send the newsletter; sign-in emails are currently sent by Google Firebase).
If you use the barcode lookup when contributing a beverage, your browser queries the Open Food Facts database directly; that request (the barcode and your IP address) is subject to Open Food Facts’ own terms and privacy policy.
We may also disclose information where reasonably necessary to comply with the law, enforce our Terms, or protect the rights, property, or safety of our users or the public. If we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, and we will notify you as required by law. We do not sell your personal information or share it for cross-context behavioral advertising. If we introduce third-party display advertising in the future, we will update this policy and our cookie controls first.
7. International data transfers
We are based in the United States, and our service providers may process data in the United States. For transfers of personal data from the EEA, UK, or Switzerland, we rely on recognized safeguards: Google relies on the EU-US Data Privacy Framework (with the UK Extension and the Swiss-US DPF), and Shopify relies on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. These mechanisms are intended to provide an adequate level of protection for your data. You can ask us for more information about these safeguards using the contact details below.
8. How long we keep your information
- Newsletter: until you unsubscribe.
- Account and related data: until you delete your account.
- Analytics: only for the limited retention window configured in Google Analytics (14 months or less).
- Purchase and billing records: for as long as required by tax, accounting, and other applicable laws.
- Security and infrastructure logs: retained briefly by our infrastructure providers (typically 30 days or less) and then deleted.
9. Your rights (EU / UK GDPR)
If the EU or UK GDPR applies to you, you may request access to, and rectification or erasure of, your personal data; restrict or object to processing; request data portability; and withdraw consent at any time (without affecting processing already carried out). You can download your data or delete your account yourself on your account page, or contact us at contact@rootbeersocialclub.com. You also have the right to lodge a complaint with a supervisory authority, such as an EU member-state data protection authority or the UK Information Commissioner’s Office (ICO).
10. US state privacy rights
Depending on your US state (for example, under California’s CCPA/CPRA and similar laws), you may have the right to know about, access, delete, and correct your personal information, and to opt out of its "sale" or "sharing." We do not sell your personal information or share it for cross-context behavioral advertising. We do not knowingly collect or process sensitive personal information as defined by these laws, and we will not discriminate against you for exercising any of these rights. If that changes (for example, if we add an advertising partner), we will add a "Do Not Sell or Share My Personal Information" control and honor Global Privacy Control signals. To exercise your rights, use your account page or email contact@rootbeersocialclub.com.
11. EU and UK residents
If you are in the EEA or UK, the protections described above apply to you, and you can reach us about your data using the contact details below. We are not currently selling or advertising to the EEA or UK. If we begin doing so and are required to designate an EU representative (GDPR Art. 27) or a UK representative, we will name them and provide their contact details here.
12. Children
The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users aged 13 to 17 may use the Site only as described in our Terms of Use, with the consent of a parent or legal guardian. If we begin targeting the EEA or UK, we will apply the parental-consent age that applies there (under 16, GDPR Art. 8). If you believe a child under 13 has provided us with personal information, contact us and we will delete it.
13. How we protect your information
We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please help protect your account by keeping access to your email secure and signing out on shared devices.
14. Changes to this policy
We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide a more prominent notice. Questions about changes: contact@rootbeersocialclub.com.
15. Contact us
Root Beer Social Club LLC
5441 S Macadam Ave, Ste N, Portland, Oregon 97239
Telephone: +1 (541) 566-8626