Privacy Policy

Rootstock (⟨registered entity name⟩, ⟨registered address⟩, Dutch Chamber of Commerce no. ⟨KvK number⟩) operates this marketplace and is the controller for the personal data described in this policy. You can reach us at ⟨contact email⟩.

The producers you buy from are independent businesses and the seller of record for your order. To fulfil it they receive your order details and act as independent controllers for that processing; their own privacy statements apply alongside this one.

• Account data — your email address, display name, and whether the account is a consumer or producer account. If you sign in with Google, we receive your name and email address from Google.
• Order data — the products you bought, amounts paid, and the shipping address you enter at checkout.
• Payment data — payments are processed by Stripe. Your card details go directly to Stripe and are never seen or stored by us. We also never store identity documents, bank details, or dates of birth in our own systems.
• Public contributions — reviews, product questions, and likes you post, shown together with your display name.
• Messages — direct messages you exchange with producers. They are not end-to-end encrypted; we store them to deliver the feature and look at them only when a conversation is reported.
• Reports — if you report a conversation, we store the report and the reason you give.
• On your device only — your cart and your light/dark theme choice are kept in your browser’s local storage and are not sent to our servers.

• To perform our contract with you — running your account, processing orders, and delivering messaging and other marketplace features.
• Legitimate interests — keeping the platform secure, preventing fraud and abuse (including Google reCAPTCHA on a small number of sensitive actions), and moderating reported content.
• Legal obligations — tax and bookkeeping rules that require us to keep transaction records.

We do not run advertising, do not sell personal data, and make no automated decisions with legal or similarly significant effects.

• Producers — the producer you order from receives your name, shipping address, and order contents; a producer you message or ask a question sees your display name and the content you send.
• Stripe — our payment processor.
• Google Cloud / Firebase — our hosting and database provider.
• Google reCAPTCHA — abuse protection on selected actions such as submitting a review or paying.

Our database and backend run in Google Cloud’s European Union regions. Where a provider such as Stripe or Google transfers data outside the EU, that transfer is covered by recognised safeguards (such as the EU Standard Contractual Clauses or an adequacy decision).

• Account data — until you delete your account.
• Order and payment records — for the statutory retention period (in the Netherlands generally seven years for bookkeeping records).
• Reviews and questions — as long as the product or producer page exists, unless you delete them.
• Messages and reports — until the related accounts are deleted.

Under the GDPR you can ask us for access to, correction, deletion, or a portable copy of your personal data, ask us to restrict processing, and object to processing based on legitimate interests. Contact us at ⟨contact email⟩ to exercise these rights. You can also lodge a complaint with the Dutch supervisory authority (Autoriteit Persoonsgegevens) or the authority in your own country.

We use no analytics, advertising, or tracking cookies, which is why you see no cookie banner. The only storage on your device is strictly necessary: your sign-in session (Firebase Authentication), your cart and theme preference (local storage, never sent to us), Stripe’s fraud-prevention cookies on the checkout pages, and Google reCAPTCHA on the few actions it protects. If we ever add analytics or marketing technology, we will introduce a consent choice first.

Rootstock sells alcoholic beverages and is not intended for anyone under 18. We do not knowingly collect data from minors.

We will update this policy as the platform evolves and show the date of the latest revision at the top. For significant changes we will notify you through the platform.