Privacy Policy
Last updated: 1 June 2026
This policy explains how we process your personal data when you visit this website, place an order, create an account, or subscribe to updates. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).
Data controller
The controller responsible for your data is PostPeripheral GmbH, Weststrasse 40, 8003 Zürich, Switzerland (see our Impressum). For any privacy request, contact privacy@tensorcoffee.com.
What data we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email, name, shipping & billing address, order details | Process and fulfil your order, provide support, send transactional emails | Performance of a contract (Art. 6(1)(b)) |
| Payment details (card / TWINT) | Take payment — handled directly by Stripe; we never receive full card numbers | Performance of a contract (Art. 6(1)(b)) |
| Email address (newsletter) | Send product updates you asked for | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Account session (sign-in link & session cookie) | Keep you signed in to view your orders | Performance of a contract / legitimate interest (Art. 6(1)(b)/(f)) |
| Order and tax records | Comply with accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
Cookies and local storage
We do not use advertising or analytics cookies and we do not track you across other sites.
We use a single strictly necessary cookie (tc_session) to keep you signed in,
and your browser's local storage to remember your cart, language, and region preferences.
Because these are essential to features you request, none of them require consent.
When you first visit, we show a short privacy notice. Choosing Accept Essential lets us remember your language and region between visits; choosing Reject keeps those preferences for the current visit only. Either way, the strictly necessary cookie and your cart continue to work, and we never load advertising, analytics, or cross-site tracking. Clearing your browser storage resets this choice and removes all of the above.
Fonts and hosting
Web fonts are served from our own servers — we do not load fonts from Google or any other third-party CDN, so your IP address is not shared with a font provider. The site is hosted on Amazon Web Services (AWS) infrastructure and delivered via the Amazon CloudFront content delivery network.
Who we share data with (processors)
We share data only with service providers that process it on our behalf:
- Stripe — payment processing.
- Kit (formerly ConvertKit) — newsletter delivery (only if you subscribe).
- Amazon Web Services — hosting, order storage (DynamoDB), and transactional email (SES).
We do not sell your personal data.
International transfers
Some of these providers (Stripe, Kit, and AWS) may process data on servers in the United States or other countries outside Switzerland and the EEA. Where data is transferred outside Switzerland/the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent Swiss data-transfer mechanisms.
How long we keep data
- Order and accounting records: retained for the statutory retention period (10 years under Swiss law).
- Account data: kept while your account is active; deleted on request where no legal obligation requires retention.
- Newsletter data: kept until you unsubscribe or withdraw consent.
Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to certain processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time (e.g. unsubscribe), without affecting prior processing.
To exercise any of these rights, email privacy@tensorcoffee.com. You can manage your saved addresses and payment methods directly from your account.
Right to complain
If you believe we have mishandled your data you may lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.
Changes to this policy
We may update this policy from time to time. The "last updated" date above reflects the most recent revision.