1. Scope and controller
This Policy explains how BetaRoast, the operator of betaroast.com, collects, uses, discloses and protects personal data when you visit the site, create an account, use Developer or Roaster features, contact support or consent to analytics.
BetaRoast acts as controller for operating the platform. A Developer may be a separate controller for information collected through its own app or test. Review that Developer’s notice as well.
2. Data we collect
The data depends on how you use BetaRoast.
- Account data: Google account ID, verified email, name, profile image, username and sign-in records.
- Profile and device data: bio, testing availability, device model, operating system and settings you provide.
- Testing data: apps, Roasts, tasks, applications, participation, status, findings, bug reports, attachments, discussions and contribution history.
- Finding context when you enable it: the device attached to the test, detected browser and operating system, screen dimensions, language, time zone and orientation to help reproduce an issue. We do not store the full user-agent, passwords or in-app content.
- Support and communications: contact submissions, email content and notification preferences.
- Technical data: approximate IP address, request logs, browser and device type, performance and security information.
- Analytics data with consent: page views, usage events, device data, approximate location, clicks, scrolling, heatmaps and session recordings with form fields masked.
3. Sources of data
We receive data directly from you, from Google when you choose Google Sign-In, automatically through platform use, from Developers or Roasters in the same Roast, and from analytics providers after consent. We do not request or read Gmail data.
4. Purposes and legal bases
We process data only for defined purposes with an appropriate legal basis.
- Provide accounts, Roasts, participation, findings, notifications and support to perform our agreement or take requested steps.
- Secure the service, prevent fraud, enforce rules and maintain trust based on legitimate interests and legal obligations.
- Analyze use through Google Analytics and Microsoft Clarity only with consent, which can be withdrawn at any time.
- Send necessary service messages and requested communications. We do not sell personal data or use it for targeted advertising.
- Create aggregated or de-identified statistics to improve the product and community.
5. Sharing and processors
We do not sell personal data. We disclose only what is needed to contracted service providers, relevant users or as legally required.
- Cloudflare: hosting, compute, D1 database, R2 file storage and Workers AI when you use the optional English translation assistant.
- Google: sign-in and Google Analytics after consent.
- Microsoft: Clarity analytics, heatmaps and session recordings after consent.
- Email providers: transactional email and notifications.
- Developers and Roasters in the same Roast: profile, tasks, progress and findings according to access rights.
- Advisers, authorities or transaction parties: where needed for law, rights protection or an organizational transaction.
6. Public and restricted information
Your username, display name, photo, bio, testing availability and contribution count may be public according to your settings. Public Roast history appears only when enabled. Installation links and restricted details are limited to authorized participants.
Do not include unnecessary personal data, trade secrets, passwords, tokens or sensitive data in findings or discussions.
8. International transfers
Our providers may process data outside Thailand. We select providers with safeguards and use data-processing terms and suitable transfer mechanisms where required. Laws in destination countries may differ from Thai law.
9. Retention
We keep data no longer than needed for its purpose, security, disputes and legal requirements.
- Google OAuth cookie: 10 minutes; session cookie: up to 30 days; consent cookie: 180 days.
- Account, profile and Roast data: for the account lifetime or until deletion; some contribution records may be de-identified to preserve integrity.
- Support and security records: as needed to resolve issues, prevent abuse or meet legal requirements.
- Clarity: playback is generally retained 30 days; click/heatmap data and labeled sessions may be retained up to 9 months according to Microsoft.
- Google Analytics: according to the Analytics account’s retention configuration and Google’s policy; GA4 cookies have a default expiration of up to 2 years.
10. Your rights
Depending on applicable law, you may request access, a copy, correction, portability, objection, restriction or deletion; withdraw consent; and complain to Thailand’s Personal Data Protection Committee. Withdrawal does not affect processing already lawfully completed.
Email privacy@betaroast.com. We may verify identity, limit requests that affect others’ rights and respond within the legal timeframe. Many profile and preference fields can be changed directly in your account.
11. Security
We use proportionate technical and organizational measures such as TLS, HttpOnly/Secure/SameSite cookies, access controls, input validation, secret separation and event logging. No system is perfectly secure. Protect your Google account and report concerns promptly to security@betaroast.com.
12. Children
BetaRoast is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a minor submitted data, contact privacy@betaroast.com so we can investigate and act.
13. Changes and contact
We may update this Policy when the service, law or providers change. We will display the revision date and provide reasonable notice of material changes through the service or contact channels.
Privacy questions and requests: privacy@betaroast.com. General support: support@betaroast.com or our contact page.