Privacy Notice

BeersOn is operated by Onfo Labs, a trading name of Onfo Ltd. Onfo Ltd is registered in England and Wales under company number 16920128.

General enquiries: hello@beerson.com. Privacy enquiries: privacy@beerson.com.

Depending on how you use BeersOn, we may process Supabase user IDs, email addresses, Google profile or name metadata, display name, first and last name, account status, future avatar fields, favourite drinks, favourite ordering, favourite pubs, signed-in drink sightings, historical guest drink sightings, serving format, optional sighting notes, historical anonymous guest-session identifiers and timestamps.

We also process publican, producer and administrator access records, media upload metadata, QR-code configuration data, technical hosting and authentication logs, and possible request, device or security metadata. Exact GPS collection is not currently active in the customer logging flow, although location fields exist for possible future use.

We collect information when you use the site, confirm the age gate, sign in with Google, save drinks or pubs, submit drink sightings, use publican, producer or administrator areas, contact us, or when our hosting and authentication providers generate technical logs.

We use information to provide the public pub and drinks service, authenticate accounts, provide customer favourites and history, process signed-in sightings, retain historical guest sightings, prevent duplicate submissions and misuse, operate and secure BeersOn, administer publican, producer and administrator access, maintain catalogue data and media, respond to support and privacy requests, meet legal obligations, and establish or defend legal claims where necessary.

We use contract, or steps requested by you before entering a contract, for account and service functionality. We use legitimate interests to operate, secure, prevent misuse of and improve BeersOn. We use legal obligation where applicable. We only rely on consent where a future optional activity genuinely requires consent.

Accepting this Privacy Notice is not treated as consent.

New community drink reports require a signed-in BeersOn account. Historical guest sightings and their opaque guest-session identifiers remain retained under the policy that applied when they were submitted. Optional notes should only include information relevant to the sighting.

Raw sightings are private community signals and are not automatically official pub listings.

If you choose Google sign-in, Google and Supabase process the authentication flow and may provide identity metadata such as your email address and name. Using Google for a pub application does not by itself create a BeersOn customer profile. A customer profile is created when you deliberately begin or use the personal BeersOn experience. Customer profiles remain separate from admin, publican and producer access.

Saved drinks and saved pubs are explicit customer choices. They are linked to your Supabase user ID and are not inferred from drink sightings.

Protected business and administrator access is checked against role records such as publicans, producer contacts and administrators. These may include contact details, role or status fields and linked pubs or producers.

When you apply for publican access, we process your verified account identity, contact details, role and relationship to the pub, the pub details you submit, Publican Terms acceptance, application messages, review status and decision history.

Authorised BeersOn administrators may privately compare submitted pub details with existing records, record internal review notes and investigate duplicate or competing applications. Match candidates, other applicants, existing memberships and private notes are not shown to applicants or on public pages.

We use this information to assess authority, prevent unauthorised pub access, resolve duplicate records, administer approved memberships, secure BeersOn and maintain appropriate business and audit records.

When a publican contacts BeersOn support, we may process account and related-pub context, publican messages, replies from the BeersOn team, request status, conversation and audit history, and private internal operational notes.

We use this information to respond to requests, secure the service, investigate problems and maintain appropriate business records. Internal operational notes are restricted to authorised BeersOn administrators and are not shown in publican support history.

BeersOn uses essential cookies for age confirmation, secure sign-in, guest logging and core features. BeersOn does not currently use advertising or behavioural-tracking cookies. See the Cookie Policy.

We use Supabase for authentication, database and storage infrastructure, and Vercel or another hosting provider for application hosting and technical logs. Google is involved when you choose Google sign-in.

We may share information with professional advisers, regulators, courts or public authorities where required. New service providers will be reflected in this notice when introduced.

Some providers may process information outside the UK. Exact processing regions were not visible in the repository and should be confirmed from the provider dashboards before launch.

The age-confirmation cookie lasts 12 months. The guest-session cookie lasts 12 months. The OAuth return cookie lasts up to 10 minutes and is cleared after the callback. Supabase authentication cookies follow the active authentication session lifecycle.

Customer profiles are kept while the account remains active and afterwards only where reasonably necessary. Favourites are kept until removed by the customer or deleted with the account. Sightings are retained while needed for contribution history, moderation, duplicate prevention, service integrity and legal requirements. Guest sightings include an expiry field, but automated purge implementation is still being finalised.

Support and privacy correspondence is kept as long as needed to deal with the request and keep an appropriate record. Technical logs and backups follow provider and operational retention settings.

We use access controls, role checks, secure cookies where appropriate, row-level security and server-side validation. No online service can be guaranteed to be completely secure.

Depending on the circumstances, you may have rights to access, correct, delete, restrict or object to processing of your information, receive portable data, and withdraw consent where processing relies on consent.

These rights do not always apply in every situation. We may need to verify your identity before completing a request.

To request a copy of your data or account deletion, email privacy@beerson.com. Automated account deletion and export tools are not currently built.

You can contact the UK Information Commissioner's Office at ico.org.uk. We would welcome the chance to deal with your concern first.

We may update this notice as BeersOn changes. The latest version will be posted on this page.

Privacy and data-protection enquiries: privacy@beerson.com. General enquiries: hello@beerson.com.