mach.coffee

Site under construction.

We are not open yet. Nothing here is finished, and most of it will change before it is.

Taste Zürich — five 50 g samples from the city's best roastersFree shipping on shop orders over 100 CHFMonthly coffee, built around how you brew · Swiss delivery included

Privacy Policy

Last updated: 3 August 2026

This policy explains how we process your personal data when you visit this website, place an order, create an account, subscribe to updates, or use the mach.coffee mobile app. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

Data controller

The controller responsible for your data is PostPeripheral GmbH, Weststrasse 40, 8003 Zürich, Switzerland (see our Impressum). For any privacy request, contact privacy@mach.coffee.

What data we collect and why

DataPurposeLegal basis (GDPR Art. 6)
Email, name, shipping & billing address, order details Process and fulfil your order, provide support, send transactional emails Performance of a contract (Art. 6(1)(b))
Payment details (card / TWINT) Take payment — handled directly by Stripe; we never receive full card numbers Performance of a contract (Art. 6(1)(b))
Email address (newsletter) Send product updates you asked for Consent (Art. 6(1)(a)) — withdrawable at any time
Account session (sign-in link & session cookie) Keep you signed in to view your orders Performance of a contract / legitimate interest (Art. 6(1)(b)/(f))
Order and tax records Comply with accounting and tax obligations Legal obligation (Art. 6(1)(c))

Cookies and local storage

We do not use advertising or analytics cookies and we do not track you across other sites. We use a single strictly necessary cookie (mach_session) to keep you signed in, and your browser's local storage to remember your cart and your language and region preferences. Because these are essential to features you request, none of them require consent.

When you first visit, we show a short privacy notice. Choosing Accept Essential lets us remember your language and region between visits; choosing Reject keeps those preferences for the current visit only. Either way, the strictly necessary cookie and your cart continue to work, and we never load advertising, analytics, or cross-site tracking. Clearing your browser storage resets this choice and removes all of the above.

Fonts and hosting

Web fonts are served from our own servers — we do not load fonts from Google or any other third-party CDN, so your IP address is not shared with a font provider. The site is hosted on Amazon Web Services (AWS) infrastructure and delivered via the Amazon CloudFront content delivery network.

The Tensor One app

This section covers the mach.coffee mobile app for iOS and Android, which controls a Tensor One espresso controller. The app needs no mach.coffee account, contains no analytics, advertising or tracking software, and sends no usage data to us. Everything below stays on your phone or travels directly between your phone and your own equipment.

  • On-device data — brew profiles, uploaded images, shot history, the machine’s display settings and your app preferences are stored locally on your phone. They are not copied to us or to any cloud service.
  • Bluetooth — used only to find and talk to your Tensor One. We do not use Bluetooth to determine or infer your location, and no scan results leave your phone.
  • Photos and camera — when you pick a photo or take one for the machine’s display, it is resized and converted on your phone and sent straight to the machine. We never receive your photos, and the app does not read your photo library beyond the images you choose.
  • Local network — when your machine is on Wi-Fi, the app talks to it directly over your own network for faster transfers and live status. These requests stay inside your network and are not routed through us.
  • La Marzocco account (optional) — connecting your machine uses your La Marzocco account. The email address and password you type go over the encrypted Bluetooth link to your Tensor One, and the controller signs in to La Marzocco’s own servers itself and holds the session from then on — the phone never contacts La Marzocco. Your password is never stored, on the phone or on the Tensor One. The session is used to read and set boiler temperature and to start a cleaning cycle. PostPeripheral GmbH never receives any of it. La Marzocco is an independent company and its own privacy policy governs what it does with your account data.
  • Home Assistant (optional) — if you connect your own Home Assistant server, its address and the access token you create are kept on your phone (in the keychain on iOS, in the app’s private storage on Android) and used only to reach that server. The traffic goes to your server, not to us.
  • Firmware updates — the Tensor One checks for and downloads firmware itself over your Wi-Fi; the update files never pass through the app. Like any download, that request reaches our update server with the machine’s IP address and current version, which appear in ordinary server logs.
  • Feature configuration — the app periodically fetches a small file from mach.coffee that says whether the optional La Marzocco integration is available. It carries no personal data; like any web request, our host sees the device’s IP address and standard request information. This is the only request the app makes to us.

You stay in control of all of it. “Forget device” removes a remembered machine, signing out of La Marzocco or Home Assistant deletes the stored tokens immediately, and deleting the app removes every local profile, image, shot record and preference from your phone. Because none of this data reaches our servers, there is nothing for us to delete on your behalf — but you can always write to support@mach.coffee with questions about the app’s data handling.

Who we share data with (processors)

We share data only with service providers that process it on our behalf:

  • Stripe — payment processing.
  • Kit (formerly ConvertKit) — newsletter delivery (only if you subscribe).
  • Amazon Web Services — hosting, order storage (DynamoDB), and transactional email (SES).

We do not sell your personal data.

International transfers

Some of these providers (Stripe, Kit, and AWS) may process data on servers in the United States or other countries outside Switzerland and the EEA. Where data is transferred outside Switzerland/the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent Swiss data-transfer mechanisms.

How long we keep data

  • Order and accounting records: retained for the statutory retention period (10 years under Swiss law).
  • Account data: kept while your account is active; deleted on request where no legal obligation requires retention.
  • Newsletter data: kept until you unsubscribe or withdraw consent.

Your rights

Subject to applicable law, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased ("right to be forgotten");
  • restrict or object to certain processing;
  • receive your data in a portable, machine-readable format;
  • withdraw consent at any time (e.g. unsubscribe), without affecting prior processing.

To exercise any of these rights, email privacy@mach.coffee. You can manage your saved addresses and payment methods directly from your account.

Right to complain

If you believe we have mishandled your data you may lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.

Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the most recent revision.