Effective September 25, 2026
This policy explains what personal information Bots n' Beans (botsnbeans.com, the "site") collects, why, who we share it with, how long we keep it, and the choices and rights you have. "We", "us" and "our" mean Peter Kappes, doing business as Bots n' Beans, the operator of the site.
Short version: we collect what you give us to run your account and the community, we keep a simple first-party log of page views and link clicks, and we use Google Analytics 4 to measure traffic and usage. We do not sell personal information; Google Analytics sharing with Google as a service provider is described in sections 5 and 11.
1. Who we are
The site is operated by Peter Kappes, doing business as Bots n' Beans, based in Eagle, Idaho, USA (mailing address: 141 N. Palmetto Ave #201, Emmett, Idaho 83616, USA). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the "controller" of the personal information described in this policy.
Privacy questions and requests: peter@botsnbeans.com, or the contact form. We aim to reply within 30 days.
We have not appointed an EU/UK representative. EU/UK visitors can contact us at peter@botsnbeans.com.
2. Information we collect
Account information. When you create an account with email and password we store your email address, the name you give us, and a one-way hash of your password (never the password itself). When you sign up we check your chosen password against the Have I Been Pwned breach database using a privacy-preserving method: only the first 5 characters of a hash of the password leave our server.
Social sign-in. If you choose "Continue with LinkedIn" or "Continue with Google", that provider sends us your name, email address, whether the provider has verified that email, your profile photo URL and a provider account ID. We store these to create and sign in to your account. We do not receive your LinkedIn or Google password, and we do not post anything to those accounts. See section 6.
Profile information (optional). Handle, display name, bio, profile photo and banner, favourite coffee, usual coffee shop, headline, city/region/country, current title and company, open-to-work / hiring / open-to-collaborate flags, about text, experience, education, skills, interests, projects, certifications, links to other profiles, role type, industry, how you heard about us, and gender. Gender is optional (including "prefer not to say"), is never displayed, and is used only to pick a default avatar when you have not uploaded a photo.
Business card scan (optional). When you sign up or edit your profile you can photograph your own business card to fill in the form. See section 9.
Content you post. Community posts, comments, emoji reactions, podcast ratings and comments, and photos you upload with them. Company managers can also publish company profile content, videos and images.
Activity on your account. Items you save (robots, articles, jobs), people and companies you follow, connection requests, events you mark as attending, podcast episodes you play and how far you got, and your notification and visibility settings.
Direct messages. Messages you send to other members or to companies on the site, plus block and report actions. See section 8.
Forms. Contact, newsletter sign-up, add-a-company, sponsor enquiry, shop order request, humanoid purchase/lease/pre-order requests, company ownership claims (name, work email, job title, optional LinkedIn URL), the Meet / card-exchange page, and job alert sign-ups (email address and the job filters you chose).
Technical and usage information. When you use the site our hosting provider receives your IP address, browser user agent and the pages you request. When you sign in we store the IP address and user agent with your session record for security. Our own activity log records page views and link clicks (see section 5). To limit spam we store a one-way hash of your IP address (and of the email address you typed) for about two days when you submit a form.
Email events. Our email provider tells us if an email to you bounced or was marked as spam, so we stop emailing that address. Some notification emails may record link clicks (see section 5).
3. Where we get information
- From you, when you create an account, fill in your profile, post, message, or submit a form.
- From LinkedIn or Google, when you choose to sign in with them.
- Automatically, from your browser and device when you visit (IP address, user agent, approximate city derived from your IP address, pages viewed, links clicked).
- From business contacts and public sources for our business contact list (CRM): business cards exchanged with us in person, our earlier website and email list, and contact details people have published for business purposes. See section 10.
- From public sources for site content: public job postings on employers' own job boards, public LinkedIn and X posts by people and companies we cover, and public video and podcast feeds.
4. How we use information, and our legal bases
If you are in the European Economic Area or the United Kingdom, GDPR requires us to name a legal basis for each use. We rely on:
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, sign you in, keep you signed in | Account, social sign-in, session data | Performance of a contract (our Terms) |
| Show your profile, posts, comments, reactions, attendance and saves as you choose | Profile, content, activity | Performance of a contract |
| Deliver direct messages and email you when one is waiting | Messages, email address | Performance of a contract |
| Send service emails: confirm email, reset password, confirm an email change, connection and message notices | Email address, name | Performance of a contract; legitimate interests |
| Send job alerts you asked for | Email, job filters | Consent (you turn alerts on; unsubscribe any time) |
| Newsletter sign-up | Email address | Consent (withdraw any time) |
| Answer contact, sponsor, company, shop and robot request forms | Form contents | Steps at your request before a contract; legitimate interests |
| Keep a business contact list (CRM) and follow up on business conversations | Business contact details | Legitimate interests in running and growing the business |
| Read a business card photo you choose to scan | Card photo, extracted fields | Consent (you choose to scan) / your request |
| Understand which pages and links are used (first-party activity log) | Page path, link clicked, city, hashed IP, name/email if signed in | Legitimate interests (see section 5 to object) |
| Measure traffic and usage with Google Analytics 4 | Analytics cookie, device and browser information, pages viewed, approximate location, referrer | Consent where required; legitimate interests where permitted |
| Security, abuse and spam prevention, moderation, rate limits, enforcing our Terms | Technical data, hashed IPs, reports, content | Legitimate interests; legal obligation where applicable |
| Comply with law and respond to lawful requests | As required | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and you can object (see section 13). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not build advertising profiles.
7. What other people can see
- Public to everyone, including search engines: your handle, display name, profile photo, bio, favourite coffee, usual coffee shop, your community posts, comments and reactions, event attendance ("I'm attending" also posts a notice to the community feed), and the profile fields you leave set to "public".
- Visible only to signed-in members: profile location, experience and education when you set them to "members", and connection lists.
- Podcast listening history is shown on your profile by default. You can hide it in your profile settings.
- Search engines: your post pages can appear in search results.
- Never shown: your email address, password, gender, phone number, and IP address.
Anything you post publicly can be copied or shared by others before you delete it. Please do not post other people's private information.
8. Direct messages
Messages are stored on our servers so they can be delivered and shown to the participants. They are not end-to-end encrypted. Recipients never see your email address; they get an email notice with a link back to the conversation.
Messages sent to a company are readable by that company's approved managers on the site. Our administrator tools show message counts and reported conversations, not message text. We may review the messages in a conversation that has been reported to us, or when needed to investigate abuse, protect safety, or comply with law. You can block other members and report conversations.
9. Business card scanning and other AI features
Scanning your own card. When you choose to scan your business card at sign-up or on your profile, the photo is sent to an AI vision model, currently Google Gemini, through the Vercel AI Gateway, which returns the text fields it reads (name, title, company, email, phone, website, LinkedIn, location). The photo is processed in memory for that request only: we do not store it, and we do not log it. You review and can edit every field before saving. The providers process the image to return a result, under their own terms.
Cards we receive in person. When someone hands a business card to our team, we may photograph it and use the same AI model to read it into our business contact list. In that case the card photo may be kept with the contact record in our private database, visible only to our administrators. See section 10.
We do not use your content to train AI models, and we do not use AI to make decisions about you. AI output can be wrong, which is why every scanned field is shown for review.
10. Business contacts (CRM)
We keep a private business contact list to run Bots n' Beans: partners, sponsors, companies, people we meet at events, and people who contacted us or signed up for updates. A contact record can include name, job title, company, work and company email, phone, website, LinkedIn URL, location or address, industry, tags and notes, and, for cards we photographed, the card image.
How we got it: from forms you submitted on this site (contact, newsletter, add-a-company, sponsor, Meet page, humanoid requests), business cards exchanged with us in person, and contacts carried over from our earlier website and email list (including its newsletter subscribers and registered users).
How we use it: to reply to you, follow up on business conversations, send updates you signed up for, and understand our network. Only our administrators can see the list. We do not sell it.
Member profiles for business contacts. For some business contacts we may create a basic member profile showing name, title, company and, if you have a public Gravatar image linked to your email, that image. Your email address and phone number are never shown, and the profile cannot be signed in to. If you find a profile of yourself that you did not create, contact us and we will remove it or hand it over to you.
You can ask what we hold about you, ask us to correct or delete it, or opt out of any emails at any time using the contact details in section 16.
11. How long we keep information
| Information | How long |
|---|---|
| Account and profile | While your account is open. After you ask us to close it, we delete or anonymise it within 30 days, except where we must keep something by law. |
| Posts, comments, reactions | Until you delete them or your account is closed. You can delete your own posts and comments at any time. |
| Direct messages | Until your account is closed. The other participant keeps their copy of the conversation. |
| Sign-in sessions (with IP address and user agent) | About 7 days after last use. |
| Activity log | Rolling: only the 500 most recent events are kept. |
| Form spam-protection hashes | About 2 days. |
| Form submissions and business contacts (CRM) | Until you ask us to delete them, or 3 years after our last contact with you. |
| Job alert subscriptions | Until you unsubscribe (every alert has a one-click unsubscribe link). |
| Bounce and spam-complaint records | As long as needed to make sure we never email that address again. |
| Hosting provider logs | According to our hosting provider's standard log retention. |
| Backups | Deleted data can remain in database backups until they roll over under our providers' backup schedules. |
12. Security
We use HTTPS everywhere, store passwords only as hashes, reject passwords found in known data breaches, rate-limit sign-in, sign-up and password reset, sign other devices out when you change or reset your password, encrypt stored sign-in tokens, keep sign-in cookies secure and host-only, restrict direct access to our database to our own server, and keep business card photos in a private, admin-only store. Security headers limit framing and other browser risks.
No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires. Please use a unique password and tell us about any security issue through the contact details below.
13. Your rights and choices
Everyone. You can edit your profile, delete your own posts and comments, hide your podcast history, turn off search-engine indexing of your posts, turn off network email alerts, unsubscribe from job alerts, block members, and turn off pop-ups. To close your account, get a copy of your data, or make any other request below, contact us (section 16). We will verify your identity before acting on a request, for example by asking you to write from the email address on your account.
EEA and UK (GDPR / UK GDPR). You have the right to access, correct, delete, restrict or object to our processing of your personal information, to data portability, and to withdraw consent at any time. You can object at any time to processing based on legitimate interests, including the activity log and our business contact list. You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office).
California (CCPA/CPRA) and other US states with privacy laws. You have the right to know what personal information we collect, use and disclose; to access and get a copy of it; to correct it; to delete it; and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising. Google Analytics information is disclosed to Google LLC as a service provider for traffic and usage measurement, as described in section 5; where required, analytics cookies load only after consent. We do not use sensitive personal information for purposes that would give you the right to limit it. You may use an authorised agent to make a request; we may ask for proof of authorisation. In the past 12 months we have collected the categories described in section 2: identifiers (name, email, IP address, account IDs), professional information (title, company, work history), internet activity (pages viewed, links clicked), approximate location (city), and user content. We do not create inferences or profiles about you. We disclosed them for business purposes only to the service providers that run the site.
We respond to verified requests within the time the law requires (generally 30 days under GDPR and 45 days under the CCPA).
14. International transfers
We are based in the United States and our providers process data in the United States and possibly other countries. Our database is hosted by Supabase in the region shown in our records, available on request. If you use the site from outside the US, your information will be transferred to and stored in the US, where data protection laws may differ from yours. For transfers from the EEA, UK or Switzerland we rely on our providers' Standard Contractual Clauses (and the UK Addendum) or their certification under the EU-US Data Privacy Framework, where available.
15. Children
The site is not directed to children. You must be at least 13 years old to create an account, and at least 16 if you live in the EEA or the UK. We do not knowingly collect personal information from children under these ages. If you believe a child has given us personal information, contact us and we will delete it.
16. Contact us
Peter Kappes, doing business as Bots n' Beans, 141 N. Palmetto Ave #201, Emmett, Idaho 83616, USA. Email: peter@botsnbeans.com. Or use the contact form.
17. Changes to this policy
We will update this policy when our practices change and change the effective date at the top. If a change is material, we will tell signed-in members on the site or by email before it takes effect.
See also our Terms and Conditions.
See also the Terms and Conditions.
6. Signing in with LinkedIn or Google
Social sign-in is optional; you can always use email and password instead. If you use it: