Who we are
One rat, four sauces, a very small office.
Super Rat Spices (Mallorca, Spain) runs super-rat-spices.com and is the data controller for everything on this page. We make small-batch hot sauce and flavoured sea salts in Mallorca, in the EU. For anything about your data, email info@super-rat-spices.com.
The waitlist
One form, one email address, one promise.
When you join the pack, you give us your email address. Alongside it we record when and on which page you signed up, the country our host guesses you're in (country only), and the words you agreed to. No name, no IP address, no tracking.
Why: to send you your Rat Pass card (one email with its link), one launch announcement when the sauces or the salts go on sale, plus the occasional update about new products or merch. Nothing else.
Legal basis: your consent (GDPR article 6(1)(a)). You can withdraw it whenever you like, and that doesn't affect anything done before you did.
Where: as a customer record in our Shopify store. Shopify International Limited, Ireland, processes it on our instructions and for nothing of its own.
The salts list: signing up for the salts (on the tray, a salt's own page or the salts band on the homepage) adds a salts-only tag to your record, so the salts list can be told apart from everything else in the store, and keeps a separate note of that sign-up: which page, when, the country our host guesses you're in (country only) and the words you agreed to. If the store already knows your email address, it goes on your existing record instead of a second one. And if you had unsubscribed from our emails before, or never confirmed an earlier sign-up, signing up for the salts switches them back on, because you have just asked us to.
How long: until you unsubscribe, or 24 months after the sauce or salt launch — whichever comes first. Then it's deleted.
Unsubscribe: reply to any email we send you, or write to info@super-rat-spices.com. We never sell or rent the list.
Rat Pass
A card that knows your miles, and only what you tell it.
What we keep:the card number, its miles and their history (when, what was bought, and which crew member or which shop order added it). Optionally, and only if you type them in on the card page: your first name, your email address, and, if you tick the separate box, your consent to offers by email, word for word, with the time. A paper card works with none of these. If you order from our online shop or join the waitlist and your email has no card yet, we make a digital card for it: the same record, with your email on it. When you buy from Jose at the stall or order from him, he can open a Rat Pass in your name there and then, so the miles of what you buy go straight onto it: the card holds the name you gave him, your email only if you give it to him, and the card's miles. If your email already has a digital card, he uses that one instead of making a second.
Why: to run the programme you joined by taking a card or joining the waitlist (GDPR article 6(1)(b)). A digital card made from a shop order, or opened for you by Jose, rests on our legitimate interest in rewarding customers (article 6(1)(f)); reply to its email, ask Jose or write to us, and we delete it. Your email is used only to replace a lost card, to add miles for shop orders made with the same address, to find the card you already have, and to send a digital card made for a shop order or the waitlist its link once. A card Jose opens for you gets no email at all unless you ask for one: you find it by signing in to My Rat Pass with the email you gave him, or Jose shows you its QR code on his phone. Opening one never signs you up for offers. Offers are sent only if you ticked the box (your consent, article 6(1)(a)), which you can withdraw whenever you like.
Where: as a customer record in our Shopify store (Shopify International Limited, Ireland), one per card, with no email unless you add one. If the store already knows your email address, the card is linked to your existing record instead, and your email preferences there stay exactly as they are: the offers box on a card page never changes them. The card page takes your details once; to change them later, ask Jose or write to us.
Who sees it: the card page is private. Search engines are told not to list it, and its address is not shared when you follow a link from it. Anyone holding your card or a photo of its QR code can open the page and see your first name (if you gave one) and your miles, never your email. Only Jose, logged in on his phone, and paid orders from our shop change the miles. If you add the card to Apple or Google Wallet, the pass holds the card number and its link, never your name or email.
My Rat Pass: you can also open your card by signing in at super-rat-spices.com/account with your email, no password. We email you a sign-in link (sent by Resend) that works for 15 minutes; your address travels in it encrypted. Following it puts one sign-in cookie in your browser for 30 days, and logging out deletes it. My Rat Pass shows the digital card we made for your email; if there is none yet, signing in makes one, as above. A paper card with your email typed on its card page shows only by its number, because anyone holding a card can type any address there: it opens from its own QR code, and Jose can move its miles onto your digital card. We use the email only to sign you in and to show you your own card (article 6(1)(b)); asking for a link never signs you up for offers.
Reviews:once a purchase is on your card, its page lets you rate a salt. We keep the stars, your words, the first name you sign with (if any), the card number and the time, on one more record in our Shopify store. Nothing goes on the website until Jose has read it, and only if you ticked that it may (your consent, article 6(1)(a)). On the website a review shows the stars, your words exactly as written, the first name or “A Rat Pass passenger”, and the month: never the card number or anything else about you. Search engines read the stars and signed reviews from the salt's page. To change a review, rate the same salt again; to take it down or have it deleted, write to us with your card number. If you said yes to email from us, we send one email a week after you buy at the stall with your card, asking how the salt was: once per card, never after you have reviewed, and never if you unsubscribed. Reply “stop” and we will not write again.
How long: while the programme runs, or until you ask us to delete it. Deleting it: write to info@super-rat-spices.com with your card number. We delete the record, and the card goes back to “not flown yet”, miles and all.
Merch orders
Shopify takes the money. Printify makes the thing.
Checkout, payment and your order records are handled by Shopify — for EU customers that's Shopify International Limited, Ireland — on super-rat-spices.myshopify.com. We see the order details we need to run the shop (what you bought, where it's going, how to reach you) inside our Shopify admin.
Legal basis: performing our contract with you (GDPR article 6(1)(b)), and keeping invoices and tax records because the law requires it (article 6(1)(c)).
Printing and shipping is done by Printify, Inc. and the print providers it works with. To make and post your order they receive your name, shipping address, email address, phone number if you gave one, and what you ordered — nothing more.
Payments run through Shopify Payments or PayPal. Your card details go straight to them; we never see full card numbers.
Shopify's own handling of your data is described in Shopify's privacy policy.
Hosting & logs
Every website has a landlord.
The site is hosted by Vercel Inc. Like every host, Vercel keeps server logs — including your IP address — for a short time, for security and to keep the site running. Vercel also tells our server your approximate country so checkout can pre-select it. We don't store the IP.
We count visits with Vercel Web Analytics and measure how fast pages load with Vercel Speed Insights. Neither sets a cookie or stores anything in your browser. They record the page, the site you came from, your country, and your browser and device type. Your IP address is only used to make a code that changes every day, so a visit can't be traced back to you or followed from one day to the next. Card pages, sign-in pages and the crew's pages are never counted.
Product photos on the merch pages load from Shopify's image CDN (cdn.shopify.com), which sees your IP address like any server does. It sets no cookies.
Browser storage
One item in your browser's storage (your bag ID), no cookies, no tracking across sites. Crew phones get one login cookie for the Rat Pass, and so does a passenger who signs in to My Rat Pass. Nobody else gets one. The whole story is in the cookie policy.
Who we share with
The short list. Nobody buys it.
- Vercel Inc. — hosting, server logs, and the anonymous visit counts and page-speed measurements.
- Shopify (Shopify International Limited, Ireland, for EU customers) — the waitlist, Rat Pass cards, checkout, payments, order records, and the merch product photos (cdn.shopify.com).
- Printify, Inc. and its print providers — printing and shipping merch orders.
- Payment providers — Shopify Payments and PayPal, for taking payment.
- Resend, Inc. — sends the one email with a digital Rat Pass card's link, and the My Rat Pass sign-in links you ask for.
- WalletWallet — makes the Apple and Google Wallet pass when you ask for one: the card number and its link only.
Each of them gets only what it needs to do its job. Vercel, Printify and Resend are based in the United States, so some of your data is processed outside the EU. Depending on the provider, those transfers rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses; email us for a copy. We never sell or rent your data, and we don't share it for advertising.
How long we keep things
- Waitlist: until you unsubscribe or 24 months after the sauce or salt launch, whichever is first.
- Rat Pass cards: while the programme runs, or until you ask us to delete yours.
- Reviews: while the programme runs, or until you ask us to delete yours.
- Order records: as long as Spanish tax and consumer law requires, then deleted.
- Server logs: kept briefly by Vercel for security and operations, then gone.
Your rights
It's your data. You hold the bottle.
Under the GDPR (articles 15 to 22) you can ask us to:
- Access — see what we hold about you.
- Rectify — correct it.
- Erase — delete it.
- Restrict — pause what we do with it.
- Port — get a copy you can take elsewhere.
- Object — to any use you're not happy with.
- Withdraw consent — at any time, for the waitlist and for Rat Pass offers.
Email info@super-rat-spices.com and we'll sort it — no forms, no hoops. If you think we've got something wrong, you can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at aepd.es.
Children
This site and the waitlist aren't directed at anyone under 16. If you're a parent or guardian and think a child has given us their email, tell us and we'll delete it.
Changes & contact
If we change how we handle your data, this page changes first and the date below moves. Anything that needs fresh consent gets asked for properly. Questions: info@super-rat-spices.com.