[LEGAL ENTITY NAME], [COMPANY NUMBER], and [REGISTERED ADDRESS] throughout this page with your actual company details.1. Who We Are
Cuppd is operated by [LEGAL ENTITY NAME] (company number [COMPANY NUMBER]), registered in England and Wales at [REGISTERED ADDRESS] (“Cuppd”, “we”, “us”, or “our”).
We operate the website at cuppd.coffee and the Cuppd mobile application (together, the “Platform”).
For the purposes of UK GDPR and EU GDPR, we are the data controller for personal data collected through the Platform.
Contact us about privacy:
Email: privacy@cuppd.coffee
Post: [REGISTERED ADDRESS]
2. What This Policy Covers
This policy explains:
- What personal data we collect about you
- Why we collect it and what legal basis we rely on
- How we use it and who we share it with
- How long we keep it
- Your rights as a data subject
- How to contact us with questions or requests
This policy applies to all users of the Platform, including consumers, registered app users, and roastery partners.
3. Data We Collect
3.1 Data You Give Us Directly
| Data | When collected |
|---|---|
| Email address | Waitlist signup, account creation, roastery claim form |
| Name or username | Account creation |
| City or location (self-reported) | Waitlist signup, app onboarding |
| Roastery name, contact email, city, website | Roastery claim form |
| Communications you send us | Support emails, feedback submissions |
3.2 Data We Collect Automatically
| Data | Source |
|---|---|
| IP address | Server logs, Sentry error tracking |
| Browser type and version | Analytics |
| Device type and operating system | App telemetry |
| Pages and screens visited | Google Analytics 4, PostHog |
| Actions taken (buttons clicked, features used) | PostHog product analytics |
| App crashes and errors | Sentry |
| Referral source | Analytics |
3.3 Data We Do Not Collect
- We do not collect payment card data directly. Any future in-app purchases will be processed via Apple Pay, Google Pay, or Stripe — we will not store card numbers.
- We do not collect precise GPS location data. Location references are city-level and self-reported.
4. Why We Process Your Data and Our Legal Basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Cuppd service | Account data, usage data | Contract — necessary to provide the service |
| Sending the waitlist launch notification email | Email address | Legitimate interests — you submitted your email to be notified |
| Sending transactional emails (welcome, password reset) | Email address | Contract — necessary for account management |
| Sending marketing emails and product updates | Email address | Consent — withdraw at any time via unsubscribe |
| Processing roastery claim requests | Roastery name, contact email, city | Legitimate interests — following up on a B2B enquiry you submitted |
| Product analytics and improving the Platform | Usage data, device data | Legitimate interests — improving our product |
| Error tracking and platform stability | IP address, device data, crash logs | Legitimate interests — maintaining a functioning service |
| Complying with legal obligations | As required | Legal obligation |
5. Cookies and Tracking Technologies
We use cookies and similar technologies on the cuppd.coffee website.
| Cookie type | Purpose | Can you opt out? |
|---|---|---|
| Essential | Session management, authentication | No — required for the site to function |
| Analytics | Google Analytics 4 — aggregate traffic and behaviour | Yes — via our cookie banner |
| Product analytics | PostHog — in-app feature usage and funnel tracking | Yes — via our cookie banner |
| Marketing | Meta Pixel — building ad audiences from website visitors | Yes — via our cookie banner |
You can manage your cookie preferences at any time by clicking the “Cookie settings” link in the footer.
6. Who We Share Your Data With
We do not sell your personal data. We share data with the following third-party processors only to the extent necessary to operate the Platform.
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Ireland) |
| Vercel | Website hosting | EU (Frankfurt) |
| Railway | Backend API hosting | EU (Frankfurt) |
| Cloudinary | Image storage and delivery | EU |
| Algolia | Search | EU (Ireland) |
| Resend | Transactional email | EU |
| Klaviyo | Email marketing and waitlist management | US (SCCs in place) |
| PostHog | Product analytics | EU (cloud) |
| Google Analytics 4 | Website analytics | US (SCCs in place) |
| Sentry | Error tracking | US (SCCs in place) |
| Meta (Facebook) | Ad audience building via Meta Pixel | US (SCCs in place) |
All processors are bound by data processing agreements. Where processors are based outside the UK or EU, we use Standard Contractual Clauses (SCCs) or equivalent safeguards.
7. Data Retention
| Data | Retention period |
|---|---|
| Active account data | Retained while your account is active |
| Waitlist email (pre-launch) | Deleted 12 months after the app launch date, or on unsubscribe |
| Roastery claim lead data | 2 years for ops and legal purposes |
| Analytics data | Individual events retained for 12 months |
| Error logs (Sentry) | 90 days |
| Transactional email records | 12 months |
8. Your Rights
Under UK GDPR and EU GDPR, you have the following rights:
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate data |
| Erasure | Ask us to delete your data (“right to be forgotten”) |
| Portability | Receive your data in a machine-readable format |
| Restriction | Ask us to pause processing in certain circumstances |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Where we rely on consent, you can withdraw at any time |
To exercise any of these rights, email privacy@cuppd.coffee. We will respond within 30 days.
Right to complain: If you are unhappy with how we have handled your data, you may contact:
- The Information Commissioner's Office (ICO) — ico.org.uk — if you are based in the UK
- The Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt — if you are based in Portugal
- The supervisory authority in your country of residence if based elsewhere in the EU
9. Children
The Platform is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact privacy@cuppd.coffee and we will delete it promptly.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by email (if you have an account) or by displaying a notice on the Platform. The “last updated” date at the top of this page reflects the most recent version.
11. Contact
Email: privacy@cuppd.coffee
Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]
Questions about this document?
Email us at privacy@cuppd.coffee and we will respond within 30 days.