Privacy Policy

Cupsa coffee subscription · Last updated 22 July 2026

This policy explains what the Cupsa apps collect, why, and what you can do about it. It covers the Cupsa customer app and the Cupsa Barista staff app. Cupsa is operated by ATOMATE FZE, United Arab Emirates.

The short version. We collect your phone number so you can sign in, your order history so the subscription works, and a device token so we can tell you your coffee is ready. We never see or store your card number. We do not sell your data and we do not use it for advertising.

What we collect

Data	Why
Phone number	It is your account. We send a one-time code to it to sign you in.
Name and email (optional)	Shown in your profile and on receipts. You can leave both empty.
Profile photo (optional)	Only if you upload one.
Orders	Which drink, which café, and when — this is how your plan allowance is counted.
Approximate location	Only while the app is open, to show cafés near you on the map and to check that a redemption happens at the café it claims. Deny it and everything except map centring still works.
Device notification token	To send you “your coffee is ready”. Removed when you sign out or delete your account.
Camera	Used only to read a QR code, in the moment you point it. No images are stored or transmitted.
Crash and diagnostic data	To find bugs. Contains no message content or card data.

Payments

Card payments are processed by Stripe. Your card number, expiry and CVC are entered into Stripe’s own secure form and are never sent to or stored on Cupsa servers. We keep only the payment result, the amount, and the last four digits Stripe returns so you can recognise the card.

Who else processes your data

Stripe — payments and subscription billing.
Google Firebase — push notifications, crash reports, basic usage statistics.
Google Maps — the café map.
Amazon Web Services — hosting, in the Frankfurt region (eu-central-1).
Partner cafés — a café you order from sees your first name, the drink, and the order number. Cafés never see your phone number, email or payment details.

We do not sell your personal data, and we do not share it with advertisers.

How long we keep it

Account and profile — until you delete your account.
Orders and payment records — kept after account deletion, because we are required to retain financial records. They are no longer linked to your name, email or phone number.
Notification tokens — deleted at sign-out or account deletion.

Deleting your account

In the app: Profile → Delete account. This closes your account immediately, cancels any active subscription, erases your name, email and photo, removes your devices from notifications, and frees your phone number so it can be used to register again. Past orders remain as anonymised financial records, as described above.

You can also write to privacy@cuppa.one and we will do it for you.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Write to privacy@cuppa.one and we will respond within 30 days.

Children

Cupsa is not intended for children under 13, and we do not knowingly collect their data.

Changes

If we change this policy materially we will tell you in the app before the change takes effect. The date at the top always reflects the current version.