Privacy Policy

This Privacy Policy explains how Coffeein7 ([Your registered business name], ABN [XX XXX XXX XXX]) collects, uses, discloses, and protects your personal information. We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

1. What we collect

• Customers: your phone number, first name (optional), order history at participating cafés, loyalty stamp count, Beans balance, and any notification consent.
• Café Owners: your Google account email (if you use Google sign-in), café name/slug, ABN (if provided), and admin activity logs.
• Payments: we do not store full card numbers. Card data is handled directly by Stripe (PCI-DSS Level 1 compliant).
• Technical data: IP address, device type, browser, service-worker push subscription tokens if you opt in to notifications.

2. How we use it

• To process your orders and apply loyalty rewards.
• To notify you when your order is ready (only if you opt in).
• To provide café owners with anonymised analytics about their customer base.
• To improve the platform and prevent fraud.

3. Marketing

We only send marketing messages when you explicitly opt in — pre-ticked boxes are never used. You can unsubscribe at any time by tapping “unsubscribe” in any message or emailing us. This complies with the Spam Act 2003 (Cth).

4. Sharing

Your data is never sold. We share it only with:

• The specific café you order from (your name and last-4 digits of your phone, so the barista knows whose coffee is whose).
• Service providers we depend on: Stripe (payments), our hosting provider, email/SMS providers if enabled.
• Law enforcement when compelled by a valid warrant or court order.

5. Cross-café identity

When you use your phone number at a second Coffeein7 café, we display your first name to that café’s owner as an “Is this you? Sam” verification prompt. No spend data, order history, or other personal details are shared cross-café without your consent.

6. Where your data is stored

Data is stored on servers hosted within the Asia-Pacific region. Coffeein7 uses industry-standard encryption in transit (TLS 1.2+) and at rest.

7. Your rights

You can request a copy of your data or ask us to delete it by emailing admin@coffeein7.com. We respond within 30 days. You can also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Data retention

Order and loyalty data is retained while your account is active plus 24 months of inactivity, after which anonymised aggregates are kept and personal identifiers are deleted.

9. Cookies

We use minimal cookies and browser storage strictly for authentication, cart state, and saving your phone number locally so you don’t have to re-enter it. We do not use third-party ad-tracking cookies.

This document is a plain-language draft. Please have a privacy lawyer review it before public launch, and update the ABN and business details in section 1 above.