Privacy Policy

The data controller responsible for your personal data is:

We use your personal data for the following purposes:

We collect your precise location only when you initiate a drink redemption, to confirm you are physically present at the partner café. Location access is requested in-app at the time of redemption and is never collected in the background.

You may deny location permission at any time through your device settings. Doing so will prevent drink redemptions, as physical presence verification is a core service requirement.

We do not store your full payment card details. All payment processing is handled by PCI-DSS compliant third-party processors. We retain only a tokenised reference, the transaction amount, and the date of transaction for billing and dispute resolution purposes.

We do not sell your personal data. We share your information only in the following circumstances:

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: retained for the duration of your account plus 2 years after account closure
• Transaction records: retained for 5 years for financial and legal compliance
• Location data: not stored beyond the immediate redemption event — it is used only for real-time verification
• Marketing data: deleted promptly upon withdrawal of consent

You may request deletion of your account at any time. Upon request, we will delete or anonymise your personal data within 30 days, subject to legal retention obligations.

Subject to applicable law, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure— request deletion of your data (“right to be forgotten”)
• Right to restriction — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw marketing consent at any time without affecting prior processing

To exercise any of these rights, contact us at hello@cupsa.app. We will respond within 30 days. If you are dissatisfied with our response, you have the right to complain to the UAE Data Office or, if applicable, your local data protection authority.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly. If you believe we have collected data from a child, please contact us at hello@cupsa.app.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls limiting data access to authorised personnel only
• Regular security assessments and vulnerability testing
• Incident response procedures for data breaches

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant authorities as required by applicable law.

Your data is processed primarily within the UAE. If we transfer your data to countries outside the UAE or the EU/EEA, we ensure adequate protections are in place through standard contractual clauses or equivalent safeguards approved by the relevant data protection authorities.

Our website (cupsa.app) uses essential cookies necessary for site functionality. We do not use advertising or behavioural tracking cookies without your consent. You can control cookie settings through your browser preferences.

Our mobile application does not use cookies. It may use device identifiers and analytics SDKs as described in Section 2.2.

With your permission, we may send push notifications to inform you of new partner cafés, membership renewals, redemption confirmations, and promotions. You can manage notification preferences at any time in your device settings or within the app.

If you download the Service through the Apple App Store or Google Play, your use of those platforms is governed by Apple's and Google's respective privacy policies and terms of service. CUPSA is independently responsible for the data practices described in this policy. Apple and Google are not a party to this Privacy Policy and have no responsibility for the Service or your data within it.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time. We will notify you of material changes via the application or by email at least 14 days before the changes take effect. The “Effective date” at the top of this page indicates when the policy was last revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

For any questions, requests, or concerns about this Privacy Policy or our data practices, contact our Privacy team: