Privacy Policy

1. Information We Collect

Information You Provide

• Name
• Email address
• Phone number (optional)
• School or employer (if applicable)
• Preferences

Automatically Collected

• Device type
• App usage data
• Approximate location (city/state)

2. Information We Do NOT Collect

• Exact GPS location
• Social Security numbers
• Financial account details
• Sensitive personal data

3. How We Use Information

• Deliver deals and notifications
• Manage accounts and memberships
• Improve platform performance
• Ensure compliance and security

4. Communications

• Opt-in only
• Frequency controls available
• Easy opt-out at any time

5. Data Sharing

We do not sell personal data.

We may share limited data with:

• Service providers (hosting, messaging)
• Merchants (only as required for redemption)
• Legal authorities if required by law

6. Children & Student Privacy

• COPPA-compliant for users 13–18
• Parent consent required where applicable
• No targeted advertising to minors

7. Data Security

Infrastructure Security

• Enterprise-grade PostgreSQL database with encryption at rest
• SSL/TLS encryption for all data transmitted over HTTPS
• Automatic daily backups with point-in-time recovery
• DDoS protection and traffic filtering
• Isolated data environments - your data is separate from other applications

Authentication & Access Control

• JWT-based authentication with secure token management
• Role-based access control (admin vs. user permissions)
• Password hashing - passwords are never stored in plaintext
• Automatic session management and timeout protection
• OAuth integrations with major identity providers

Payment Security

• PCI DSS compliant payment processing through Stripe
• Card details never stored on our servers - handled entirely by Stripe
• Webhook signature verification prevents fraudulent payment requests
• Tokenized payment data for recurring subscriptions

API & System Security

• Rate limiting on AI operations (10 images/min, 5 campaigns/min, 20 LLM calls/min)
• File upload validation - size limits (5MB images, 50MB videos) and type checking
• Query optimization with indexed fields for fast performance
• Admin-only endpoints protected with role verification
• Real-time performance monitoring with automated alerts

Third-Party Integrations

We use trusted service providers:

• Stripe - Payment processing (PCI DSS Level 1 certified)
• Twilio - SMS messaging (SOC 2 Type II certified)
• HubSpot - CRM and marketing automation (GDPR compliant)
• Base44 - Platform infrastructure (enterprise-grade security)

All integrations use secure OAuth authentication and encrypted API connections.

8. Your Rights (GDPR & CCPA Compliance)

You have the right to:

• Access your data - Request a copy of all personal information we hold
• Request corrections - Update inaccurate or incomplete data
• Delete your account - Permanent deletion of all personal data (right to be forgotten)
• Withdraw consent - Opt out of marketing communications at any time
• Data portability - Export your data in a machine-readable format
• Object to processing - Restrict how we use your personal information
• Lodge a complaint - Contact data protection authorities if you believe your rights are violated

To exercise these rights, contact privacy@coffeecanz.com

9. Data Retention

We retain personal data only as long as necessary to provide services or comply with legal obligations.

Retention Periods

• Active accounts - Data retained while account is active
• Inactive accounts - Data deleted after 2 years of inactivity
• Deleted accounts - Personal data permanently deleted within 30 days
• Transaction records - Retained for 7 years for tax/legal compliance
• Marketing data - Deleted immediately upon opt-out request
• Backup data - Automatically purged after 90 days

Some anonymized, aggregated data may be retained indefinitely for analytics and platform improvement.

10. Policy Updates

We may update this policy and will notify users of material changes.

11. Contact

📧 privacy@coffeecanz.com