Privacy Policy

Who we are

Cupcloud is operated from the United Arab Emirates. For any privacy question or request, write to info@cupcloud.ae.

There are two kinds of people on Cupcloud: café owners and their staff, who use Cupcloud to run a café's menu and orders, and customers, who order from a café through that café's menu page. When you order from a café, your details are kept for that café.

What we collect from café owners and staff

When you sign up or are given an account, we keep:

• Your name, email address and mobile number
• Your password, stored only in a scrambled (hashed) form that we cannot read
• Your café's details: name, address, contact numbers, logo, menu, prices, opening hours, VAT settings and delivery areas
• Staff accounts you create (name, email, role) and a record of who took or changed an order or a payment
• Business records you choose to enter in the back office, such as suppliers, expenses and staff pay
• The network (IP) address used at sign-up and sign-in, used to limit abuse

What we collect from café customers

When you order from a café that uses Cupcloud, we keep for that café:

• Your UAE mobile number — it is required for every order so the café can reach you
• Your name, if you give it
• Your email address and a hashed password, only if you create an account with email
• If you use Google sign-in: your name, your email address and your Google account identifier — nothing else from your Google account
• Delivery addresses you enter and the map pin you choose; your car plate for a car order
• Your orders: items, notes, totals, time, how you ordered and the order's status
• If you turn on order updates: the notification address your browser gives us
• The network (IP) address of an order or a sign-in, used to limit abuse

What we do not collect

We do not see or store card numbers. If a café offers card payment, you pay on the page of that café's payment gateway.

We do not use advertising trackers or third-party analytics on café menus or on this site.

Why we use it

We use personal information only to run the service:

• To take, prepare, deliver and track orders
• To run accounts and sign-in, and to send the codes and emails an account needs
• To answer support requests
• To keep the service secure and stop abuse, for example limits on repeated orders or sign-in attempts
• To send a café owner messages about their own account, such as trial reminders

Who can see it

The café you order from sees its own orders and its own customers only. Its staff, including a delivery driver, see what they need to fulfil your order, such as your number and delivery address. One café cannot see another café's orders or customers.

The Cupcloud team can access data when needed to run the service and to give support.

We use a small number of service providers, who receive only what their task needs:

• A hosting provider for our server and backups
• An email delivery provider, for sign-in codes and account emails
• Google, when you choose Google sign-in, and Google Maps when you use the delivery map
• Cloudflare Turnstile, on sign-up and password forms, to tell people from bots
• The café's own payment gateway, only when you choose to pay by card
• Your browser's notification service, only if you turn on order updates

We do not sell your data

We do not sell personal information and we do not share it for advertising. We disclose it only as described on this page, or when the law requires us to.

Your data stays with one café

A customer account belongs to one café. An account at one café does not exist at another, and typing someone's phone number or email address never shows their addresses or orders. Only the signed-in account can see its own saved details.

Cookies and storage on your device

We use only what the service needs to work:

• A sign-in cookie that keeps you signed in (30 days for a customer account), and a short-lived cookie during Google sign-in or café sign-up
• Storage in your browser for your language, your cart and your recent orders on this device
• For guests: your phone number, name and up to five recent delivery addresses, kept in your browser only, for up to 90 days. "Forget my details on this device" at checkout or in My orders clears them at once

How long we keep it

Orders and money records are part of the café's business records and are kept while the café uses Cupcloud. Sign-in codes expire after 10 minutes. Backups are kept for 14 days.

Accounts are not deleted automatically. If you ask us to delete your account or your details, we will do so, except for what a café must keep as a record of a past order.

Your rights

You can ask for a copy of your information, ask us to correct it, or ask us to delete it. Write to info@cupcloud.ae and tell us which café the request is about; we may ask you to confirm it is really you.

A signed-in customer can change their name, addresses and cars in their account. There is no self-service "delete account" button yet — email us and we will delete it for you.

Security

Pages are served over an encrypted connection. Passwords and sign-in codes are stored hashed. Each café's data is separated by access rules in the database. No system is perfectly secure, but we work to keep yours safe and will tell affected people if something serious goes wrong.

Where data is processed

Some of our service providers may process information on servers outside the United Arab Emirates.

Children

Cupcloud is not aimed at children, and we do not knowingly collect information from them.

The law we follow

This policy is intended to align with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Changes to this policy

When we change this policy we update the date at the top. For an important change we will also tell café owners by email or with a notice on the site.