Privacy Policy

Cupo Coffee — Effective date: 22 July 2026

This Privacy Policy explains how Cupo Pte. Ltd. (UEN 202503648C) ("Cupo", "we", "us") collects, uses, discloses and protects your personal data when you use the Cupo mobile application and website (together, the "Service"). We are committed to handling your personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA").

1. Personal data we collect

Information you provide

• Account & profile: mobile number, name, date of birth, and (optionally) email address, when you register or complete your member profile.
• Marketing preferences: whether you have consented to receive marketing notifications.
• Orders: the items you order, order notes, and pickup times.
• Guest checkout: if you order without an account, only a nickname you enter so staff can call your order.
• Communications: messages you send us for support.

Information collected automatically

• Membership & rewards activity: your cashback balance, points, stamps and coupons, and related transaction history.
• Device & notifications: a push-notification token and device/app information used to deliver order updates and notifications.
• Technical & usage data: app/version, general device information, and log data (such as approximate access times) used to operate and secure the Service.

Payment information

Payments are processed by our payment provider, Stripe (PayNow). Your payment is handled directly by Stripe; we receive a payment reference and status to confirm your order, and we do not store your full card or bank credentials on our systems.

We do not collect precise (GPS) location, and the customer app is used for takeaway/pickup orders only.

2. How we use your personal data

• To create and manage your member account and authenticate you (via one-time password or password).
• To take, process, prepare and fulfil your orders, and to confirm payment.
• To operate our membership programme — cashback, points, stamps and coupons.
• To send you order status updates and, where you have consented, marketing or promotional notifications.
• To provide customer support, ensure security, prevent fraud, and comply with legal obligations.

3. Consent and legal basis

We collect, use and disclose your personal data with your consent, or where permitted or required under the PDPA and other applicable laws. You may withdraw consent for specific uses (for example, marketing notifications) at any time, as described in Section 8. Withdrawing certain consents may mean we can no longer provide parts of the Service to you.

4. Disclosure and third-party service providers

We do not sell your personal data. We share personal data only with service providers who process it on our behalf, under appropriate safeguards, including:

• Google / Firebase — authentication, hosting, and push messaging.
• Google Cloud Platform — application hosting and databases.
• Stripe — payment processing.
• Delivery platforms (e.g., GrabFood), only where you place an order through such a platform.

We may also disclose personal data where required by law, regulation, or valid legal process.

5. International transfers

Some of our service providers may store or process personal data outside Singapore. Where we transfer personal data overseas, we take reasonable steps to ensure it is protected to a standard comparable to the PDPA.

6. Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law (for example, transaction records for accounting and tax purposes). When your account is deleted (see Section 8), we delete or anonymise your personal data, except where we are required to retain certain records.

7. Security

We use reasonable administrative, technical and physical safeguards to protect your personal data, including encryption in transit (HTTPS), hashed credentials and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to address incidents responsibly.

8. Your rights and choices

• Access & correction: you may request access to, or correction of, your personal data.
• Withdraw consent: you can turn off marketing notifications in the app or by contacting us.
• Delete your account: you can delete your account and associated personal data directly in the app (Account → Delete account), or by contacting us at the address below. A web-based deletion request is also available at https://cupocoffeesg.com/delete-account.

9. Children

The Service is not directed at children, and we do not knowingly collect personal data from children without appropriate consent. If you believe a child has provided us personal data, please contact us so we can remove it.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the effective date above. Material changes will be communicated through the Service where appropriate.

11. Contact us / Data Protection Officer

If you have questions, requests or complaints about your personal data or this policy, please contact our Data Protection Officer:

Dexter
Cupo Pte. Ltd.
Blk 1 Jalan Bukit Merah, #01-4532, S150001
Email: hello@cupocoffeesg.com