Privacy Policy

1. About this policy

Vero& Pty Ltd (ABN 37 699 193 676) trading as CaféCircle ("we", "us", "our") operates the CaféCircle loyalty platform, including the CaféCircle mobile application and website (collectively, the "Platform").

This Privacy Policy explains how we collect, use, disclose and protect your personal information when you use the Platform. We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the Platform, you consent to the collection and use of your information as described in this Policy.

2. Information we collect

2.1 Information you provide to us

• Full name
• Email address
• Mobile phone number (optional)
• Date of birth (optional — used for birthday rewards only)
• Favourite coffee preference
• Payment information (processed securely by Stripe — we do not store card details)

2.2 Information we collect automatically

• Location data — used to verify café visits and show nearby participating cafés (with your permission)
• Device information — device type, operating system, app version
• Usage data — which cafés you visit, how often, stamp and reward history
• QR code scan data — time, date and location of each café visit

2.3 Information collected from cafés (merchants)

• Café name, address and contact details
• Subscription plan and payment history
• Customer visit data and analytics

3. How we use your information

We use your personal information to:

• Operate and improve the CaféCircle loyalty platform
• Record and display your stamp and reward history across the network
• Verify you are physically present at a café before recording a stamp
• Send you birthday rewards and promotional offers (with your consent)
• Show you nearby participating cafés based on your location
• Generate personalised café recommendations using AI
• Process payments for merchant subscriptions
• Send push notifications about offers and rewards (with your consent)
• Comply with our legal obligations and prevent fraud

4. Sharing your information

We do not sell your personal information. We may share it with:

• Participating cafés — your visit history and preferences are shared with cafés you scan at, to enable them to serve you better
• Stripe — for payment processing (governed by Stripe's Privacy Policy)
• Firebase (Google) — for secure data storage (governed by Google's Privacy Policy)
• Anthropic — anonymised usage data may be processed for AI-powered recommendations
• OneSignal — for push notification delivery
• Law enforcement — where required by law

5. Location data

We request access to your device location to verify you are physically at a café when you scan a loyalty QR code, and to show nearby CaféCircle cafés on the map. You may deny location access in your device settings — the app will still function, but stamp earning and café discovery features will be limited. We do not store your precise location history beyond what is needed to verify individual scans.

6. Data security

We implement reasonable security measures to protect your personal information, including encrypted data transmission (HTTPS), Firebase security rules, and access controls. However, no method of transmission over the internet is 100% secure.

7. Data retention

We retain your personal information for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

8. Your rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal data
• Withdraw consent to marketing communications at any time
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise these rights, contact us at privacy@cafecircle.com.au.

9. Children's privacy

CaféCircle is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the app. Continued use of the Platform after changes constitutes acceptance of the updated Policy.

---