Privacy Policy

FreeCup ("FreeCup", "we", "us", or "our") is a digital coffee-loyalty service operated from Kathmandu, Nepal. Our app lets you collect stamps at participating cafés and redeem free cups, replacing paper loyalty cards with a simple, private, phone-based experience.

This Privacy Policy applies to the FreeCup mobile apps, our website, and the café-owner dashboard (together, the "Services"). By using the Services you agree to the practices described here. If you do not agree, please do not use the Services.

We collect only what we need to run a loyalty program. We do not require your name, email, or a password to create a customer account.

2.1 Information you provide

• Phone number — used as your account identifier and to send a one-time verification code. This is the only piece of personal information required to sign up as a customer.
• Optional profile details — a display name or preferred language, if you choose to add them.
• Café-owner account details — for business users: business name, contact person, café address, and billing information for paid plans.
• Support communications — messages you send us when you request help or give feedback.

2.2 Information created as you use FreeCup

• Loyalty activity — stamps earned, rewards redeemed, and the participating cafés where these events occur, with timestamps.
• Device & technical data — device type, operating-system version, app version, and a randomly generated device identifier, used for security and troubleshooting.
• Diagnostic data — anonymised crash reports and performance metrics that help us keep the app fast, including on slower networks.

2.3 What we do not collect

• We do not track your precise GPS location in the background.
• We do not collect payment-card details from customers — the customer app is free.
• We do not sell your personal information to anyone, ever.

We use the information above to:

• Create and secure your account and verify it's really you via one-time codes.
• Record your stamps and let you redeem rewards at participating cafés.
• Show you your loyalty cards, progress, and reward history across all cafés in one place.
• Provide café owners with aggregate insights about visits and redemptions (see Section 6).
• Send essential service notifications, such as a stamp confirmation or a "reward ready" alert.
• Prevent fraud, abuse, and duplicate or fraudulent stamping.
• Diagnose problems, improve performance, and develop new features.
• Comply with applicable laws and enforce our terms.

Where data-protection law requires a legal basis, we rely on the following:

• Performance of a contract — to deliver the loyalty features you asked for.
• Legitimate interests — to secure the Services, prevent fraud, and improve the product, balanced against your rights.
• Consent — for any optional communications; you can withdraw consent at any time.
• Legal obligation — where we must retain records to comply with the law.

We share personal information only in these limited situations:

• With participating cafés — as described in Section 6.
• With service providers — vetted vendors who host our infrastructure, send verification SMS messages, or provide crash analytics, acting on our instructions under confidentiality obligations.
• For legal reasons — where required by law, court order, or to protect the rights, safety, and property of FreeCup, our users, or the public.
• In a business transfer — if FreeCup is involved in a merger, acquisition, or sale of assets, with notice to you.

We never sell or rent your personal information, and we do not share it for third-party advertising.

When you collect a stamp at a café, that café can see the loyalty activity tied to their own business — for example, a customer identifier, your stamp count, and redemption history at their venue. This lets staff confirm stamps and honour rewards.

Café owners also see aggregate, de-identified statistics — such as total stamps issued, return-visit rates, and free cups redeemed. A café cannot see your activity at other cafés, your phone number is masked where it is not needed, and owners are contractually prohibited from using your data for anything other than operating their loyalty program.

We keep your information only as long as needed to provide the Services and for legitimate business or legal purposes:

• Account and loyalty data are kept while your account is active.
• If you delete your account, we remove or anonymise your personal data within 30 days, except where we must retain limited records to comply with legal, tax, or fraud-prevention obligations.
• Anonymised and aggregate statistics that cannot identify you may be retained indefinitely.

We use industry-standard safeguards to protect your information, including encryption in transit, restricted internal access on a need-to-know basis, and passwordless sign-in that removes the risk of leaked or reused passwords. No method of transmission or storage is completely secure, but we work continually to protect your data and will notify you and the relevant authorities of any breach as required by law.

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal data.
• Object to or restrict certain processing.
• Port your data to another service in a portable format.
• Withdraw consent at any time, without affecting prior processing.

You can delete your account directly in the app, or exercise any of these rights by contacting us (Section 13). We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

FreeCup is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with information, please contact us and we will delete it promptly.

FreeCup is operated from Nepal, and your information may be processed on servers located in other countries where our service providers operate. Where we transfer data across borders, we take steps to ensure it receives an appropriate level of protection consistent with this policy and applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of the Services after an update means you accept the revised policy.

If you have questions about this policy or how we handle your data, reach out to our privacy team: