Privacy policy.

Charity Coffee ("we", "us") is a self-service coffee platform operated by Polsia. This policy explains what data we collect when you buy a cup, scan a QR, donate online, or join the waitlist — and what we do not collect. It is written in plain language with the actual database columns named, so you can verify the data we hold by reading the underlying tables.

Who we are

The data controller for everything described on this page is Charity Coffee, a Polsia-built application hosted at cupcause.polsia.app. For any privacy request — access, deletion, complaint — email privacy@cupcause.polsia.app. We respond within 30 days.

What we store for a web donation (/donate)

When you donate through our website, Stripe handles the cardholder side of the checkout on their own servers. We receive a verified payment confirmation and persist only the impact record:

• donations.cents_amount — the donation amount in cents
• donations.minutes_funded — the schooling minutes this donation unlocks
• donations.school_id — which school the funding is routed to
• donations.venue_id — set to 'donate-page' for web donations
• donations.charity_partner_id — the verified partner organisation
• donations.school_region — the locked region in our pairing table
• donations.status — 'pending', 'succeeded' or 'failed'; public totals only count 'succeeded'
• donations.stripe_checkout_session_id, stripe_payment_intent_id, stripe_charge_id, stripe_event_id — Stripe identifiers used to reconcile each row to Stripe's authoritative state
• donations.cents_amount_authoritative — the cent amount Stripe confirms, kept separate from the pre-checkout optimistic value
• donations.reconciled_at — timestamp of the last successful Stripe reconciliation
• donations.created_at — timestamp for accounting and audit
• payment_events_cursor.last_event_id — bookmark of the last consumed Stripe event; only the id, no payment data

We do not store your name or email against a web donation. Cardholder details (name, email, billing address, payment method) live with Stripe under their DPA and are visible only to you in your Stripe receipt email.

What we store for a vended cup purchase

When you buy a cup from a Charity Coffee machine, three rows are written — also with no donor identity:

• donations — the same impact row named above (venue_id = the machine venue)
• purchases — a record keyed by a per-cup UUID (cup_id), the machine_id, and a scanned / scanned_at flag toggled when someone visits the QR
• cup_tokens — a one-shot opaque token (the QR's encoded value), the machine's venue_id, created_at, and a nullable used_at timestamp

The cup_id and token are random opaque strings; neither row carries a name, email, phone, payment method or any other donor-identifying field. The only linkage between you and the cup is the printed QR code on the physical cup you hold.

What we store when you join the waitlist (/landing)

The waitlist form writes a single row into the leads table:

• leads.email — the address you typed
• leads.source — set to the literal string 'landing'
• leads.created_at — timestamp of submission

We use this only to email you once when we're ready in your area. We never sell or share waitlist addresses.

What we store when you scan a QR

Scanning a cup's QR opens /qr/[token] or /scan, which sets the matching cup_tokens.used_at = NOW(). We do not collect an IP address, user-agent string, device fingerprint, or any geolocation from this visit. Standard server-level nginx / hosting logs exist for security and rate-limiting, but Charity Coffee does not store or profile them.

What we DON'T collect

Charity Coffee is deliberately narrow. Across every flow we do not collect:

• Names, postal addresses or phone numbers
• Biometric data, advertising IDs or cross-site identifiers
• Third-party tracker cookies — we don't run any
• Cross-site behavioural profiles
• Social-graph data from external platforms

Why we process this data (GDPR Article 6)

• Contract — fulfilling a donation you have authorised (Stripe checkout, vended purchase).
• Legitimate interest — reporting our aggregate impact (totals on /our-impact, the live pilot screen, and the per-venue API). These counts come from donations rows and identify no individual.
• Consent — the waitlist email capture. You give it by submitting the form, you can withdraw it any time by emailing us.

Where your data lives

All first-party tables run on PostgreSQL hosted by Neon, served over TLS. Any transfer outside our database is to Stripe (payments) under their published Data Processing Addendum, and to our transactional email provider (waitlist announcements) which processes the address on our behalf only. Donor-facing identifiers never leave Stripe's environment except for the per-cup record we name above.

How long we keep your data

• Financial donation records (cents_amount, school_id, venue + timestamps) — retained 7 years for tax / charity audit.
• Waitlist emails (leads.email) — retained 2 years, then deleted unless you've become a customer.
• Cup tokens and matching purchases — retained alongside the donation audit window.

Your rights as a data subject

Under GDPR you have the right to:

• Access — ask for a copy of the data we hold on you
• Rectification — correct anything that's wrong
• Erasure — ask us to delete your data, subject to our tax / audit retention
• Restriction — ask us to pause processing
• Portability — receive the data you gave us in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — for the waitlist, at any time
• Lodge a complaint with your country's data-protection supervisory authority

Email privacy@cupcause.polsia.app and we'll respond within 30 days.

Cookies & local storage

We do not set analytics or marketing cookies. We do read & write one first-party localStorage value, polsia_vid, which is a random UUID Polsia uses for first-party, anonymous aggregate pageview counts. You can clear it from your browser at any time without affecting the service.

Changes to this policy

We may update this page from time to time. The "Last updated" date at the top of this page is the authoritative version — if a change is material we will also email waitlist addresses.