Privacy policy

01What this policy covers

This policy explains what information Cafein processes and why, across the Cafein website (cafein.app), the Cafein consumer app, the Cafein Business app used by café staff and owners, and the Cafein Business dashboard at panel.cafein.app.

Where a feature is only available in one of these products, the section below says so. If you use more than one product, the relevant sections apply to each of them.

02Who operates Cafein

Cafein Technologies, Schrenstr. 5, 81543 Munich, Germany, operates the products covered by this policy. You can reach us at info@cafein.app with any question, request or complaint about your data.

03Account information

Creating a Cafein or Cafein Business account requires your name, email address and a password, which we store as a salted hash rather than in plain text. Each account also gets an internal account ID used to link your activity across the product. Sign-in is currently by email and password only; we do not yet offer Google or Apple sign-in in either app.

04Location

In the Cafein app, we use your device’s location only while the app is open, to show you nearby cafés and their distance from you. When you look up nearby cafés, your coordinates are sent to our servers for that request. We do not access your location in the background.

In the Cafein Business app, location is used only to help you place your café’s pin on a map when you add or edit a branch, for example by centring the map on your current position or turning an address into coordinates. We do not track a business user’s location continuously.

A branch’s address and map coordinates are stored as information about the business, not about an individual person.

05Camera and photos

Scanning a QR code happens on your device; only the code itself, not a photo, is sent to our servers to look it up.

You may choose to upload photos for menu items and products, or as evidence when applying to claim or list a café. We don’t otherwise access your camera or photo library.

In the Cafein Business app, the menu import tool lets you photograph a menu and send it to our servers, where an AI provider (Mistral AI, with Google Gemini as a fallback) reads the text and turns it into a draft list of items. Nothing from that draft is saved to your menu until you review and confirm it.

06Loyalty and rewards

We keep a record of the stamps you earn, the rewards you redeem, and your redemption history at participating cafés, along with the QR card identifiers used to redeem a reward. This history is linked to your account so your loyalty balance stays accurate across the network.

07Cafein Business features

If you use Cafein Business, we also process information related to running a café: your organization and team membership, your role (for example owner or staff), invitations you send or receive by email to join a team, the menus, campaigns and events you create, and analytics we calculate from your business’s loyalty transactions, such as redemption counts and revenue trends. This information is only visible to accounts with access to that business.

08Service providers we use

We rely on a small number of providers to run Cafein: Google Maps to show cafés and branches on a map, Resend to send account, verification and invitation emails, Cloudflare to store uploaded photos and files, and Hetzner (Germany) to host our API. This website and the Cafein Business dashboard are hosted on Vercel. We use Expo/EAS only to build and publish the apps; we do not use it to send push notifications or ship over-the-air updates, and it does not collect data from your device on our behalf.

We do not use advertising SDKs or an advertising ID, and the apps contain no third-party analytics or tracking SDKs. We do not sell your personal information. Data sent to and from Cafein is encrypted in transit (HTTPS).

09Retention and deleting your account

You can delete your account yourself, at any time, from within either app: in the Cafein app, go to Settings and choose Delete account; in the Cafein Business app, go to Settings, open the danger zone and confirm by typing DELETE. Both actions call the same account-deletion endpoint on our servers.

Deleting your account permanently removes your profile and account data. Where other people or businesses depend on records you were involved in, such as a loyalty ledger or an audit trail, we anonymise those records instead of deleting them outright, so that other users’ and businesses’ history stays accurate. We only keep information for longer where we are legally required to, and only for as long as that requirement applies.

If you are the sole owner of a business on Cafein, you’ll need to transfer ownership or close that business before your account can be deleted; the app will tell you if this applies to you.

10Security

We use appropriate technical and organisational measures to protect your information, including encrypting data in transit. No online service can guarantee absolute security.

11Your data protection rights

Subject to applicable law, you may have the right to access, correct or erase your information, restrict or object to processing, and receive a portable copy of your data. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Send requests to info@cafein.app. We may ask for the minimum information needed to verify your identity and understand your request. You can also complain to a competent supervisory authority; BayLDA handles complaints concerning private organisations in Bavaria. Where Turkish data protection law (KVKK) applies, the corresponding rights and complaint routes are also available to you.

12Changes to this policy

We’ll update this policy as our products change. The date at the top of this page shows when it was last revised.