1. Who we are
Qahwa (“we”, “us”, “our”) operates a pickup-only coffee ordering marketplace in the United Arab Emirates (“UAE”). Customers use the Qahwa mobile app and website to browse participating cafes, place orders for in-person pickup, pay in-app, and manage loyalty rewards.
This Privacy Policy explains how we collect, use, share, store, and protect personal data when you use our customer-facing services (the “Services”).
Data controller
[Legal entity name — e.g. Qahwa Platform LLC]
[Registered address, UAE]
Privacy contact: [email protected]
Support: [email protected]
If you are a cafe owner or staff member using our merchant or barista dashboards, separate terms and notices may apply to those products.
2. Scope and important notes
- Pickup only. Qahwa does not offer delivery. We do not collect a delivery address for fulfilment. Location data, where you allow it, is used to show nearby outlets, provide driving directions to your pickup, and — only if you opt in — tell the cafe you have arrived when you are about 150 metres away. We do not send your GPS coordinates to Qahwa or to the cafe. You can turn this off in Settings.
- UAE law. We process personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”) and applicable regulations.
- Children. The Services are not directed at children under 18. You must be at least 18 years old (or the age of majority in your emirate, if higher) to create an account and place orders. The same age rule applies to appearing on Cups or posting pickup photos.
3. Personal data we collect
We collect only what we need to operate the Services, fulfil orders, prevent fraud, and — with your consent where required — send optional marketing.
| Category | Examples | How we collect it |
|---|---|---|
| Account & identity | Mobile phone number (E.164), display name, optional email, date of birth (if you provide it), profile photo URL | You provide this when signing up or editing your profile |
| Authentication | One-time passcodes (OTP) sent to your phone; session tokens | Generated when you sign in; OTP codes are short-lived and not stored in plain text |
| Orders & transactions | Order items, customisations, cup message, outlet, pickup code, order status, amounts in AED, payment status, refunds | Created when you place or manage an order |
| Payment information | Payment method type, last four digits, wallet type (e.g. Apple Pay / Google Pay), Stripe payment identifiers | Collected by Stripe on our behalf; we do not store full card numbers or CVV |
| Vehicle information | Make, model, colour, plate details, nickname (optional) | You provide this to help staff identify you at curbside pickup |
| Location | Approximate or precise device location (with your permission). Optional background location while you have an active pickup if you enable “Tell cafe when I'm close” | From your device when you enable location services |
| Loyalty & rewards | Points balance, stamp progress, reward redemptions, wallet pass identifiers | Generated through your use of loyalty features |
| Gift cards | Purchase and redemption records, recipient phone (if you send a gift), optional message | You provide this when buying or sending gift cards |
| Cups (community photos) | Public handle, photos of a cup from a completed pickup, optional taste note (max 150 characters), reports and blocks you submit | You provide this when you use Cups; other customers or merchants may submit reports about a post |
| Communications | Push notification tokens, Live Activity tokens, notification preferences (order updates, rewards, marketing) | From your device and in-app settings |
| Support & safety | Messages you send to support, fraud signals, abuse reports | You provide this, or we generate it to keep the platform safe |
| Technical & usage | Device type, operating system, app version, IP address, request logs, crash/diagnostic data | Automatically when you use the Services |
We do not knowingly collect sensitive categories of data (such as health, biometric, or government ID) unless you voluntarily include something in a free-text field (e.g. a cup message). Please do not include sensitive information in optional text fields.
4. How we use personal data
We use personal data for the following purposes:
- Provide the Services — create and secure your account, show nearby cafes and menus, process orders, facilitate payment, display order tracking and pickup codes, offer driving directions to the outlet, optionally tell the cafe you have arrived (without sending GPS coordinates), and operate loyalty and gift-card features.
- Communicate with you — send transactional messages (OTP codes, order status, pickup readiness) by SMS, WhatsApp, and/or push notification. For an active pickup on iPhone, we may also show the pickup code, cafe name, and order status on the Lock Screen and Dynamic Island using a Live Activity. This is optional, is not used for ads, and you can hide it from Tracking or turn it off in Settings.
- Customer support — respond to enquiries and resolve disputes.
- Safety & integrity — detect fraud, abuse, and security incidents; enforce our Terms of Service.
- Improve the platform — analyse aggregated, de-identified usage to improve performance and features.
- Legal compliance — meet tax, accounting, anti-fraud, and regulatory obligations.
- Marketing (opt-in only) — with your explicit consent, send promotional offers and cafe updates by push or SMS. You can withdraw consent at any time in app settings.
- Cups — display approved pickup photos, handles, and optional taste notes on the Cups wall and outlet map so logged-in customers can find UAE cafes (“help a UAE cafe get seen”). Outlet heat on the map is counts of posts per outlet, not a trail of your device GPS. We use reports and blocks to moderate the feature.
We do not sell your personal data. Cups is used to show approved cafe pickup photos to other customers.
5. Legal bases (PDPL)
Depending on the processing activity, we rely on one or more of the following:
- Contractual necessity — to perform our agreement with you (account, orders, payments, loyalty).
- Legitimate interests — to secure the platform, prevent fraud, and improve the Services, balanced against your rights.
- Consent — for optional marketing, precise location (where required), and certain analytics or communications.
- Legal obligation — to retain financial records and respond to lawful requests.
Where consent is required, you may withdraw it without affecting the lawfulness of processing before withdrawal.
6. How we share personal data
We share personal data only as needed:
| Recipient | Purpose |
|---|---|
| Participating cafes (merchants) | Fulfil your order — they receive order details, pickup code, cup message, vehicle info you provide, and (if you opt in) a notice that you have arrived outside. They do not receive your GPS coordinates or full payment card details. Merchants may also see reports about Cups posts at their outlet so we can investigate |
| Other logged-in customers | Approved Cups photos, handle, and taste notes are visible in the app to signed-in customers while the post is public |
| Stripe | Payment processing, refunds, and fraud prevention (Stripe Privacy Policy) |
| SMS providers (e.g. Unifonic, Twilio) | Deliver OTP and transactional SMS |
| WhatsApp / Twilio | Deliver OTP codes over WhatsApp when you choose that fallback, using Meta Authentication Templates from Qahwa’s WhatsApp Business account |
| Push notification services (Apple, Google) | Deliver order and loyalty notifications |
| Map / location providers (e.g. Mapbox) | Display maps and nearby outlets when you use location features |
| Cloud hosting & storage (e.g. DigitalOcean, object storage/CDN) | Host and operate the platform; encrypted at rest and in transit |
| Professional advisers & authorities | Legal, accounting, or regulatory requirements |
All processors are bound by contracts requiring appropriate security and use limitations. Merchants are independent businesses responsible for their own handling of order information at the point of pickup.
7. International transfers
Our primary infrastructure is hosted in or near the UAE / region. Some processors (e.g. Stripe, SMS, WhatsApp, or push providers) may process data outside the UAE. Where required, we implement appropriate safeguards (such as contractual clauses) and document transfers in our records of processing.
8. Retention
We keep personal data only as long as necessary:
| Data type | Typical retention |
|---|---|
| Account profile | While active. When you delete your account in the app, we flag the account as deleted immediately (you cannot sign in again). Records are not physically erased yet; personal-data anonymisation may follow in a later process. |
| Cups photos, handle, and public Cups profile | Unpublished immediately when you delete your account — posts disappear from the wall, map, and public profile even if the account row is only flagged. Public user-generated content does not stay up. You can also delete your own posts while the account is active. |
| Cups reports and blocks | Kept as needed to investigate abuse and protect the platform |
| Orders & payments | Up to 180 days for payment processor disputes — even after account deletion |
| OTP challenges | Minutes; hashed records may be kept briefly for abuse prevention |
| Server logs | Up to 90 days, unless needed for a security investigation |
| Marketing preferences | Until you opt out or delete your account |
We may retain anonymised or aggregated data that cannot identify you.
9. Security
We apply technical and organisational measures including TLS encryption in transit, access controls, role-based permissions, encrypted storage for sensitive fields, rate limiting, and monitoring. Payment card data is handled by Stripe’s PCI-compliant infrastructure; our servers receive tokens and payment identifiers only.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact [email protected] immediately.
10. Your rights (PDPL)
Subject to applicable law, you may:
- Access a copy of your personal data
- Rectify inaccurate or incomplete data
- Erase your data (right to be forgotten), subject to legal retention
- Restrict or object to certain processing
- Port your data in a structured, commonly used format where feasible
- Withdraw consent for marketing or optional processing
To exercise these rights, use Settings → Delete account in the app, or email [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling a request.
Deleting your account in the app marks the account deleted and ends your sessions immediately. Cups photos, handle, and public Cups profile are unpublished immediately. Order and payment records may be retained for payment processor disputes (see Retention). Full anonymisation of retained personal fields may be completed in a later process.
11. Cookies and similar technologies (website)
Our marketing website (qahwa.io) may use essential cookies and similar technologies for security and basic functionality. We do not use invasive third-party advertising trackers on the customer app without disclosure and, where required, consent.
12. Third-party links
The Services may link to cafe websites or third-party payment wallets. Their privacy practices are governed by their own policies. We are not responsible for third-party sites you visit outside Qahwa.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised version at https://qahwa.io/privacy and update the “Last updated” date. For material changes, we will provide notice in the app or by other appropriate means. Continued use after the effective date constitutes acceptance where permitted by law.
14. Contact & complaints
Privacy enquiries: [email protected]
General support: [email protected]
You may also lodge a complaint with the UAE Data Office if you believe your data protection rights have been violated.
Appendix — App Store privacy labels (summary)
For Apple App Store Connect / Google Play Data Safety declarations, the customer app may collect:
- Contact info: phone number, name, email (optional)
- Financial info: payment info (via Stripe; not stored on Qahwa servers)
- Location: coarse/precise (optional, for nearby cafes, directions to pickup, and — if you opt in — telling the cafe you have arrived). Background location is used only while you have an active pickup and have enabled the feature. GPS coordinates are not sent to Qahwa.
- User content: cup message, profile photo, gift message, Cups handle, cup photos, optional taste note
- Photos: profile photo and Cups pickup photos
- Identifiers: user ID, device/push tokens, Live Activity tokens
- Usage data: product interaction, diagnostics
Data is not used for third-party advertising. Marketing use is opt-in.