Privacy Policy

Who we are Draft

Coffee Mug is a platform for ordering coffee ahead and picking it up from your car, with payment made directly to the coffee shop at pickup. The platform is a project being set up in Qatar, and the details of the legal operator have not been finalised yet. They will be added here once confirmed.

The data we process Draft

Depending on your role on the platform, we may process:

• Customers — phone number: to create your account and verify you with a code sent to you. We store it encrypted and use a cryptographic fingerprint of it to recognise you when you return.
• Customers — orders: the coffee shop, branch, items, amounts, time and status of the order.
• Customers — vehicle details (plate number, colour and type) that you enter to ease handover. The branch team sees them only while the order is ready or when you have arrived.
• Customers — the favourite branches you choose.
• Customers — your consents and data requests: a record of your consents (including the optional marketing consent) and of the access, correction and deletion requests you make.
• Technical data: session tokens (we keep a cryptographic fingerprint, not the token itself), encrypted identifiers of the device and the connection address used to prevent abuse and limit request rates, and operational logs for security and audit in which numbers and codes are masked.
• Coffee shop staff and owners — name, email address (encrypted), role and branch, for sign-in and permission management.
• Visitors to this website — we use no cookies and no analytics or tracking tools. The hosting provider may keep temporary technical logs (such as the connection address and visit time) for security and to run the service.

Location Draft

Your location is read on your device only while you are using the app, and it is used locally to sort branches by distance. We do not send your location to our servers and we do not store it.

Payments Draft

We do not store payment card details. As designed for the pilot launch, payment is made directly to the coffee shop when you pick up the order. In this mode the platform records only that the coffee shop confirmed receiving the order amount, together with the staff member and the time of confirmation. Card, Apple Pay and Google Pay are coming soon and are not available. When electronic payments are enabled they will be processed by a licensed payment provider that we will announce here.

Why we process your data Draft

• To run the service: creating the account, signing in, fulfilling and handing over orders.
• Security, and preventing abuse and fraud.
• Accounting and legal obligations.
• Support, and handling the requests you make about your data.
• Marketing: only if you give a separate, optional consent, which you can withdraw at any time.

Who sees your data Draft

• The branch team preparing your order sees the content of the order only, and sees vehicle details only while the order is ready or when you have arrived.
• Coffee shop owners do not see customer identities; they are shown aggregated data only.
• Authorised platform staff, to the minimum extent needed for operations and support.
• We do not sell your personal data.

Providers that process data on our behalf Draft

We use service providers to run the platform. Some may be located outside Qatar, and data may be transferred to them for this purpose:

• Verification message provider: to send the sign-in code to your phone number (for example the WhatsApp Business platform from Meta).
• Email provider: to send sign-in codes to coffee shop staff and owners (currently Resend).
• Cloud hosting provider: to run the servers and store the data (currently Google Cloud, in the Doha region).
• Payment provider and maps provider: neither has been integrated yet, and we will add them here before using them.

How long we keep data Draft

We keep your data for as long as your account exists. Order records of a financial nature are kept for the period that accounting rules require. We plan to delete vehicle details shortly after handover and to delete verification codes and expired sessions periodically, but this automatic deletion has not been switched on yet. The exact periods are being finalised and will be published here.

Your rights Draft

You may ask to access, correct or delete your data, and to withdraw your marketing consent. These requests are recorded on the platform and we verify your identity before acting on them. How to submit them: from inside the app once available, or through the official contact channel that will be announced on this website.

We are reviewing our obligations under Qatar Law No. 13 of 2016 on Personal Data Privacy Protection with legal counsel before launch.

How to request deletion of your data Draft

There is no email address, phone number or web form published for this yet, and we will not invent one. Until the official privacy channel is announced on this website, do not send personal data to any address that claims to act for Coffee Mug.

When the channel is available (or from inside the app once it is released), a deletion request works like this:

• Send the request through the official privacy channel and say clearly that you want your data deleted.
• Tell us the phone number or email you use to sign in, so we can find your account.
• We verify your identity before acting on the request, for example through the same sign-in method.
• We delete or anonymise your personal data. Records that accounting rules require us to keep are kept for the required period only.
• We confirm to you when the request has been handled. The response time is being finalised and will be published here.

Protecting data Draft

We protect data with technical and organisational measures, including encrypted connections, encryption of phone numbers and email addresses in the database, storing codes in hashed form, and separating staff permissions by branch. No system is perfectly secure, and we will notify those affected if a breach occurs that requires it.

Changes to this policy Draft

We will publish any update on this page with its date and version number.

Contact about privacy Draft

The official privacy contact channel is being confirmed and will be published here before the pilot launch.