This Privacy Policy explains how Finasto ("Finasto", "we", "us" or "our") collects, uses, shares and protects your personal information when you use the Finasto Coffee mobile application (the "App") and the website https://finasto.net (together, the "Service").
By creating an account or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Data controller: Finasto
Contact for privacy questions: support@finasto.net
1. Summary (plain language)
- We use your data to create your account, take and deliver your coffee orders, run the loyalty-points and referral programs, send you order notifications, provide customer support, and keep the Service secure.
- We do not sell your personal data.
- We do not show third-party advertising in the App.
- You can delete your account and personal data at any time (see Section 10).
- We use Google Firebase to run the Service, so some data is processed on Google's cloud infrastructure.
2. Information we collect
2.1 Information you give us
| Data | When | Why |
|---|---|---|
| Name | Sign-up, checkout, profile | Identify you, label your orders |
| Email address | Sign-up | Login, account recovery, service messages |
| Password | Sign-up | Secured by Google Firebase Authentication (we never see it in plain text) |
| Phone number (required) | Sign-up, checkout, profile | Verify your account with a one-time SMS code (sent by Google Firebase Authentication), keep one account per phone number to prevent abuse, and contact you about your order / delivery |
| Delivery address, city, country, postal code | Checkout, profile | Deliver your order and calculate delivery charges |
| Delivery pin location (optional; see Section 2.3) | Checkout, when you use the delivery map or your current location | Resolve your address, select the serving store and calculate delivery charges |
| Profile photo (optional) | Profile | Personalise your account |
| Payment proof screenshot (optional) | Checkout | Confirm a manual bank/e-wallet/QR payment |
| Complaint photos (optional) | When you report a problem with an order | Review and resolve your complaint |
| Bank name and account number | Refund request, promoter withdrawal request | Send you a refund or a promoter payout |
| Order notes / special instructions | Checkout | Fulfil your order correctly |
| Support messages | When you contact support@finasto.net | Answer your request |
| Promoter application details | Promoter sign-up | Review and manage your participation in the referral program |
2.2 Information collected automatically
| Data | Source | Why |
|---|---|---|
| Country (region setting) | Your device's system language/region setting — read directly on-device | Show the correct currency, pricing and available branches |
| Push notification token | Firebase Cloud Messaging | Send order-status and program notifications |
| Device information | Firebase | Operate the Service and diagnostics |
| Crash logs and diagnostic data | Firebase Crashlytics | Detect and fix bugs and crashes |
| Order history, loyalty points, badges, referral attribution | Generated as you use the Service | Run the ordering, rewards and referral features |
2.3 Location details
Delivery location (optional). When you choose delivery at checkout, the App can use your device's location to fill in your delivery address and place the delivery pin on a map. This happens only when you open the delivery map or tap the option to use your current location, and only after you grant the device location permission.
- What is collected: a single precise (GPS) or approximate location fix, depending on the accuracy you allow, and the coordinates (latitude and longitude) of the delivery pin you confirm.
- When: once per request, while the App is open. The App does not track your location continuously and does not access it in the background.
- Why: to resolve your delivery address, select the store that can serve you, calculate delivery distance and charges, and show the delivery point to the store and delivery staff handling your order.
- Where it goes: the confirmed pin coordinates are saved with your order on our servers (Google Firebase). To convert coordinates to an address, search for an address, and display the map, the App sends your device location fix or the pin coordinates, your search text and the map area being viewed to OpenStreetMap services (Nominatim geocoding and map tiles), operated by the OpenStreetMap Foundation. No name, email, phone number or account identifier is included in those requests, although OpenStreetMap receives your IP address as with any internet request.
- How long it is kept: a location fix that you do not confirm is not stored. Confirmed pin coordinates are kept as part of the order record (see Section 6).
- Your choice: location access is optional. If you decline or later revoke the permission, you can still type your address or place the pin manually by moving the map.
We do not use your location for advertising or analytics.
Country. Separately, your country is inferred from your device's system region/language setting (the same setting your phone already uses for date formats, etc.), read directly on-device — nothing is sent to us or to Google to determine it. You can change the App's selected country manually at any time regardless of your device setting.
2.4 Children's privacy
The Service is intended for users 18 years of age or older (it includes a monetary referral-payout feature).
We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact support@finasto.net and we will delete it.
3. How we use your information
We use personal data to:
- Create and manage your account and authenticate you.
- Accept, process, prepare, deliver and track your orders and pre-orders.
- Process manual payments and verify payment proofs.
- Operate the loyalty-points / rewards program.
- Operate the promoter / referral program, attribute referrals, calculate commissions and process withdrawal requests.
- Send you transactional notifications including order status, refunds, points earned, referral events and promoter approvals.
- Provide customer support.
- Detect, prevent and investigate fraud, abuse, policy violations and security incidents.
- Analyse and improve the Service and fix technical problems.
- Comply with legal, tax and accounting obligations.
Legal bases (where GDPR or similar laws apply): performance of a contract, your consent, our legitimate interests (security, fraud prevention and service improvement), and compliance with legal obligations.
4. How your information is shared
We share personal data only as described below. We do not sell your personal data.
| Recipient | Purpose |
|---|---|
| Google Firebase / Google Cloud | Authentication, hosting, database, file storage, Cloud Functions, notifications and crash reporting |
| Delivery staff / couriers | Your name, phone number, delivery address and delivery pin location, to deliver your order |
| OpenStreetMap (OpenStreetMap Foundation) | Delivery pin coordinates, address search text and the map area viewed, to look up addresses and display the delivery map (see Section 2.3) |
| Our store administrators | Manage orders, refunds, rewards, promoter applications and withdrawals |
| Payment recipients' banks / e-wallet providers | Process manual payments, refunds or promoter payouts |
| ExchangeRate-API (open.er-api.com) | The App downloads public currency exchange rates to show prices in your currency. No account or personal data is sent, although the provider receives your IP address as with any internet request |
| Professional advisers, auditors and tax authorities | Accounting, tax and legal compliance |
| Law enforcement or regulators | Where required by law, court order, or to protect our rights, users or the public |
| A successor entity | If we merge with, acquire or are acquired by another business, subject to this Policy |
We may also share aggregated or de-identified information that cannot reasonably be used to identify you.
5. International data transfers
The Service is operated using Google's global infrastructure. Your data may be processed in countries other than your own, including the United States and the Asia-Southeast (Jakarta) Google Cloud region.
Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. Data retention
| Data | Retention |
|---|---|
| Account profile | Until you delete your account, then removed within 30 days |
| Order and transaction records, refunds, commissions, withdrawals | Up to 7 years after the transaction, then deleted or anonymised |
| Delivery pin location | Kept with the order it belongs to, for the same period as the order record |
| Payment proof screenshots, complaint photos | Kept with the order they belong to while your account exists; deleted when you delete your account |
| Push notification tokens | Removed on logout, account deletion, or when invalid |
| Crash logs | Up to 90 days |
| Support correspondence | Up to 2 years after resolution |
7. Security
We use industry-standard measures to protect your data, including:
- Encryption in transit (HTTPS/TLS) for communication with our servers.
- Google Firebase Authentication for password handling and SMS phone verification.
- Server-side access rules restricting users to authorised data.
- Restricted and monitored access to production systems.
No method of transmission or storage is 100% secure. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as required by law.
8. Your rights
Depending on where you live, you may have the right to:
- Access personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your account and personal data.
- Object to or restrict certain processing.
- Withdraw consent for optional permissions.
- Data portability — receive certain data in a portable format.
- Lodge a complaint with your local data-protection authority.
To exercise any right, email support@finasto.net from the email address on your account. We will respond within the time required by applicable law (generally 30 days).
9. Notifications and permissions
| Permission | Purpose | How to turn it off |
|---|---|---|
| Notifications | Order status, refunds, points, referral and promoter updates | Device Settings → Apps → Finasto Coffee → Notifications |
| Photos / media | Choose a profile picture or upload payment proof | Managed in Device Settings → Permissions |
| Camera (optional) | Take a photo to attach to a complaint, and (store staff only) scan order QR codes at pickup. Used only while you are on those screens | Device Settings → Apps → Finasto Coffee → Permissions → Camera |
| Location (optional) | Fill in your delivery address and place the delivery pin at checkout | Device Settings → Apps → Finasto Coffee → Permissions → Location |
10. How to delete your account and data
You can delete your account directly in the App:
You can also request deletion by emailing support@finasto.net with the subject "Delete my account" from your registered email address, or by visiting https://finasto.net/delete-account.html.
What is deleted: your authentication record, profile (name, email, phone, address, photo), loyalty points and badges, saved device/notification tokens, promoter application, your in-app notifications, and the photos you uploaded (payment proofs and complaint photos).
What may be retained (and why): order, payment, refund, commission and withdrawal records are retained for up to 7 years to comply with tax, accounting and anti-fraud obligations. Your name, phone number, address, delivery pin location, order notes, bank details and uploaded photos are removed from these records. They keep only an internal reference number that no longer corresponds to any account.
Deletion is completed within 30 days of your request.
11. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App or by email before the changes take effect.
The "Last updated" date at the top shows the latest version. Continued use of the Service after changes take effect means you accept the updated Policy.