This Privacy Policy explains how Finasto ("Finasto", "we", "us" or "our") collects, uses, shares and protects your personal information when you use the Finasto Coffee mobile application (the "App") and the website https://finasto.net (together, the "Service").
By creating an account or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Data Controller: Finasto, Rashid Minhas Rd, Karachi, Pakistan
Contact for Privacy Questions: support@finasto.net
1. Summary (Plain Language)
- We use your data to create your account, take and deliver your coffee orders, run the loyalty-points and referral programs, send you order notifications, provide customer support, and keep the Service secure.
- We do not sell your personal data.
- We do not show third-party advertising in the App.
- You can delete your account and personal data at any time (see Section 10).
- We use Google Firebase to run the Service, so some data is processed on Google's cloud infrastructure.
2. Information We Collect
2.1 Information You Give Us
| Data | When | Why |
|---|---|---|
| Name | Sign-up, checkout, profile | Identify you, label your orders |
| Email address | Sign-up | Login, account recovery, service messages |
| Password | Sign-up | Secured by Google Firebase Authentication (we never see it in plain text) |
| Phone number | Checkout, profile | Contact you about your order / delivery |
| Delivery address, city, country, postal code | Checkout, profile | Deliver your order and calculate delivery charges |
| Profile photo (optional) | Profile | Personalise your account |
| Payment proof screenshot (optional) | Checkout | Confirm a manual bank/e-wallet/QR payment |
| Bank name and account number | Refund request, promoter withdrawal request | Send you a refund or a promoter payout |
| Order notes / special instructions | Checkout | Fulfil your order correctly |
| Support messages | When you contact support@finasto.net | Answer your request |
| Promoter application details | Promoter sign-up | Review and manage your participation in the referral program |
2.2 Information Collected Automatically
| Data | Source | Why |
|---|---|---|
| Country (region setting) | Your device's system language/region setting — read directly on-device | Show the correct currency, pricing and available branches |
| Push notification token | Firebase Cloud Messaging | Send order-status and program notifications |
| Device information | Firebase | Operate the Service and diagnostics |
| Crash logs and diagnostic data | Firebase Crashlytics | Detect and fix bugs and crashes |
| Order history, loyalty points, badges, referral attribution | Generated as you use the Service | Run the ordering, rewards and referral features |
2.3 Location Details
The App does not request the device location permission, does not use GPS, and does not call any geocoding or location API.
Your country is inferred only from your device's system region/language setting (the same setting your phone already uses for date formats, etc.), read directly on-device — nothing is sent to us or to Google to determine it.
You can change the App's selected country manually at any time regardless of your device setting.
2.4 Children's Privacy
The Service is intended for users 18 years of age or older (it includes a monetary referral-payout feature).
We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact support@finasto.net and we will delete it.
3. How We Use Your Information
We use personal data to:
- Create and manage your account and authenticate you.
- Accept, process, prepare, deliver and track your orders and pre-orders.
- Process manual payments and verify payment proofs.
- Operate the loyalty-points / rewards program.
- Operate the promoter / referral program, attribute referrals, calculate commissions and process withdrawal requests.
- Send you transactional notifications including order status, refunds, points earned, referral events and promoter approvals.
- Provide customer support.
- Detect, prevent and investigate fraud, abuse, policy violations and security incidents.
- Analyse and improve the Service and fix technical problems.
- Comply with legal, tax and accounting obligations.
Legal bases (where GDPR or similar laws apply): performance of a contract, your consent, our legitimate interests (security, fraud prevention and service improvement), and compliance with legal obligations.
4. How Your Information Is Shared
We share personal data only as described below. We do not sell your personal data.
| Recipient | Purpose |
|---|---|
| Google Firebase / Google Cloud | Authentication, hosting, database, file storage, Cloud Functions, notifications and crash reporting |
| Delivery staff / couriers | Your name, phone number and delivery address, to deliver your order |
| Our store administrators | Manage orders, refunds, rewards, promoter applications and withdrawals |
| Payment recipients' banks / e-wallet providers | Process manual payments, refunds or promoter payouts |
| Professional advisers, auditors and tax authorities | Accounting, tax and legal compliance |
| Law enforcement or regulators | Where required by law, court order, or to protect our rights, users or the public |
| A successor entity | If we merge with, acquire or are acquired by another business, subject to this Policy |
We may also share aggregated or de-identified information that cannot reasonably be used to identify you.
5. International Data Transfers
The Service is operated using Google's global infrastructure. Your data may be processed in countries other than your own, including the United States and the Asia-Southeast Google Cloud region.
Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. Data Retention
| Data | Retention |
|---|---|
| Account profile | Until you delete your account, then removed within 30 days |
| Order and transaction records, refunds, commissions, withdrawals | Up to 7 years after the transaction, then deleted or anonymised |
| Payment proof screenshots | Deleted within 90 days after the order is completed or cancelled, unless needed for a dispute |
| Push notification tokens | Removed on logout, account deletion, or when invalid |
| Crash logs | Up to 90 days |
| Support correspondence | Up to 2 years after resolution |
7. Security
We use industry-standard measures to protect your data, including:
- Encryption in transit (HTTPS/TLS) for communication with our servers.
- Google Firebase Authentication for password handling.
- Server-side access rules restricting users to authorised data.
- Restricted and monitored access to production systems.
No method of transmission or storage is 100% secure. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as required by law.
8. Your Rights
Depending on where you live, you may have the right to:
- Access personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your account and personal data.
- Object to or restrict certain processing.
- Withdraw consent for optional permissions.
- Data portability — receive certain data in a portable format.
- Lodge a complaint with your local data-protection authority.
To exercise any right, email support@finasto.net from the email address on your account. We will respond within the time required by applicable law (generally 30 days).
9. Notifications and Permissions
| Permission | Purpose | How to Turn It Off |
|---|---|---|
| Notifications | Order status, refunds, points, referral and promoter updates | Device Settings → Apps → Finasto Coffee → Notifications |
| Photos / media | Choose a profile picture or upload payment proof | Managed in Device Settings → Permissions |
10. How to Delete Your Account and Data
You can delete your account directly in the App:
You can also request deletion by emailing support@finasto.net with the subject "Delete my account" from your registered email address, or by visiting https://finasto.net/delete-account.html .
What is deleted: your authentication record, profile (name, email, phone, address, photo), loyalty points and badges, saved device/notification tokens, promoter application, and personal identifiers on your notifications.
What may be retained (and why): order, payment, refund, commission and withdrawal records are retained in de-identified or legally required form for up to 7 years to comply with tax, accounting and anti-fraud obligations. These records are no longer linked to your account after deletion.
Deletion is completed within 30 days of your request.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App or by email before the changes take effect.
The "Last Updated" date at the top shows the latest version. Continued use of the Service after changes take effect means you accept the updated Policy.