Privacy policy

1. Data controller

[Raison sociale], 3 rue Anatole France, immeuble Le Lys Rouge, centre-ville, Nouméa, New Caledonia — contact@baristacafe.nc — +687 46 12 01.

2. The website

The website is informational: it requires no account and sets no advertising or analytics cookies. Our host (Vercel) keeps technical logs (IP address, browser, requested page) for security and reliability, for a limited period.

3. Data collected by the app

• Account: email address, password (stored hashed, never in plain text), phone number (optional). If you sign in with Google or Apple, we receive your email address (possibly a private relay address from Apple) and a technical identifier.
• Orders: items ordered, amounts, optional note, requested pickup time, order and payment status.
• Payment: card payments are processed directly on the secure platform of our provider ePayNC. We never receive or store your card number; we only keep the transaction reference and status.
• Loyalty: personal QR code, stamps / loyalty balance, rewards earned.
• Notifications: your device's technical notification token and device type, if you allow notifications.

The app does not use your location, shows no ads and never sells any data.

4. Purposes and legal bases

• Creating and managing your account, taking, preparing and handing over your orders, processing payments: performance of a contract (your orders).
• Issuing invoices and keeping our accounts: legal obligation.
• Running the loyalty programme: performance of a contract.
• Order status notifications: performance of a contract; news or offer notifications are only sent with your consent, which you can withdraw at any time in your phone settings.
• Securing the service and preventing fraud: legitimate interest.

5. Recipients and service providers

Your data is only accessible to authorised Barista Café staff (preparing and tracking orders) and to our technical providers, acting on our instructions:

• Supabase — database hosting and authentication.
• Vercel — website hosting.
• Google (Firebase Cloud Messaging) — push notifications.
• Google and Apple — only if you choose to sign in with them.
• ePayNC — secure online payment.
• EazyBill — point-of-sale and invoicing software (invoices for your orders).

6. Transfers outside New Caledonia

Some providers (Supabase, Vercel, Google, Apple) may host or process data outside New Caledonia and the European Union. These transfers are covered by the contractual safeguards offered by these providers (including standard contractual clauses).

7. Retention periods

• Account and loyalty: while your account is active, deleted when you close it.
• Orders and invoices: statutory retention period for accounting records (10 years). When you delete your account, orders are dissociated from your identity.
• Notification tokens: until you sign out, uninstall the app or delete your account.

8. Deleting your account

You can delete your account at any time in the app: Profile → “Delete account”. Deletion is immediate and permanent: your account details, QR code, loyalty balance and notification tokens are erased; your order history is anonymised (kept only for our accounting obligations).

If you no longer have access to the app, email us at contact@baristacafe.nc from your account's email address with the subject “Account deletion”: we will process your request within 30 days.

9. Your rights

Under French Law No. 78-17 of 6 January 1978 (“Informatique et Libertés”), applicable in New Caledonia, you have the right to access, rectify and erase your data, to object to and restrict its processing, and to set instructions regarding your data after your death.

To exercise these rights: contact@baristacafe.nc. You may also lodge a complaint with the CNIL (www.cnil.fr).

10. Security

All communication between the app, the website and our servers is encrypted (HTTPS). Database-level security rules ensure each customer can only access their own orders and loyalty card.

11. Children

The app is intended for a general audience. Children under 15 must obtain consent from a parent or legal guardian before creating an account.

12. Changes

We may update this policy, in particular when adding new features. The date of the last update is shown at the top of this page; you will be notified in the app of any significant change.