Privacy Policy

Who we are

Papi Rewards provides QR-based digital stamp cards for independent coffee shops. For privacy questions, contact us at support@papi.lt.

Cafe owners are responsible for the customer information they choose to collect through their loyalty program. Papi Rewards provides the software used to store and manage that information.

Information we collect

• Owner account data, such as name, email address, authentication records, and account settings.
• Cafe profile data, such as cafe name, public slug, country, city, reward rules, and subscription status.
• Customer loyalty data entered by a cafe or customer, such as customer name, optional email or phone number, card token, stamp history, rewards earned, and rewards redeemed.
• Operational data, such as activity logs, support messages, security events, device/browser metadata, and webhook events needed to keep billing and account access accurate.
• Billing data processed through Dodo Payments, including checkout session IDs, customer or subscription IDs, plan status, invoices, tax information, refund status, and payment events. We do not store raw card numbers.

How we use information

• To create accounts, authenticate users, and provide the dashboard, QR cards, stamp terminal, rewards, and subscription billing.
• To send account, security, subscription, support, and service messages.
• To prevent abuse, investigate errors, protect the service, and maintain audit logs.
• To meet legal, tax, accounting, dispute, fraud-prevention, and payment network obligations.
• To improve product reliability and understand high-level product usage.

GDPR and privacy rights

Where GDPR, UK GDPR, or similar data protection laws apply, we rely on legal bases such as contract performance, legitimate interests, legal obligations, and consent where consent is requested.

Depending on your location and role, you may have rights to access, correct, delete, restrict, export, or object to processing of your personal data, and to withdraw consent where processing is based on consent. You may also have the right to complain to a supervisory authority.

Dodo Payments

Paid subscriptions are handled through Dodo Payments checkout and billing infrastructure. Dodo Payments may collect payment method details, billing address details, tax information, fraud signals, and information required to issue invoices, process refunds, handle disputes, and comply with payment and tax rules.

Papi Rewards receives billing status and identifiers from Dodo Payments so we can activate, renew, update, or restrict subscription access.

Service providers and sharing

We share information with service providers that help us run Papi Rewards, including hosting, database, authentication, storage, support, analytics, and payment providers. We may also share information if required by law, to protect rights and security, or as part of a business transfer.

Retention and security

We keep personal data only as long as needed to provide the service, meet legal and accounting obligations, resolve disputes, maintain security, and enforce agreements. We use reasonable technical and organizational safeguards, but no online service can be guaranteed to be completely secure.

International transfers

Papi Rewards, Supabase, Dodo Payments, and other service providers may process information in countries outside your own. Where required, we use appropriate safeguards for international transfers.

Children

Papi Rewards is intended for cafe owners and loyalty customers old enough to use the service under local law. It is not directed to children under 16.

Contact

For privacy requests, deletion requests, or questions about how Papi Rewards handles personal data, contact support@papi.lt.