Privacy
Privacy policy
This section covers the website. For the Cupd app, see the app privacy policy.
Controller
Maximilian, see contact above.
Hosting
This site is hosted by Vercel Inc. (USA). Loading a page transfers your IP address to Vercel as part of standard server operation, this is necessary to deliver the page at all (Art. 6 (1)(f) GDPR, legitimate interest in a working website). Vercel processes this under its own data processing terms; where data leaves the EU, Vercel relies on the EU-US Data Privacy Framework or standard contractual clauses. The domains are registered with IONOS SE (Germany).
Server log data
Like any web server, Vercel's infrastructure automatically records access logs (IP address, page requested, timestamp, browser type). This is standard operation, not evaluated individually, and deleted on Vercel's normal rolling schedule.
No tracking, no analytics, no third-party fonts
This site sets no advertising or analytics cookies and runs no tracking or analytics scripts. Typefaces are served from this domain, not from Google's servers, so no font request leaves this site. Your browser saves your language choice (English/German) and, only after you sign up for the waitlist or claim or apply for a café, your spot on the waitlist or your entry, in localStorage. This is purely functional, never read by us, and not a cookie in the legal sense, so it needs no consent banner. Which page brought a sign-up we only learn from the form you send (see the waitlist section).
Contact form
If you use the contact form, the name, email address and message you enter are sent directly to our database at Supabase Inc. (our data processor) and stored so we can answer you. Legal basis: Art. 6 (1)(b) GDPR (steps prior to a contract) or Art. 6 (1)(f) GDPR (our legitimate interest in answering enquiries) if no contract is intended. Only the responsible party named above can read these messages. We delete a message once your enquiry is resolved and no longer needs to be kept, at the latest after 12 months.
Waitlist and beta requests
If you join the waitlist on cupd.app, we store your email address, your name (optional), your language and your browser's user agent at Supabase Inc. (our data processor), so we can tell you when Cupd launches. We also store the page on cupd.app where you sent the form and the page you came from, for other websites only their address (such as google.com), so we can see which of our pages bring sign-ups. If you came through a link with a campaign tag, for example from one of our ads, we store that tag instead of the page you came from. For this we set no cookies and store nothing on your device; your browser names the previous page anyway. If you ask for a seat in the private TestFlight beta, we also store that request and, if you give one, your Apple ID email, and we send the request to ourselves by email via Resend Inc. (data processor) so we can add you as a tester in Apple's TestFlight. Legal basis: Art. 6 (1)(a) GDPR (your consent by submitting the form), for the two pages Art. 6 (1)(f) GDPR (our legitimate interest in knowing which pages bring sign-ups). You can withdraw at any time by writing to us, and we will delete your entry. Otherwise we delete the waitlist once Cupd has launched and we have told you, at the latest after 12 months.
Claims and applications from cafés and roasters
When you search for your café or roastery on cupd.app, your search term is sent to Supabase Inc. (data processor) to look up the public listings in the Cupd app. We don't store it. If you then claim a listing or apply, we store whether you claim or apply, the listing you picked (if any), the business name, the type (café, roastery or both), the location, the email address, the Instagram handle (optional) and your language at Supabase Inc., and we send it to ourselves by email via Resend Inc. (data processor), so we can prepare your profile and get in touch before launch. As with the waitlist, we also store the page where you sent the form and the page you came from (for other websites only their address, for a link with a campaign tag that tag). Legal basis: Art. 6 (1)(b) GDPR (steps you asked for before a contract) and Art. 6 (1)(f) GDPR (our legitimate interest in onboarding cafés and roasters and in knowing which pages bring requests). Write to us at any time and we will delete your entry. Otherwise we delete it once your profile is claimed or your application is decided, at the latest 12 months after launch.
Your rights
You have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), and port (Art. 20) your data, and to object to its processing (Art. 21 GDPR). Write to the contact above to exercise any of these. You also have the right to complain to a data protection supervisory authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit.