Skip to content

Privacy Policy

Draft for legal review. Written in plain English for an Australian lawyer to check before launch. Not yet reviewed. Items in [square brackets] still need filling in or a decision.

Effective [EFFECTIVE DATE]

This policy explains what personal information [COMPANY NAME] Pty Ltd (ABN [ABN]) collects through CafeScoreboard, why, and what you can do about it. We handle personal information in line with the Australian Privacy Principles.

1. What we collect

If you just browse

  • Nothing that identifies you. If you choose to show your position on a city map, your location is used in your browser only and is not sent to us or stored.

If you have an account

  • Your email address and password (stored only as a secure hash by our authentication provider).
  • Your café listing: name, photo, tagline, address, neighbourhood, map position and links. This is public.
  • Your bids: amount, time and the rank before and after. Amounts and times are public on your café’s profile; who placed them is never shown.
  • Payment details are collected and held by Stripe, not us. We receive the payment amount, a payment reference and your email.
  • A one-way scrambled (hashed) version of the IP address used to bid, to help detect fraud. We don’t keep the IP itself.
  • What you type into the café/address search when listing.

If you report a listing

  • The reason and note you give, and your email if you choose to include it.

Everyone

  • A count of clicks on each café’s website link (a number per café — not linked to you).
  • Essential cookies only, to keep you logged in. We don’t use advertising or analytics cookies. If we ever add analytics, we’ll update this policy first.

2. Why we use it

  • To run your account, show your listing and record your bids.
  • To take payments and send receipts (via Stripe).
  • To prevent fraud and abuse, and to handle reports and chargebacks.
  • To contact you about your account, listing or a report.
  • To meet our legal obligations, including tax record-keeping.

We don’t sell personal information. We won’t send you marketing emails unless you opt in, and every marketing email will have an unsubscribe link.

3. Who we share it with

  • Stripe — payment processing.
  • Supabase — database, login and photo hosting. Our data is hosted in Supabase’s Sydney, Australia region.
  • OpenStreetMap Nominatim — receives the café/address search text you type when listing.
  • Resend — sending account, login and password-reset emails.
  • Law enforcement or regulators, where the law requires it.

4. Overseas

Some providers may store or process information outside Australia:

  • Stripe — Australia and the United States (and other countries where Stripe operates, for payment processing and fraud prevention).
  • Supabase — stored in Australia (Sydney). Supabase staff and support systems may access it from the United States.
  • Resend — United States.
  • OpenStreetMap Nominatim — the United Kingdom and the European Union. It receives only the search text you type, not your account details.

We use providers that commit to protecting information to a standard similar to the Australian Privacy Principles, and we take reasonable steps to make sure they do.

5. How long we keep it

  • Account and listing details: while your account is open, then deleted within 90 days of you closing it.
  • Payment and bid records: 5 years, to meet Australian tax record-keeping rules.
  • Reports: up to 2 years, so we can spot repeat problems. Reporter emails are deleted once the report is resolved.

6. Security

Information is encrypted in transit, access is limited to people who need it, and card details never touch our systems. No system is perfectly secure; if a data breach is likely to cause you serious harm, we’ll tell you and the OAIC as required.

7. Your choices and rights

  • You can see and edit your listing from your dashboard at any time.
  • You can ask for a copy of the personal information we hold about you, or ask us to correct or delete it.
  • We’ll respond within 30 days. Some records (like payment records) must be kept by law.

8. Children

CafeScoreboard is for people aged 18 or over. We don’t knowingly collect information from children.

9. Complaints

Email raminau022@gmail.com. We’ll reply within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Changes

If we change this policy in a way that matters, we’ll update the date above and email account holders. See also our Terms of Service.