Privacy Policy
Effective date: 1 September 2026
This Privacy Policy explains how CoffeePal AI Limited ("CoffeePal", "we", "us" or "our") collects, uses, stores, shares, and protects personal data when you visit coffeepal.ai, create an account, upload coffee materials, generate, edit, and publish coffee visualisation pages, or otherwise interact with our Service.
This policy is intended for business users, including specialty coffee roasters, self-roasting cafes, content operators, and coffee product teams, in mainland China, Hong Kong, Macau, Taiwan, South Korea, and other coffee markets. It does not remove any mandatory rights available under applicable law.
1. Controller and contact details
The controller of your personal data is:
CoffeePal AI Limited
UNIT 2904-05, 29/F UNIVERSAL TRADE CTR
3 ARBUTHNOT RD, CENTRAL, HONG KONG
Email: hello@coffeepal.ai
2. Personal data we collect
We collect the following categories of data, depending on how you use the Service:
| Category | Examples | Why we use it |
|---|---|---|
| Account and contact data | email address, password or authentication credentials, display name, organisation details you choose to provide | create and secure your account, authenticate you, provide support, and communicate about the Service |
| Coffee materials and content | coffee name, origin, process, roast, tasting notes, product information, text, images, brand assets, editing instructions, and published-page settings | create, edit, host, and publish the coffee visualisation pages you request |
| Generated content and activity | prompts/instructions, generated pages and text, editing history, publication status, and Credit consumption records | provide the requested generation workflow, enable revision and publication, troubleshoot, prevent misuse, and maintain your account records |
| Transaction data | plan selected, order ID, amount, currency, payment status, subscription cancellation, invoice/tax information you provide, refunds, disputes, and Credits balance/history | process subscriptions and Credit packages, manage billing, prevent fraud, and comply with accounting and legal obligations |
| Technical and security data | IP address, browser and device type, operating-system/browser version, request and error logs, session identifiers, approximate location inferred from IP, and security events | deliver the Service, detect abuse, keep accounts secure, diagnose faults, and protect our infrastructure |
| Communications | support requests, feedback, and correspondence | respond to you and improve support |
Please do not upload personal data, sensitive personal information, or confidential information that is not necessary for the Service. If materials you upload contain personal data about another person, you must have a valid authority to provide it and to instruct us to process it. We do not ask for or use device contacts, SMS, precise location, SIM information, device application lists, IMEI, or other mobile-device identifiers.
3. How we use personal data and our grounds for doing so
We process personal data to provide the Service you request, including account registration, content upload, AI-assisted generation, editing, publication, subscription administration, and Credits management. We also process it to meet legal obligations, protect the security and integrity of the Service, investigate fraud or misuse, and respond to support requests.
Where applicable law requires consent, we will seek it before the relevant processing. We may otherwise process data where necessary to perform our contract with you, to comply with law, or for our legitimate interests in operating, securing, and improving the Service, provided those interests do not override your rights. We do not use your coffee materials, uploaded content, or prompts to train our own general-purpose AI models without your separate, explicit permission.
4. AI-assisted generation
CoffeePal uses the Gemini API and OpenAI API, selected as needed for the requested feature, to process the text, images, and instructions needed to generate your requested coffee visualisation content. We send only the content reasonably necessary for that task. AI output may be inaccurate, incomplete, or inappropriate for your intended use; you must review and edit output before publishing or relying on it.
Generated content is stored with your account so that you can edit, revise, and publish it. Your published page may be accessible to anyone with its public link. Do not publish personal data or confidential information unless you have a lawful basis and intend it to be public.
5. Service providers and disclosures
We use providers to operate the Service. They may process personal data only as necessary to provide services to us, subject to appropriate contractual and security controls:
| Provider/category | Role | Data involved |
|---|---|---|
| Amazon Web Services (AWS) | application hosting, authentication/backend services, database, object storage, backups, and security operations | account data, content, generated content, technical logs, and account records |
| Cloudflare | DNS, content delivery, web-application firewall, caching, edge/network security, and request routing | IP address, browser/device/request data, and security logs |
| Google Gemini API | AI-assisted content generation | the prompts, text, images, and instructions necessary for a generation request |
| OpenAI API | AI-assisted content generation | the prompts, text, images, and instructions necessary for a generation request |
| Payment provider shown at checkout | payment processing and fraud controls | billing contact data, order/payment status, amount/currency, and dispute/refund data |
We may also disclose data when required by law, to enforce our Terms, to protect users or the public, or in connection with a merger, acquisition, financing, or sale of assets. If ownership changes, the successor must use personal data consistently with this Policy or provide notice and choices required by law.
6. International processing and data location
Our application data is stored in AWS. Cloudflare, Google Gemini API, OpenAI API, payment providers, and their support/security operations may operate globally. Therefore, personal data necessary for network delivery, security, payment, or an AI-generation request may be accessed or processed outside your country or region, including in Singapore and other locations where those providers operate. We take steps required by applicable law for cross-border processing, including contractual, organisational, and technical safeguards where appropriate.
For users in mainland China, using our Singapore-hosted Service involves cross-border provision of the personal data needed to create an account and use the Service. We will provide any separate notice and obtain any separate consent required by applicable law before a transfer that requires it.
7. Retention
We retain account data and private content while your account remains active and for as long as needed to provide the Service, resolve disputes, enforce agreements, secure the Service, and meet legal obligations. We retain transaction, invoice, and payment-dispute records for the period required by applicable tax, accounting, and other laws. We delete or anonymise data when it is no longer needed, subject to legal retention requirements and reasonable backup-cycle delays.
You can delete published content or request account deletion by contacting us. Deleting an account may make unused Credits and associated generation history unavailable; this does not affect any refund or other right that cannot lawfully be excluded.
8. Security
We use reasonable technical and organisational measures designed to protect personal data, including access controls, encryption in transit where supported, and measures to protect our hosting and storage environment. No internet service is completely secure. If a personal-data incident occurs, we will take appropriate remedial action and notify affected persons and authorities where required by law.
9. Your rights and choices
Subject to applicable law, you may have rights to access, correct, delete, obtain a copy of, object to or restrict certain processing of, withdraw consent for, or request transfer of your personal data. You may also request information about our processing and recipients of your personal data. To make a request, email hello@coffeepal.ai. We may need to verify your identity and will respond within the period required by applicable law.
You may complain to the data-protection authority with jurisdiction over you if you consider our handling of your personal data unlawful. This does not affect other remedies available to you.
10. Cookies
We use strictly necessary cookies and similar technologies for account sessions, security, and Service operation. We do not currently use advertising cookies or non-essential analytics cookies. See our Cookie Policy for details and choices.
11. Children
The Service is designed for business users and is not directed to children. Do not create an account or submit personal data if you are below the minimum age required to consent to data processing in your jurisdiction. If we learn that we have collected a child's personal data without required consent, we will take appropriate steps to delete it.
12. Changes to this Policy
We may update this Policy when our Service, data practices, or legal obligations change. We will publish the updated version and revise the effective date. For material changes, we will provide additional notice or obtain consent where required by law.
13. Contact us
Questions, requests, and privacy concerns can be sent to hello@coffeepal.ai.