Who we are
The Coffee Realm, Lot 1 Block 210 Mark Street corner Dollar Street, Quezon City, Philippines 1121. We are the personal information controller for everything described here.
For anything to do with your information — a copy of it, a correction, or deletion — email main.thecoffeerealm@gmail.com or call 0926 916 0424. We answer within 15 working days, which is the period the Data Privacy Act allows.
What we collect, and why
The table below is the whole list. If something is not on it, we do not hold it.
| What | Why we need it |
|---|---|
| Your email address and password | To sign you in. The password is stored only as a one-way hash by our sign-in provider — nobody at the shop can read it, including us. |
| Your name | To put on the order so the right bag reaches the right person at the counter. |
| Your contact number | So the shop or the rider can reach you if something about your order changes. Delivery orders only, and orders you place at the counter where you give one. |
| Your delivery address and map pin | To work out the delivery fee and to give the rider somewhere to go. Delivery orders only. |
| What you ordered, and what you paid | To make it, to give you a receipt, and to keep the sales records the BIR requires of us. |
| Your date of birth | Only if you choose to give it, and only to send you a birthday reward. You can order, earn points and spend them without ever entering it. |
| Loyalty points and what you redeemed | To run the rewards scheme and to stop the same reward being spent twice. |
| Payment reference and a screenshot of your transfer | So a person at the counter can check the money arrived before we make your order. We never see or hold your card number — card payments go straight to the payment provider. |
| A photo of your PWD or Senior Citizen ID | Only if you claim that discount. See the section below — this one is treated differently. |
| Messages you send us about an order | So we can answer you, and so the next person on shift can see what was already said. |
| Feedback and ratings you leave | To know how we are doing. Published on the site without your name attached. |
| A photograph of something wrong with your order | Only if you send one when you ask for a refund. We look at it to check the claim, and it stays with that order’s refund record. |
| Refund payout details you give us | Only when you ask for a refund, and only to send the money back to you. |
PWD and Senior Citizen ID photographs
Under the Data Privacy Act this is sensitive personal information, because it says something about your age or your health. We treat it accordingly.
We ask for it only because Republic Act 9994 and Republic Act 10754 require us to verify the discount before we give it, and to keep a record that we did. You are never asked for it unless you claim one of those discounts.
The photograph is stored in a private folder that has no public address at all. A member of staff can open it only while they are checking your order, and only through a link that expires. It is not attached to your profile, it is attached to the one order it was used for.
We keep it for as long as the BIR requires us to be able to substantiate the discount, and no longer. You may ask us to confirm what we hold and when it will be deleted.
What we deliberately do not collect
We think this list matters as much as the one above.
- No advertising or analytics trackers. There is no Google Analytics, no Meta Pixel, no heatmap tool, and no advertising cookie on this site. We do not know which pages you looked at.
- No card numbers. Card and e-wallet payments are handled entirely by the payment provider. Nothing of your card ever reaches our database.
- No location tracking. The map on the delivery page uses your location only at the moment you press the button, only to drop a pin, and only in your browser until you submit the order.
- No contact list, photo library or device access of any kind.
- No profiling and no automated decisions. A person decides every refund, every discount and every cancellation.
Who else sees it
Five companies, each doing one job, and none of them for marketing.
| Who | What they get |
|---|---|
| Supabase | Hosts our database and sign-in. Everything above is stored there. |
| Vercel | Hosts this website. Sees the ordinary request information any web host sees. |
| PayMongo | Handles card and e-wallet payments, and receives your payment details directly. |
| Lalamove | Receives your delivery address and contact number, and only when you order a delivery, so the rider can find you. |
| Carries our email. Order confirmations and refund updates are sent through Gmail, and anything you email us — including a photograph of a wrong order — arrives in a Gmail mailbox. |
How long we keep it
Order and payment records: ten years, because the National Internal Revenue Code requires us to keep books of account and their supporting records for that long. We cannot delete a paid order before then even if you ask us to, and this is the one thing on this page we cannot be flexible about.
Your account, profile, points and birthday: until you ask us to close the account. Then it goes, apart from the order records above, which are kept detached from your profile.
Order messages, feedback and delivery pins: two years.
Photographs you send us with a refund claim: these reach us by email, so they sit in that mailbox. We delete them a year after the claim is settled.
ID photographs: as described in the section above.
Your rights
The Data Privacy Act gives you all of these, and you exercise any of them by emailing main.thecoffeerealm@gmail.com.
- To be told what we hold about you, and to be given a copy of it.
- To have anything wrong corrected.
- To have it deleted, other than the order records the BIR requires us to keep.
- To object to a use of it, and to withdraw a consent you gave.
- To take your data elsewhere in a readable format.
- To complain to the National Privacy Commission at privacy.gov.ph if we have not dealt with you properly. You do not have to come to us first, though we would rather you did.
Children
This site is not intended for children under 18 and we do not knowingly collect their information. If you believe a child has given us something, tell us and we will remove it.
If this policy changes
The date at the top is the date it last changed. If we ever change something that affects what we collect or who sees it, we will say so on the site rather than quietly updating the page.