YOUR DATA, YOUR CHOICES
Privacy policy
Updated 24 October 2026
Vivid Bean Café Ltd operates the Vivid Bean Café ordering, loyalty and community service at vividbeancafe.onrender.com, including its Android customer app. Contact us at vividbeancafe@gmail.com or 11 Hanger Green, London, W5 3EL, United Kingdom.
Information we collect
We process the email address and name you provide, account identifiers, sign-in verification records, session information and communication preferences. When linked to your account, orders include purchases, payment status, visit history, Beans, rewards and adjustments. Community activity can include posts, uploaded images, comments, reactions, meetup proposals and registrations. The game records scores, progress and reward activity. Please do not include sensitive personal information in posts or images.
We also process technical information needed to operate and protect the service, such as request logs, IP addresses, browser or app information, and notification subscription details if you enable device notifications. Community viewing statistics distinguish signed-in member views and guest visits; these are used to understand engagement. We use browser storage for sessions, basket and app settings.
How we use information
We use this information to fulfil orders, manage accounts and loyalty rewards, authenticate access, run the game and community, moderate submissions, administer meetups, provide support and protect against abuse. Order and account processing is necessary to provide the service you request. Security and moderation support our legitimate interests in operating a reliable service. We retain relevant financial records to meet legal obligations.
Email and notifications
Sign-in codes and essential account communications support the service. Optional community updates, offers and promotional emails or notifications depend on your saved communication choices. You can change these in your profile, use the unsubscribe link in update emails, or contact us. Device notifications also require browser or operating-system permission and can be disabled in device settings. Joining the community does not itself grant access to your mailbox.
Google and Gmail API access
The café authorises its own Google account to send messages through the Gmail API using the gmail.send permission. This is used to send sign-in codes and account or community emails to customers, including optional updates where enabled. Customers sign in using an emailed code; we do not ask customers to authorise access to their Google accounts or mailboxes.
The sending integration processes recipient email addresses and the message subject and content, and sends them to Google for delivery. The café's sender authorisation credentials and tokens are held in private configuration used by the sending service. This integration does not request permission to read inbox messages, contacts or files. Google may retain sent messages and delivery records under its service terms. The café account holder can revoke the integration through their Google Account permissions and request removal of sender credentials.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it to train general-purpose AI models, or use it for advertising targeting. Access by authorised personnel is limited to operating the service, support, security and legal requirements.
Payments and service providers
Card payments are handled by Revolut. Our service stores order references, amounts and payment status rather than full payment card numbers or card security codes. Authorised café staff can access information needed for their role. We use Render for hosting, Supabase/PostgreSQL for database storage, Cloudinary for images and configured backup storage, Google for email delivery, and browser or device push services for notifications. These providers process the information needed to deliver their services. We may disclose information where required by law or to protect the service.
Community visibility
Approved public posts and meetup details can be viewed by visitors without an account. Member-only content is restricted to signed-in members as configured. Other members may see the display name and content you publish, including comments or organiser information. Your account email is not presented as a public member directory. Administrators can review member information, proposals, participation and communication preferences.
Storage, security and retention
Information is stored in our service database and operational backups. Providers may process data outside the UK; applicable transfer safeguards depend on the provider and service configuration. Access controls and encrypted HTTPS connections help protect information. No online service can guarantee absolute security.
We keep account information while needed to provide the service and deal with support or disputes. Account deletion removes active profile and community information according to the app's deletion process; financial order records and necessary audit records can be retained for accounting, fraud prevention and legal obligations. Backup copies can remain until rotated or deleted. Contact us for details about a particular record or a deletion request; deletion does not automatically cancel orders or issue refunds.
Your rights and choices
You can request access to, correction of, or deletion of your personal information, and ask about portability, restriction or objections where applicable. You can withdraw optional communication consent without affecting earlier lawful processing. Use the profile's account deletion controls or email vividbeancafe@gmail.com. We may need to verify your identity before acting. You can complain to the UK Information Commissioner's Office at ico.org.uk.
Changes
We will update this page when our practices change and provide additional notice or obtain consent where required. Contact us before submitting information if you have questions about how it will be used.