Privacy Policy

Last updated: 16 April 2026

Sister Barista ("we", "us", "our") operates the Sister Barista loyalty rewards app. This policy explains how we collect, use, and protect your personal information when you use our service.

Who we are

Sister Barista is a coffee shop based in Cheshire, England. We are the data controller for your personal information under UK data protection law (UK GDPR). The app is developed and maintained on our behalf by Third Harmonic Ltd.

What we collect

When you use our loyalty app, we collect:

• Your name (first name and surname)
• Your email address (if you create an account or are invited to claim one)
• A record of your loyalty stamps and rewards (dates and number of stamps)
• Whether you used your own cup (for bonus stamps)

We do not collect payment information, location data, or any other personal information beyond what is listed above.

Why we collect it

We process your personal information to run our loyalty rewards scheme. Our lawful basis for this is legitimate interest — we have a genuine business need to operate a loyalty programme, and you have a reasonable expectation that we'll keep track of your stamps and rewards when you participate.

For email communications (such as account invitations and password resets), our lawful basis is your consent, given when you provide your email address.

How we store it

Your data is stored securely using Supabase, a cloud database service hosted in the European Union. Your password is never stored in plain text — it is securely hashed by Supabase's authentication system. Access to the database is restricted and protected by row-level security policies.

Who can see your data

Your name and stamp card progress are visible to Sister Barista staff through the app, so they can add stamps and manage rewards. Your email address is visible to staff if you have claimed your account.

We do not sell, share, or disclose your personal information to any third parties, except:

• Supabase (database hosting, EU-based)
• Resend (email delivery for account invitations and password resets)
• Vercel (app hosting)

These services process data on our behalf and are bound by their own privacy policies and data processing agreements.

How long we keep it

We keep your data for as long as you are an active member of our loyalty scheme. If you haven't visited in over 24 months, we may delete your account and associated data. You can request deletion at any time (see your rights below).

Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Have your data corrected if it's inaccurate
• Have your data deleted ("right to be forgotten")
• Object to our processing of your data
• Request a copy of your data in a portable format

To exercise any of these rights, speak to a member of staff in the shop or email us at the address below.

Cookies and tracking

This app does not use cookies for tracking or advertising. The only data stored in your browser is your login session, which is necessary for the app to function.

Children

Our loyalty scheme is not intended for children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. Any changes will be reflected on this page with an updated date.

Contact us

If you have questions about this privacy policy or your personal data, you can contact us at:

Sister Barista
Email: sisterbaristacheshire@gmail.com

If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.