Parau Coffee

Privacy Policy

Who we are

Parau Coffee ("we", "us") runs the Parau Coffee membership programme and this website. We decide how your personal data is used, which makes us the data controller for it. Our place of business is Jl. Raya Medokan Sawah No.85, Medokan Ayu, Kec. Rungkut, Surabaya, Jawa Timur 60295, Indonesia.

This policy explains what we collect, why we hold it, who else sees it, how long we keep it, and what you can ask us to do about it. It sits alongside our Terms & Conditions and the membership rules on this site.

What we collect

What you give us when you join

  • Your name and email address. The email is what identifies your account
  • Your phone number, if you choose to add one. It is optional
  • Your date of birth, if you choose to add it. It is optional, and it is used only to send a birthday greeting. You can turn that off at any time
  • A profile photo, if you upload one

What we record as you use the programme

  • Your membership number, your points balance, and your full points history
  • The rewards you redeem, and when you redeemed them
  • Your tier, which is calculated from the points you have earned over time
  • Sessions and sign-ins, so you stay signed in and so we can recognise unusual activity

If you use the community section

  • The posts, comments, photos and replies you write, which are visible to other signed-in members
  • Direct messages you send, which are visible only to you and the member you sent them to
  • Reports and blocks, so that moderation works

Technical information

  • Session records, and a hashed version of your IP address for security. We never store the raw address
  • A short description of your browser, used to recognise your sessions
  • If you turn notifications on, a push subscription address issued by your browser

We use no advertising trackers, we do not build a marketing profile of you, and we collect nothing that is not listed here.

If you sign in with Google

You can create an account or sign in with your Google account instead of a password. If you do, this is what happens.

  • What we receive from Google: your name, your email address, your Google account identifier, and whether Google has verified that email address
  • What we ask Google for: only the three basic permissions needed for that — openid, email, and profile
  • What we never receive: your Google password, your Gmail, your Google Drive, your calendar, your contacts, or anything else in your Google account

We use that information for one purpose only: to create your Parau Coffee account, or to recognise the account you already have so that signing in reaches the right member. We do not use it for advertising, we do not sell it, and we do not hand it to anyone else. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

If your email address already has a Parau Coffee account, signing in with Google connects to that same account rather than creating a second one. We only do that when Google confirms the email address is verified.

You can disconnect Parau Coffee from your Google account at any time at myaccount.google.com/permissions. That stops future sign-ins with Google, but it does not close your Parau Coffee account — contact us for that.

If you add your member card to Google Wallet, your name, membership number and the static barcode are shared with Google to display the pass. Your points balance and your rotating code are never included.

Why we hold it

  • To run your membership: your card, your points, your tier, your rewards
  • So staff can recognise you at the counter and award or redeem points
  • To send the notifications you have asked for
  • To keep the community section working, moderation included
  • To keep accounts secure: spotting sign-in attempts, reused sessions, and points fraud
  • To meet our own accounting and legal obligations

Consent and your choices

We rely on your consent, given when you register, to hold and use your data for the purposes above. You can withdraw that consent at any time by asking us to close your account. Withdrawing it does not affect anything we did before you withdrew it.

You do not have to give us a phone number, a date of birth, or a photo, and the membership works without any of them.

Who else can see it

We never sell your personal data, and we never share it for advertising.

We use a small number of service providers who process data on our behalf:

  • Cloudflare hosts our servers, database and media, and processes requests to the site
  • Vercel hosts this website
  • Google handles Google sign-in, and Google Wallet if you use it
  • Your browser maker applies push, if you turn notifications on

Inside our own team: staff can look up a member by name or membership number and can see a masked email address. Only owners and administrators can see full member records, and every privileged action is written to an audit log.

Community and the homepage. Other members can see your display name, photo, posts and comments. To recognise our top friends, your name, photo and monthly points total may also appear on the public homepage. You can turn that off at any time on your profile page, and turning it off removes you from it.

Transfers outside Indonesia

Cloudflare, Vercel and Google process data in data centres outside Indonesia, including in the United States and the Asia-Pacific region. Where data leaves Indonesia we rely on those providers' contractual protections and on the consent you give when you register.

How long we keep it

  • Sessions are deleted 30 days after they expire
  • Read notifications are deleted after 90 days. Unread ones are kept until you read them
  • Audit records of privileged actions are kept for 24 months
  • Points history is kept as a financial record, because it is the evidence of what you earned and spent. If you close your account, that history is kept with your personal details stripped out
  • Community content is removed when you delete it, or when you close your account

How we protect it

  • Your password never reaches our servers in a readable form. Your own browser turns it into a key before it is sent, and we store only a one-way result that cannot be reversed
  • Member codes rotate every minute, so a screenshot of someone's card is worthless shortly afterwards
  • Session cookies are marked httpOnly, so a script injected into a page cannot read them
  • We store a hashed version of your IP address, never the raw one
  • Access to member records is limited by role, and privileged actions are recorded

No system is perfectly secure, but we do not keep data we do not need, and that is the most effective protection there is.

What you can ask us to do

Under Indonesian law (UU PDP No. 27/2022) you can:

  • Ask what personal data we hold about you, and request a copy
  • Ask us to correct anything that is wrong
  • Ask us to delete your account and your personal data
  • Withdraw your consent, or object to one particular use
  • Ask us to stop sending you notifications

To make any of those requests, contact us through the contact page on this website, or come to the shop. We will respond as soon as we reasonably can. We may need to confirm who you are first, so that we do not hand your data to someone else.

If you think we have handled your data badly, you can tell us first — we would rather fix it — and you also have the right to complain to the Indonesian data protection authority.

Children

This programme is not intended for children under 13, and we do not knowingly collect their data. If you are under 17, please make sure a parent or guardian is happy for you to join. If we learn that a child under 13 has registered, we will delete the account.

Changes to this policy

If we change how we handle your data, we will update this page and change the date below. If the change matters, we will tell you in the app. Continuing to use the programme after a change means you accept the updated policy.

Last updated: 9 October 2026.

Contact

Parau Coffee — Jl. Raya Medokan Sawah No.85, Medokan Ayu, Kec. Rungkut, Surabaya, Jawa Timur 60295.

The quickest way to reach us about your data is the contact form on this website. You can also ask any of our staff at the counter, and they will pass it to the owner.