01Who handles your data
404 Route Coffee operates 404route.online and 404 Route Club. We decide how information is used to run our website, membership and rewards. This notice covers those services and information you send to us about them.
For privacy questions or requests, use Privacy & data requests in your customer portal. Delivery platforms have their own notices for the information they collect.
02What we collect
Your account
Name, email address, account identifier, optional favorite drink, account dates and stamp balance. Your name and email are needed for membership; your favorite drink is optional.
Your coffee & rewards
Customer names entered by our team for order tracking, optional links to an existing Club member, and name-only sales contacts with their transaction histories; QR identifiers and activation/collection status; drinks, quantities and saved menu prices recorded by our team; delivery platform and order reference where entered; stamp history, reward codes, milestones, redemption status and dates.
Your feedback
The rating, optional comment and drink you submit, linked to your account and a collected paid order. We also record whether your one-time feedback stamp has been awarded.
Sign-in & technical information
Email verification and session records. Our hosting, account and email providers process technical information such as IP address, browser/device information, request times, errors, sign-in activity and email delivery events.
Messages to us
Your contact details and information in support or order-related messages; the type, details, status, director response and dates of privacy requests submitted through your portal.
The website does not ask for payment-card details, identity documents, delivery addresses or phone numbers. GoFood/GrabFood collect payment and delivery information in their own apps; information received by the shop to fulfil an order is handled through those services. Please do not put sensitive personal information in feedback or order references.
03Why we use it
- Create and verify your account, send requested sign-in links and keep you signed in.
- Link a paid order to your card, calculate stamps, issue free-cup codes and verify redemption.
- Record sales, answer questions and correct order or stamp errors.
- Read feedback, improve our coffee and award the one-time feedback bonus. Any rating qualifies.
- Prevent duplicate claims and misuse, investigate faults, secure the service and meet legal obligations.
Account and reward processing is necessary to provide the membership service you request. Optional feedback and favorite-drink details are used when you choose to provide them. We also process information where required by law and for proportionate security and fraud-prevention purposes. Where consent is required, it must be specific to the relevant processing and can be withdrawn.
A name-only sales contact is not a Club login. Recording a name does not enroll you in membership, award stamps or add you to marketing. Directors can record a transaction even when its QR is not scanned. If you have no Club account, use the account-access contact described below for privacy help.
We do not sell personal information, use it for advertising audiences or add you to a marketing list just because you join. Authentication emails are service messages. We do not publish your name or feedback as a testimonial without separate permission.
04Who can access it
Signed-in customers can access their own profile, card, rewards and activity. Approved 404 Route directors can access customer records, feedback and reward controls to operate the program. Customers cannot browse other members.
Our team can export customer and sales records for business administration. Those copies need the same limited access and care as the online records. Relevant service providers process information to supply their services:
- Supabase: account authentication, database storage and access controls. Supabase privacy information.
- Resend: delivery of sign-in and other authentication emails, including recipient address, message content and delivery events. Resend privacy information.
- Vercel: website hosting, delivery, reliability and security logs. Vercel privacy information.
We may disclose information when legally required or necessary to investigate abuse or protect legal rights, limited to what is relevant. When you put a reward code in delivery-app order notes, that platform and our fulfilment team receive the code. We do not automatically send your Club profile to a delivery app just because you open its link.
05Storage & security
Membership data is stored in our Supabase project. The website is delivered by Vercel and authentication emails are sent through Resend. Their infrastructure and support operations may process information outside Indonesia. International processing must be handled with the protections required by applicable law; contact us for information about our arrangements.
We use HTTPS, verified email sign-in and account-based database permissions. Director functions require an approved director account. These measures reduce risk, but no internet service can guarantee complete security. Keep sign-in links, QR claim links and unused reward codes private, and sign out on shared devices.
If a personal-data incident occurs, we will investigate, take appropriate steps and notify affected people and authorities when required by applicable law.
06How long we keep it
We keep account details and linked stamp, reward and feedback history while needed to maintain your membership, balances and redemptions. The current service has no automatic deletion timer for inactive accounts. Signing out or clearing browser data does not delete your server-side account.
You can request account closure and deletion using Privacy & data requests in your customer portal. We handle requests manually after proportionate identity checks. We delete or anonymise information that is no longer needed, subject to applicable legal requirements. Some transaction, dispute or security records may need to be retained for a specific lawful purpose; we will explain any relevant restriction in our response rather than keeping an account indefinitely for unrelated use.
Provider logs, email records, backups and any business exports have separate lifecycles. Deletion from an active database does not necessarily remove every provider backup immediately. Providers' retention arrangements apply to those copies; for example, Resend currently describes a 30-day email/log retention period on its standard plans in its security information. Contact us for the retention details relevant to a request.
07Browser storage & cookies
Route Club uses essential browser local storage to keep your authentication session across visits. Preview pages, if opened, keep sample records separately in that browser. Clearing site storage removes those local copies and can sign you out; it does not erase your membership records.
We have not added advertising pixels or a separate visitor-analytics tracker to this website. Hosting and authentication providers still process the technical information described above to deliver and protect the service. External delivery and social-media websites use their own cookies and policies.
08Your choices & requests
You can browse the coffee website without a Club account, leave the favorite-drink field empty and choose not to leave feedback. You can edit your name and favorite drink in My profile. In Privacy & data, you can download your Club records and submit access, correction, deletion or other privacy requests. Requests and replies are private to you and approved directors; updates appear in the portal rather than by email. Submitting a deletion request does not instantly delete the account.
Under applicable Indonesian personal-data law, you may request access or a copy, correction, deletion, an end to processing, withdrawal of consent, restriction, or other rights that apply to your situation. You may also raise a complaint with us or the competent authority and pursue available legal remedies.
Open Privacy & data requests in your customer portal and sign in with your registered email to submit a request and follow its response. If you cannot access your account, contact @404.route privately for help verifying ownership. We may ask for information reasonably necessary to verify ownership; never send a password, sign-in link or reward code as identity proof. We will respond and act within the time limits that apply to your request and explain any lawful limitation. Deleting membership data may affect access to linked stamps and rewards; ask us about these before closure if needed.
09Children’s information
Route Club is not designed to collect children’s information. A parent or guardian should contact us before a child’s personal data is submitted. We will handle such information only where permitted by law, including any required parental consent. Contact us if a child’s details have been entered without the necessary permission.
10Updates & contact
We will update this page when our service or data practices change and show the updated date. Significant changes will be brought to members' attention through an appropriate service notice; a changed notice is not blanket consent for a new purpose.
For help: Privacy & data requests in your customer portal. For membership and reward rules, read the Terms of Use.