Privacy Policy

This Privacy Policy explains what personal data Chup (operated by everBetter Innovations, everbetter.site — "we", "us", "our") collects, how we use and protect it, and the rights you have. everBetter Innovations is an "organisation" for the purposes of the Personal Data Protection Order, 2025 of Brunei Darussalam (the "PDPO"), and we handle your personal data in line with it. By using Chup you agree to this policy.

Our role & who is responsible

Chup is a loyalty platform. We decide how the personal data you give to Chup is handled, and we are accountable for it. The cafés and businesses ("vendors") you choose to join run their own loyalty programs and are separately responsible for how they handle your data at their premises and in their own systems — see the Terms & Conditions.

Legal basis for using your data

• Consent. When you create your account you agree to this policy, which is your consent to us collecting, using, and disclosing your personal data for the purposes described here.
• Deemed consent. Where you take an action that reasonably requires us to process your data — for example, joining a café or showing your member code to collect a stamp — you are taken to consent to the processing needed to do that.
• Without consent where the PDPO allows. In limited cases the PDPO permits collection, use, or disclosure without consent (for example, to respond to an emergency, to comply with the law, or for investigations). We rely on these only where they apply.

Information we collect

• From your Google sign-in: your name and email address. We use Google to sign you in — we never see or store your Google password.
• Your Chup activity: the cafés you join, your loyalty cards, stamps, rewards, your member code, and related activity.
• If you run a café: your café's name, logo, location, and loyalty-program settings.
• Technical data: basic device/browser information and log data, plus an essential session cookie that keeps you signed in.

How we use your information

We use your personal data only for purposes a reasonable person would consider appropriate, and only for the purposes we've told you about:

• To run your Café Passport — record stamps, rewards, and the cafés you join;
• To show your membership and stamp activity to the cafés you choose to join, so they can stamp your card and give your rewards;
• To send you emails (see below);
• To keep Chup secure, prevent fraud, and improve the service;
• To meet our legal and regulatory obligations.

If we ever want to use your data for a new purpose that isn't compatible with the above, we'll ask for your consent first.

Who we share it with

• Cafés you join: a café can see your membership and the stamps/rewards activity at their café. They don't see your activity at other cafés.
• Service providers (data processors): trusted providers who host our app, store files, and deliver our emails, acting on our instructions and bound to protect your data.
• Legal & safety: where required or permitted by law, or to protect rights, property, and safety.

We do not sell your personal data.

Emails & direct marketing

We send essential emails about your account, rewards, and café status. With your consent we may also send optional updates, such as our weekly recap. (New cafés joining are shared via optional push notifications, not email.) You can withdraw consent and unsubscribe from optional emails at any time using the link in those emails or in your profile — essential emails will still be sent.

Keeping your data accurate

We take reasonable steps to keep your personal data accurate and complete for the way we use it. You can view and update your name in your profile, and ask us to correct anything that's wrong.

Protecting your data

We use reasonable technical and organisational measures to protect your personal data against unauthorised access, use, disclosure, loss, or misuse — including signing you in through Google so we never handle your password. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep your data safe.

How long we keep it

We keep your personal data only for as long as your account is active or as needed to provide the service, and we stop retaining it when it's no longer needed for any purpose and we're not required to keep it by law. When you delete your account we remove your personal data, except records we must keep to meet legal requirements or resolve disputes.

Data breaches

If a data breach affecting your personal data occurs, we will assess it and, where it is a notifiable breach under the PDPO, notify the Authority and affected individuals as required by law.

Transfers outside Brunei Darussalam

Some of our service providers may store or process data on servers outside Brunei Darussalam. Where they do, we take steps so that your personal data continues to receive a standard of protection comparable to that under the PDPO.

Your rights

Under the PDPO you may, subject to the exceptions the law allows:

• Access the personal data we hold about you, and information on how it has been used or disclosed;
• Correct personal data that is inaccurate or incomplete;
• Withdraw consent to our use of your data (this may mean we can no longer provide parts of the service);
• Delete your account and associated personal data.

To exercise any of these, contact us using the details below. We may need to verify your identity, and a reasonable fee may apply to an access request as permitted by the PDPO.

Data Protection Officer

We have appointed a Data Protection Officer responsible for overseeing our compliance with the PDPO. You can reach them at [email protected].

Complaints

If you have a concern about how we handle your personal data, please contact our Data Protection Officer first so we can try to resolve it. You also have the right to lodge a complaint with the Authority responsible for personal data protection in Brunei Darussalam (the Authority for Info-communications Technology Industry of Brunei Darussalam, AITI).

Children

Chup isn't intended for children under the age required to hold a Google account in their country. We don't knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. We'll update the date above and, for material changes, notify you in the app or by email.

Contact

Questions or requests about your privacy? Email us at [email protected].