Privacy Policy

We collect information in three ways: you give it to us, it is generated when you use the Services, or a partner we work with passes it along.

Information you give us

• Account details. Your name and email address when you create an account, sign in with Apple or Google, or update your profile. If you use Apple’s Hide My Email, we receive the relay address Apple provides.
• Orders and shipping. The items you buy, the shipping address and phone number you enter, and gift or delivery notes.
• Event registrations. Your name, email, and party size when you book a class, cupping, or tasting.
• Reviews and messages. The display name and text you submit in a product review, and anything you send us by email.
• Café credits and tips. The amount you add to your Ando balance or tip at the counter. Payment details go directly to Stripe (see below); we never see or store your full card number.

Information generated when you use the Services

• Order and balance history. Purchases, credit top-ups, redemptions, and refunds tied to your account.
• Session and device data. A signed session cookie so you stay logged in, plus the technical basics any server records: IP address, browser or app version, device type, and the pages or screens you request.
• Café visits (app only, opt-in). If you turn on café visit tracking in the app, your device checks whether you are physically at our Kailua storefront and records one visit per day. Location is evaluated on your device; we do not collect continuous GPS data or keep a history of your coordinates. You can turn this off at any time in the app’s garden settings or in iOS Settings.
• Garden progress (app only). The flowers, trees, and visit count in your Ando garden are stored on your device. Growth earned from purchases is linked to your account so it can follow you between devices.

Information from partners

• Payment confirmations from Stripe: whether a payment succeeded, the last four digits and brand of the card, and the wallet used (such as Apple Pay).
• Sign-in confirmations from Apple or Google: a verified identifier, your name as they provide it, and your email address.
• Tracking updates from our shipping carriers once a parcel is on its way.

We use your information to:

• Take, prepare, pack, ship, and deliver your orders, and let you know when they are ready or on the way.
• Run your account, café credit balance, and event bookings, and keep your session signed in.
• Process payments, tips, and refunds, and detect and prevent fraud.
• Answer your questions and resolve problems with an order.
• Publish reviews you choose to submit, after a member of our team has approved them.
• Grow your Ando garden and, if you opt in, count your café visits.
• Send transactional email such as receipts, shipping updates, and event confirmations.
• Understand how the Services are used in aggregate so we can fix what is broken and improve what is not.
• Meet our legal, tax, and accounting obligations.

We do not sell your personal information, and we do not use it for third-party advertising. We will only send you marketing email if you ask for it, and every such message includes a way to unsubscribe.

We share information only with the companies that help us run the Services, and only what they need to do their part:

• Stripe processes every card, wallet, and bank payment, including café credit top-ups, tips, and in-store card readers. Stripe’s handling of your data is governed by its own privacy policy.
• Apple and Google provide sign-in when you choose to use them, and Apple provides Apple Pay and App Store distribution.
• Shipping carriers and label providers (such as USPS, UPS, FedEx, and the label services we use to print postage) receive your name, address, and phone number so parcels can be delivered.
• Infrastructure providers that host our database, application, and transactional email. They store data on our behalf and are not permitted to use it for their own purposes.
• Our staff, who see the order and account details needed to serve you. Staff access is role-based and logged.

We may also disclose information when the law requires it, to protect the rights and safety of our customers, staff, or business, or as part of a sale or reorganization of the business, in which case this policy continues to apply.

Our website uses a small number of first-party cookies and browser storage that are strictly necessary: keeping you signed in, remembering your cart, and protecting forms against abuse. We do not use advertising cookies or third-party tracking pixels.

Stripe sets its own cookies during checkout to detect fraud. You can block or clear cookies in your browser settings, but you will need to sign in again and the cart may not persist between visits.

The Ando app for iPhone and iPad asks for permissions only when a feature needs them, and every one of them is optional:

• Location — used only to confirm café visits if you turn that feature on. It is never used for advertising and no coordinate history is kept.
• Notifications — if you allow them, we send order-ready alerts, garden updates, and event reminders. You can turn them off in iOS Settings.
• Motion — the garden scene can respond gently to how you hold your device. Motion data stays on the device.
• Sign in with Apple — stores your session securely in the device Keychain so you do not have to sign in every time.

Café staff who use the app’s staff tools are covered by our employee privacy notice in addition to this policy.

We keep information for as long as you have an account with us or as long as we need it for the purpose it was collected, then delete or anonymize it. In practice:

• Order, payment, and tax records are kept for seven years to meet accounting and tax requirements.
• Account and profile details are kept until you delete your account.
• Event registrations are kept for one year after the event.
• Published reviews remain until you ask us to remove them.
• Server logs are kept for up to 90 days.

You are in control of your information. You can:

• Access and update your name, email, and saved addresses from your account page or in the app.
• Delete your account. Email us at hello@andocafes.com from the address on the account, or use the delete option in the app’s account screen. We will remove your profile and personal details within 30 days, keeping only the transaction records the law requires us to hold.
• Turn off location or notifications at any time in the app or in iOS Settings.
• Unsubscribe from any marketing email using the link in the message.
• Ask for a copy of the personal information we hold about you, ask us to correct it, or object to how we use it.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or Canada’s PIPEDA. We honor those rights for everyone, regardless of location. We do not sell or share personal information for cross-context behavioral advertising, and we will never discriminate against you for exercising your rights. To make a request, email hello@andocafes.com. We may need to verify your identity before acting on it.

We protect your information with encryption in transit, encrypted storage, row-level access controls in our database, and role-based permissions for staff. Payment card data never touches our servers. No system is perfectly secure, so if you believe your account has been compromised, contact us right away and we will help.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with information, email us and we will delete it. You must be 21 or older to buy or be served alcohol at the café.

We are based in Hawaiʻi and our systems run on servers in the United States. If you order from outside the US, including Canada, your information will be transferred to and processed in the US under this policy.

When we change this policy we will update the date at the top of the page. If the change is significant, we will also let you know by email or with a notice on the website or in the app before it takes effect.

Ando Craft Matcha & Coffee
143 Hekili St #120, Kailua, HI 96734, United States
hello@andocafes.com