Privacy Policy

Who is responsible

HubsteriaBrew is operated by CareSiteBuilder LLC. For data about your own staff, customers and sales, your business is the owner of that information and CareSiteBuilder LLC handles it on your instructions as your service provider.

You can reach us about anything on this page at admin@hubsteriabrew.com.

What we record

• Account details: name, email address, the café or business you belong to, and your role.
• Sign-in records: the time of sign-in, password reset requests, and invitation acceptances.
• Café operations: products, prices, orders, payments, cash counts, shifts, expenses, stock and loyalty entries you or your staff enter.
• Customer records you choose to keep: a name, a contact reference and loyalty balance — only what your staff type in.
• Activity records: who changed a price, approved a discount, opened a drawer or corrected a sale, with the reason given.
• Technical records: browser type, screen size, page load speed samples and error reports, used to keep the app fast and fix faults.

Why we record it

• To run the service you signed up for: taking orders, accounting for money, and showing reports.
• To keep money trustworthy: every posted sale, payment and correction is kept permanently so the numbers can always be explained.
• To keep accounts secure: detecting unusual access, and proving who approved sensitive actions.
• To support you: when you ask for help, an authorised person may be granted temporary, recorded access to your café.
• To send service messages: invitations, password resets, and important notices about your account.

What we never do

• We do not sell your data, your staff's data, or your customers' data.
• We do not use your café's sales data to advertise to you or anyone else.
• We do not store full card numbers. Card payments are handled by your chosen payment provider; we keep only a reference and the amount.
• We do not store passwords or payment provider secret keys in plain text.

Who else can see it

Your data is visible to people you invite into your business, limited by the role you give them. Platform staff can only see it for support, for a limited time, and every such session is recorded.

• Supabase — database, sign-in and file storage.
• Your payment provider — card and wallet payments you choose to enable.
• Resend — sending invitation, reset and notification email.
• Our hosting provider — serving the app and measuring page speed.

How long we keep it

Financial records — sales, payments, refunds, cash movements and the activity trail — are kept for as long as your account exists and for at least the period your local tax rules require, because they can never be silently deleted or edited.

Account and staff records are kept while the person is active and then archived. Speed and error samples are kept for a short diagnostic window and then removed.

Your choices

Send any of these requests to admin@hubsteriabrew.com and we will answer within 30 days. Mailing address: CareSiteBuilder LLC, 116 Francesca Ct, Palm Desert, CA 92211, USA.

• Ask for a copy of what we hold about you.
• Correct your own name and contact details from your profile.
• Ask us to remove a customer record you entered by mistake.
• Withdraw a staff member's access at any time, which stops all further access immediately.
• Ask us to close your business account — we will confirm what must be retained for financial and legal reasons before anything is removed.

Philippine Data Privacy Act (Republic Act No. 10173)

We process personal information in line with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

Data Protection Officer: Joseph Felipe, reachable at admin@hubsteriabrew.com (subject line "DPO") or by post at CareSiteBuilder LLC, 116 Francesca Ct, Palm Desert, CA 92211, USA. Your business remains the personal information controller for its own staff and customer data; CareSiteBuilder LLC acts as its personal information processor.

• Your rights as a data subject: to be informed, to access, to object, to erasure or blocking, to damages, to file a complaint, to rectification, and to data portability.
• Cross-border transfer: our service providers may store or process data outside the Philippines (for example in Singapore or the United States). We only use providers bound by written agreements that require comparable protection.
• Personal data breach: if a breach is likely to cause serious harm, we will notify the affected business, and where required the NPC and affected people, within 72 hours of knowing about it.
• Customer deletion: an owner or manager can ask us to anonymise a customer record — the name and contact are removed while the related sales stay in the financial record without identifying the person.
• Complaints: if you are not satisfied with our answer, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

Children

HubsteriaBrew is a business tool and is not intended for anyone under 16. We do not knowingly collect information from children.

Changes to this policy

If we change how we handle information in a way that affects you, we will update the date at the top of this page and notify account owners by email before the change takes effect.