Privacy Policy

This policy explains what [Company legal name] (“Cupmargin”) keeps about you, why, and what you can do about it. Cupmargin is the data controller.

What we keep

• Your account: name, email address, and when you joined. If you use Google, the link to your Google account.
• Your password as a bcrypt hash, never as typed. If you turn on two-step login, its secret (encrypted) and your recovery codes (as hashes).
• The figures you enter: costs, staff, prices, sales, and your currency and country choices.
• Short-lived security data: counts of log-in attempts per IP address and email address, kept for 15 minutes to an hour.

What we use it for

Only to run Cupmargin for you: to log you in, keep your figures, and send account emails (confirming your address, resetting a password, security notices). We don't sell your data, show ads, or share it with anyone except the providers below.

Your location

To pick your currency, Cupmargin looks up the country (and city) of your IP address through our hosting provider when you open the calculator. It isn't stored; only the currency and any country you choose by hand are kept with your figures.

If you click "Find my area", your browser asks your permission and then gives Cupmargin your position. Cupmargin rounds it to about 100 metres and sends it from your browser to OpenStreetMap, which also sees your IP address, to get the names of your country, town and neighbourhood. Only those names are kept with your figures, never the position. You can type your area instead, and then nothing goes to OpenStreetMap. "Remove it" or picking a country removes the names.

Who processes it

• Netlify (hosting)
• MongoDB Atlas (database, encrypted at rest)
• Google, only if you sign in with Google
• OpenStreetMap Foundation, only if you click "Find my area"
• [Email provider] (account emails)

How long

As long as you have an account. Deleting your account deletes it and every figure in it straight away.

Your rights

You can see, correct, export (Export month includes your full history) and delete your data at any time. For anything else, or to complain, contact us at [contact email address]. You can also complain to [data protection authority].