Privacy policy

Effective: 20 July 2026  ·  Last updated: 20 July 2026

This policy explains how Not a Latte handles information when you use the Not a Latte mobile application, this website, or contact us. We have written it to describe the product as it works today. If the way the service handles data changes, we will update this page.

1. Who we are

Not a Latte is a UK-based independent mobile app for finding and rating flat whites. In this policy, “Not a Latte”, “we”, “us”, and “our” refer to the operator of the Not a Latte app and website.

Privacy questions can be sent to support@notalatte.uk.

2. Information we collect

Account and authentication information

If you create an account, we process your email address, user ID, optional display name, theme preference, account status, and authentication information. When you use Sign in with Apple or Google, we receive the identity information needed to sign you in. We may securely retain an encrypted provider token so that social sign-in access can be revoked if you delete your account. We do not receive your Apple or Google password.

Reviews and contributions

We process the content you choose to submit, including flat-white scores, optional profile scores, optional price, café submissions, suggested café corrections, locations you choose for café pins, addresses, opening hours, milk options, and roaster information. We also store moderation status and timestamps connected with those contributions.

Device location

The app asks for location permission only when you choose a location feature, such as centring the map on your position or placing a café pin near you. Your live device location is used for that map interaction and is not saved to your Not a Latte account. A café location that you deliberately submit is stored as part of that submission.

Support and technical information

If you contact us, we receive the information in your message and any details you choose to provide. Our hosting, authentication, map, email, and app-distribution providers may process standard technical records such as IP address, device or browser type, request time, and error information to operate, secure, and diagnose their services.

We do not sell personal information and the app does not use personal data for third-party advertising.

3. How and why we use information

• To create and secure your account, authenticate you, and keep you signed in.
• To show cafés, calculate rating summaries, display flat-white profiles, and provide search and map features.
• To receive, review, approve, merge, reject, or remove café information and community contributions.
• To enforce limits, detect spam or manipulation, restrict abusive accounts, and protect the service.
• To send account verification, sign-in, password-reset, security, and support messages.
• To respond to requests, investigate faults, and improve the reliability and usefulness of the app.
• To comply with legal obligations and establish, exercise, or defend legal claims where necessary.

Where UK data-protection law applies, we rely on performance of our contract with you when providing account features; our legitimate interests in operating, improving, and protecting the service; your consent for optional device permissions; and legal obligations where applicable. You can withdraw a device permission through your phone settings.

4. What becomes public

Café information, approved submissions, rating totals, flat-white profile averages, median prices, and roaster details may be visible to anyone using the service. Individual email addresses are not displayed publicly. The current version of the app presents aggregated café ratings rather than attaching your email address to a public review.

Once approved, factual café information can become part of the shared café directory. If you later delete your account, the account-linked submission record is deleted, but factual information that has already been accepted into the public directory may remain. Reviews tied to your account are deleted and café summaries are recalculated.

5. Service providers and disclosures

We use specialist providers to run the service. They process information for us under their own terms and privacy commitments:

• Supabase for authentication, database services, server functions, and account management.
• Resend to deliver transactional account emails.
• Apple and Google when you choose their sign-in services, and for platform map functionality where applicable.
• Expo / EAS for application building, delivery, and update infrastructure.
• Cloudflare for hosting, protecting, and delivering this website.

We may disclose information if required by law, to protect people or the service, or as part of a genuine reorganisation of the service. We do not allow providers to use Not a Latte account data for their own advertising.

Some providers may process information outside the UK. Where required, we rely on appropriate contractual or legal safeguards for international transfers.

6. How long we keep information

We generally keep account information and account-linked contributions while your account is active. Pending submissions and moderation records are kept while needed to review them, maintain service integrity, and resolve disputes. Support messages are kept only as long as reasonably necessary to answer the request and maintain an appropriate record.

When you delete your account, your authentication account, profile, reviews, café submissions, update requests, and stored social-authentication tokens are deleted from the live service. Social authorisation is revoked automatically where a valid revocation token is available; if automatic revocation is not possible, the app tells you which provider must be disconnected manually. Limited copies can remain briefly in provider backups or logs before their normal expiry.

7. Security

We use access controls, database row-level security, encrypted connections, restricted administrator functions, and encryption for retained social provider tokens. No online service can guarantee absolute security, but we work to use measures appropriate to the nature of the information we process.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the use of your personal information, and to receive a portable copy in certain circumstances. You may also complain to the UK Information Commissioner’s Office or your local data-protection authority.

• Edit your display name from Settings → My account.
• Update or delete your reviews from the café or My ratings.
• Turn location access off in your device settings.
• Delete your account in Settings → My account → Delete account.
• Use our account-deletion page if you no longer have access to the app.

We may need to verify that a request relates to you before acting on it.

9. Children

Not a Latte is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.

10. Changes to this policy

We may update this policy as the service develops or legal requirements change. The effective date at the top will show when the latest version applies. Material changes may also be highlighted in the app.

11. Contact