Winfield Order Privacy Policy

Who we are

The Winfield app is operated by Winfield Street Coffee (Winfield Street Food Concepts LLC) for the Winfield Street Coffee stores in Stamford, Rye, Naples North and Naples South. CGRabbit builds and hosts the app for Winfield Street Coffee as its software provider and processes data only on Winfield's instructions.

What we collect

Account: your name and email address, which you use to sign in; an optional phone number, which you may verify separately in the app; your birthday month and day if you provide them (never the year); and the store you select for an order.

Orders and rewards: what you order, where and when; your Winfield Dollars balance and its history; store credit; vouchers issued to you and their use; the customer groups you belong to and who approved them; and the consent choices you make.

Payments: card payments are handled by our payment processor. We receive a confirmation and the last digits of the card, never the full card number.

Sign-ins and phone verification: the channel and time of each sign-in, which uses email, and the phone-verification requests you make by text. One-time codes are stored as hashes, not readable codes. The app does not ask for your location, contacts, camera, photos or microphone.

App notifications: if you choose to enable push notifications, the app stores your device's push token and your consent choice so Expo's push-notification service can deliver messages. You can withdraw that consent in the app; removing a device stops future delivery to that registration.

Members who joined on TapMango: Winfield's final transfer from TapMango is planned after Winfield Order is published and launch checks are complete. Until that transfer is finished and reconciled, TapMango points, store credit, vouchers and group records have not necessarily been added to this app. Your marketing choices will require consent in Winfield Order and are not treated as consent merely because they existed in TapMango.

How we use it

To create and secure your account and send sign-in codes; to take, prepare and deliver your orders; to earn, hold and redeem Winfield Dollars, credit and vouchers; to answer your support requests; to prevent fraud and abuse of the rewards program; to keep the records the law and our accounting require; and, only if you opt in, to send you offers by email, text or app notification.

Text messages (SMS)

Sign-in codes are sent to your email. If you request phone verification, we send a one-time code by text to the phone number you provide. These are transactional messages, not SMS sign-in or marketing messages. Marketing texts, if offered, require separate consent. Reply STOP to any marketing message to stop, or HELP for help. Message frequency varies; message and data rates may apply. Your number is never sold or shared for marketing.

Sharing

We share data only with the providers that run the service for us: our payment processor for card payments, our email provider for sign-in codes, our text provider for phone-verification codes and any consented messages, and the push-notification service for notifications you enable. CGRabbit acts as our software provider. Each receives only what it needs for its task. Store staff see your name, phone when provided, balances and orders when they serve you. We do not sell personal data, and we do not share it with advertisers.

Storage and security

Your data is stored on servers operated for Winfield Street Coffee in the United States, encrypted in transit, with access limited to the people who need it. The app signs you in with one-time codes sent to your email and stores no password. Rewards changes made by staff carry the name of the person who made them and a reason.

Your choices and rights

You can verify your phone separately, manage any consent controls shown in the app, and ask us what we hold about you. You can request account deletion in the app (Account, Close account) or on the web at /app-delete-account. We process deletion requests within 30 days: your name, phone number, email and birthday are removed or anonymized, and any remaining Winfield Dollars, credit and vouchers are forfeited. Order and rewards records are kept for as long as tax and accounting rules require, no longer linked to a name, phone or email in your account. Catering invoices and tax exemption documents keep the details they were issued with.

Retention

We keep your account for as long as it is open. Order and rewards records are kept for the period required by tax and accounting law. One-time codes expire after ten minutes; challenge records retain a hash rather than the readable code under the account security controls. After a deletion we keep: order and rewards records, no longer linked to a name, phone or email in your account; catering invoices and tax exemption documents as they were issued; the messages you exchanged with support, as written; and your phone number on the list of numbers that already received the welcome voucher, so it is granted once.

Children

The app is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes

If this policy changes in a way that matters to you, we will show the new version in the app and update the date above before it takes effect.

Contact

Questions and requests: catering@winfieldcoffee.com, or ask at any Winfield Street Coffee store. Support page: /app-support.