Harvest n Go Ltd, 5 Minories, London EC3N 1BJ. Last updated 23 October 2026.

This explains what we collect when you use the Harvest & Go app or order from this website, why we collect it, and what you can do about it. We are the data controller. If you want to ask us anything about it, email folabi@cococure.com.

What we collect

When you create an account

Your email address, and your first and last name if you give them. A phone number and date of birth are optional — the date of birth exists so we can give you a drink on your birthday, and nothing else. We generate a member code for you, which is what the barista scans.

When you sign in

We sign you in with a six-digit code sent to your email, or with Sign in with Apple or Google. We never ask for or store a password. If you use Sign in with Apple and choose to hide your email, we only ever see the relay address Apple gives us. From Google we receive your email address and name only.

When you order

What you ordered, when, which shop, what you paid, and whether you collected it. If you save a favourite or a usual, we store what is in it.

Payments

Card payments are handled by Stripe. Your card number never reaches us and we never store it. We keep a payment reference so we can match a payment to an order and give you a refund if something goes wrong. Stripe is a separate controller for its own purposes; see stripe.com/gb/privacy.

Loyalty, challenges and credit

Your points balance and how you earned it, rewards issued and spent, challenge progress and medals, any prepaid bundle or gift card balance and its transaction history, and any promo code you have used.

Location

Only if you allow it, and only while the app is open, so we can show the nearest shop and a realistic collection time. We do not track you in the background and we do not store a history of where you have been. You can refuse and the app still works; you just pick your shop from a list.

Notifications and devices

If you turn on notifications we store a push token for your device so we can tell you an order is ready. We keep a record of devices signed in to your account so you can sign them out. If you add your card to Apple Wallet, we store the registration Apple needs to keep that pass up to date.

Technical

Our servers keep standard access logs, including IP address, for security and fault-finding. We do not use advertising trackers in the app.

Why we are allowed to use it

• To perform our contract with you — taking and fulfilling your order, running your account, operating the loyalty scheme and any subscription you take out.
• Our legitimate interests — keeping the service secure, preventing fraud and abuse of offers, and understanding which drinks sell so we can run the shop. We balance this against your interests and keep it to what is needed.
• Your consent — marketing emails or messages, push notifications, and access to your location. You can withdraw any of these at any time without affecting anything else.
• Legal obligation — we must keep transaction records for tax purposes.

Who else sees it

We do not sell your data and we do not share it for anyone else’s marketing. We use these processors, who act on our instructions:

• Stripe — payments.
• Amazon Web Services — sending our emails.
• Apple and Google — delivering push notifications to your device, and sign-in if you choose it.
• Our hosting provider — running the servers this site and app sit on.

Some of these operate outside the UK. Where they do, transfers are covered by the UK International Data Transfer Addendum or an adequacy decision.

How long we keep it

Your account and its history stay while your account is open. Transaction records are kept for six years after the end of the tax year they fall in, because HMRC requires it. Access logs are kept for 90 days. One-time sign-in codes expire within minutes.

When you delete your account we delete your saved orders, favourites, points, rewards, challenge progress, any stored credit, your devices and your notification tokens, and we strip your name, email, phone and date of birth from the account record. We keep a blank record of the member code itself so that code is never issued to somebody else.

What you can do

You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to object to or restrict how we use it, to withdraw consent, and to receive it in a portable form. To exercise any of these, email folabi@cococure.com and we will respond within one month.

You can delete your account yourself, in the app, under Account then Delete account. It takes effect immediately. If you have an active subscription, cancel it first so billing stops cleanly.

You can turn off marketing, push notifications and location access at any time — marketing and push in the app under Notifications, location in your phone’s own settings.

Children

The app is not aimed at children under 13 and we do not knowingly create accounts for them.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes

If we change this policy we will update the date at the top, and tell you in the app if the change is significant.