Privacy Policy
Last updated: September 13, 2026
EcoSip operates a reusable coffee-cup deposit-return network for consumers and café partners. This policy explains what we collect, why we collect it, and the choices you have. It covers the marketing site, the consumer app, and the business dashboard.
Who we are
EcoSip is the controller of personal data collected through ecosip.io and related apps. Questions about this policy can be answered first by the assistant on our contact page, or emailed to privacy@ecosip.io.
Information we collect
- Account data. Name, email, password hash, and (for businesses) company name, locations, and team invites.
- Cup and deposit activity. Cup registrations, refills, returns, and deposit balances so we can operate the network and show you your history.
- Location context. The café or station where a scan, refill, or return happens — not continuous GPS tracking.
- Payments. Checkout is processed by Stripe. We store Stripe customer and subscription IDs, not full card numbers.
- Support conversations. Messages you send to the contact assistant or a human follow-up form, so we can answer you and improve self-serve help.
- Device and log data. IP address, browser type, and basic diagnostics needed to keep the service secure.
How we use it
- Create and authenticate your account
- Run deposits, refills, returns, rewards, and business billing
- Show a café the activity that happened at its own locations
- Send transactional email (receipts, invites, password resets)
- Detect fraud, abuse, and service outages
- Answer support questions — first through self-serve help, then a person if needed
We do not sell personal information.
Fraud and abuse
EcoSip staff use the EcoSip Ops console to investigate suspected fraud and network abuse. That work is limited to the categories above: account identifiers, cup and deposit events, the café or station where a scan happened, Stripe customer/subscription IDs (never full card numbers), and basic request diagnostics. Typical signals include duplicate deposit refunds, a cup appearing at two places too quickly to be real, refunds that do not match an issued deposit, lost-cup patterns, and payment reversals. An automated investigator (Grok, with a deterministic playbook fallback) recommends an action; a separate policy engine may auto-dismiss noise, watch an account, or suspend a high-confidence abuse case. Ambiguous cases still go to a person. Partner cafés still only see activity at their own locations. If an investigation confirms abuse we may suspend the account as described in the Terms of Service.
Who we share it with
- Partner cafés see refill and return events at their locations, not your full account profile.
- Processors such as Stripe (payments), our hosting provider, and email delivery, only to provide the service.
- Legal requests when we are required to disclose information by law.
Retention
We keep account and deposit records for as long as the account is active and for a limited period afterward to complete returns, billing, and legal obligations. Support transcripts are kept long enough to resolve the request.
Your choices
- Update profile details in the consumer or business app
- Cancel a business subscription from Billing in the dashboard
- Request access, correction, or deletion by contacting us — start on the contact page
Cookies
We use essential cookies and similar storage for sign-in sessions and security. The marketing site does not run third-party advertising cookies.
Children
EcoSip is not directed at children under 13, and we do not knowingly collect their data.
Changes
If we make material changes, we will update this page and revise the date above. Continued use of EcoSip after an update means you accept the revised policy.