Privacy Policy

Last updated October 28, 2026

Divvit runs a marketplace where startups put their brand on the coffee sleeves of local cafés. This policy explains what we collect when you use divvit.app and marketplace.divvit.app, why we collect it, and what you can do about it.

What we collect

• Your account. Your name, email address and password. Passwords are stored by our sign-in provider in hashed form; we never see them.
• Startup profiles. Company name, website, LinkedIn page, description, logo, category, location, stage, and the areas and campaigns you set up, including sleeve designs you create or upload.
• Café listings. Café name, address and location, website, Instagram, opening hours, roughly how many cups you serve, which brands you'll carry, photos you upload, and the details of how you verified the café.
• Payments. Payments are handled by Stripe. We never see or store card numbers; we keep the amount, the status and Stripe's reference numbers.
• QR code scans. When someone scans the QR code on a campaign sleeve, we record the time and a one-way, keyed fingerprint of their connection (made from their IP address and browser) so we can count how many different people scanned. We don't store the IP address itself, and the scan isn't tied to an account. The person is then sent to the startup's website.
• On your device. We use cookies only to keep you signed in. Your browser also keeps things like an unfinished sign-up or campaign so you can pick up where you left off. We don't use advertising trackers.

Where some of it comes from

To save typing, we fill in what we can from public sources: the Y Combinator company directory, your own website, OpenStreetMap, and People Data Labs (company size, founding year and funding). You can change anything we fill in.

How we use it

• To run the marketplace: show cafés to startups, send campaigns to cafés, print and deliver sleeves, and handle payments and payouts.
• To review campaigns and verify that each café is run by the person who listed it.
• To send you emails about your account and campaigns (approvals, payments, offers, reports).
• To report how a campaign did, using scan counts and estimates.
• To keep the service secure and working, and to improve it.

Who sees it

Startups see café listings (name, neighborhood, estimates and photo). A café sees the details of a campaign offered to it: the startup's name, description, website, logo and sleeve. We don't sell personal information.

We use these providers to run Divvit, and they handle data only on our behalf:

• Supabase (database, sign-in and file storage) and Vercel (hosting)
• Stripe (payments and invoices) and Resend (email)
• People Data Labs (company details), OpenStreetMap services (maps and place details) and Anthropic (suggesting neighborhoods from a startup's description)

We may also share information if the law requires it, or with a buyer if Divvit is ever sold, under the same protections.

How long we keep it

We keep your information while your account is open. Payment records are kept as long as tax and accounting rules require. Scan counts stay with the campaign's report.

Your choices

You can see and edit your profile or listing in the marketplace at any time. To get a copy of your data, correct it, or delete your account, email elliott@divvit.app and we'll take care of it within 30 days.

Security

Data is encrypted in transit, and access to it is restricted by account. No service is perfectly secure, so please use a strong password that you don't use anywhere else.

Children

Divvit is for businesses and isn't meant for anyone under 18.

Changes

If we change this policy in a way that matters, we'll update the date above and let account holders know by email.

Contact

Questions about privacy: elliott@divvit.app.