Legal
CupSeer Privacy Policy
v0.1 · updated 2026-10-12
Last updated: [date]
CupSeer (“the app”) is operated by [LastCopper legal name, e.g. LastCopper OÜ], a company registered in Estonia, [registry code], [address in Estonia] (“LastCopper”, “we”), lastcopper.com. LastCopper is the controller of your personal data. Privacy and support contact: support@lastcopper.com.
1. What CupSeer does
CupSeer reads photos of the inside of a coffee cup (and optionally its saucer) and writes an entertainment reading.
Readings are generated by artificial intelligence (AI). AI models that understand images and text (vision-language models) look at the shapes in your photos and write the reading. The text is AI-generated, is for entertainment only, can be wrong or odd, cannot predict the future and does not replace professional advice (medical, legal, financial, psychological or any other).
2. Your LastCopper account
You use CupSeer with a LastCopper account, the same account used by all LastCopper games. The account is run by the LastCopper platform: you can use a guest account or sign in with e-mail or Apple. The platform keeps your sign-in details (e-mail, password, Apple sign-in) and a record that you are at least 13 or 18; it never stores your birth date. [Reference to the LastCopper account privacy notice.] CupSeer itself receives only your account id; it does not see your e-mail or password.
Before any account exists, CupSeer asks your year of birth on your phone. If you are under 13, no account is created and nothing is sent; your phone remembers the answer for 30 days. The year is never stored or sent, only the result (13+ or 18+).
3. What CupSeer collects
We do not collect your location, contacts or device identifiers for advertising, and we do not use analytics.
| Data | Why | How long |
|---|---|---|
| Your LastCopper account id | To keep your readings and gold together, on every phone you sign in on | Until you delete your account or your CupSeer data |
| A one-way hash of a random id created by the app on your phone | So the welcome gold is given once per device | Kept after deletion, no longer linked to your account |
| Photos you take or choose for a reading | To create the reading | Deleted 30 days after the reading finishes, or earlier when you delete it |
| The reading (what was seen in the photos, meanings, story) | To show it to you again in your journal | Until you delete it |
| Your gold balance and its history (gifts, ads, purchases, readings, refunds) | To run the in-app gold | Until you delete your data; [purchase records may be kept longer where tax law requires] |
| A report you send about a reading (reading id, reason, optional note) | To review readings reported as offensive or harmful | [90] days |
| Your interface and reading language, onboarding state | App settings | On your device only |
| Technical logs (reading ids, status, durations, error codes) | To run and secure the service | [30] days |
Your gold balance is kept in the LastCopper platform’s ledger, which is shared by LastCopper games; CupSeer keeps a journal of the gold movements it makes (readings, refunds, gifts, ads).
Photos are re-encoded on your device and again on our server; location and camera data (EXIF) are removed before storage. Our logs never contain photos, tokens or reading text.
4. How the AI works with your data
- Your photos are read by AI models running on computers operated by LastCopper in the European Union and in Türkiye (inference nodes), not by a third-party AI provider. When demand is high, LastCopper also runs the same models on GPU servers rented from RunPod in its European data centres. Which computer reads a given reading depends on which one is free. The photos are sent to them over an encrypted connection, held in memory only for the reading, and not stored there.
- No third-party AI provider receives your photos or readings.
- Your photos and readings are not used to train AI models. CupSeer does not train or fine-tune models with them.
- If you find a reading offensive or harmful, you can report it from the reading screen (Report this reading). Reports are reviewed by LastCopper staff.
5. Where your data is processed
- Network and security: all traffic between the app and LastCopper’s servers (the CupSeer API at cupseer-api.lastcopper.com and the account platform at api.lastcopper.com) passes through Cloudflare, Inc., which provides the network, the encrypted connection (TLS) and protection against attacks. Cloudflare therefore processes connection data (IP address, request metadata) and the content in transit, including photos and access tokens, on our behalf. Cloudflare does not store your photos.
- API server and database: DigitalOcean, data centre in Frankfurt, Germany (EU).
- AI processing: computers operated by LastCopper in the EU and in Türkiye, and, when demand is high, GPU servers rented from RunPod (Runpod, Inc.) in its European data centres, running LastCopper’s own models (see section 4).
- [Ads, once enabled: Google AdMob shows rewarded ads that you choose to watch. Google may process device and advertising data under its own policy. See section 7.]
- [Purchases, once enabled, are handled by Apple App Store / Google Play. We receive a transaction identifier and product, not your payment details.]
CupSeer itself sends no e-mails to players; account e-mails come from the LastCopper platform.
6. Applicable law, legal basis and international transfers
LastCopper is established in Estonia, in the European Union, so the EU General Data Protection Regulation (GDPR) is the main law that applies to how we handle your data. For users in Türkiye, and because some readings are processed on LastCopper’s computers in Türkiye, Turkish data protection law (KVKK, Law No. 6698) may also apply [scope to be confirmed by counsel].
We process your data to provide the service you ask for (contract, GDPR Article 6(1)(b)), to meet legal obligations (GDPR Article 6(1)(c)), and to keep the service secure (legitimate interest, GDPR Article 6(1)(f)). [Where KVKK applies: KVKK Article 5(2)(c), (ç), (f).]
Recipients and processors: Cloudflare, Inc. (network, TLS, attack protection), DigitalOcean (server and database hosting), RunPod (Runpod, Inc.; GPU servers in Europe that run our AI models when demand is high), [Google (AdMob), Apple and Google (store purchases), once enabled].
Where your data goes, and transfers outside the EU:
- Servers and database: DigitalOcean, Frankfurt, Germany (EU). This is not a transfer outside the EU.
- AI computers in Türkiye: some readings are read on computers that LastCopper operates itself in Türkiye; no other company receives the photos there. Türkiye has no EU adequacy decision. [Counsel to confirm whether this counts as a transfer and which safeguards apply, e.g. LastCopper’s own technical and organisational measures.]
- Cloudflare, Inc. (US), whose network may process traffic outside the EU, and RunPod (Runpod, Inc., US), whose servers we use only in its European data centres: [EU–US Data Privacy Framework certification or standard contractual clauses — to be confirmed by counsel].
- Where KVKK applies: transfers of data from Türkiye abroad fall under KVKK Article 9 [basis to be confirmed by counsel].
7. Ads [when enabled]
Rewarded ads are optional: you choose to watch them to earn gold. [Describe consent (UMP), App Tracking Transparency, and whether ads are personalised.]
8. Your rights
You can delete a reading (trash icon) at any time, or your whole account (Settings → Your LastCopper account → Delete account): this deletes your photos, readings and gold in CupSeer and then your LastCopper account. If your LastCopper account is deleted from another LastCopper game, CupSeer erases that account’s photos, readings and gold within about 10 minutes of the platform’s notice.
You may also ask us for access, correction, deletion, restriction or objection by writing to support@lastcopper.com [where KVKK applies: including your rights under KVKK Article 11].
You can complain to a data protection authority. LastCopper’s lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You may also complain to the data protection authority in your own country. Users in Türkiye may also contact the Personal Data Protection Board (KVKK Board).
9. Security
Encrypted connections (HTTPS/TLS), photos stored privately and served only to your account, database on a private network, access limited to LastCopper staff who run the service.
10. Children
Nobody under 13 can have a LastCopper account or use CupSeer (see section 2). The age in GDPR Article 8 is 13 in Estonia, but other EU countries set it between 13 and 16. CupSeer relies on its contract with you, not on consent, to process your data. [Align with the store age rating. Counsel: confirm for each country whether consent-based processing or parental consent is needed.]
11. Changes
We will update this policy when the app changes and show the date above.