Privacy Policy

Operator and scope

Leo Chen, an individual operator, operates hotcup at gethotcup.com. For privacy questions or requests, contact leo@hotcup.tw. This policy covers this website and its early-access waitlist, not the separate application at app.hotcup.tw.

Information and purposes

When you register, we store your email address, website language, registration identifier and original signup time to manage the waitlist and send early-access invitations and related launch communications. Registration is voluntary: you can browse without providing an email, but cannot receive an invitation without one. We do not ask for your name, health information, allergies, dietary preferences or scan history. Product screenshots are demonstrations.

Hosting, database and security providers process technical information, such as IP addresses, browser information, request times and security/error diagnostics, to deliver and protect the website. Provider diagnostics may contain submitted information.

Providers and overseas processing

We use Lovable hosting and Lovable Cloud database services, Cloudflare delivery and security, Google Fonts, and Google Analytics 4 (GA4), provided by Google. Font and security requests occur regardless of analytics settings. Website delivery is global, and providers may process information outside Taiwan under their service arrangements. Waitlist emails are not sent to GA4.

Analytics and cookies

Analytics depends on your approximate region, determined from the country code our delivery network (Cloudflare) attaches to each request; we do not store your IP address or this code. For visitors identified as being in Taiwan, GA4 is on by default, and you can turn it off at any time in Privacy Settings. For all other visitors—including the EEA, UK and Switzerland—and whenever the region cannot be determined, GA4 stays off until you opt in through Privacy Settings, and no GA4 script or measurement request is sent before then. Region detection may be inaccurate, for example when using a VPN.

When analytics is active, we measure page views, valid waitlist submission attempts, successful and duplicate registrations, and manual carousel actions to understand website use and improve the early-access experience. Custom waitlist events contain only website language; carousel events contain language and generic action/position, not product names or analysis/profile details. Automatic carousel rotation is not recorded as an interaction. We never send waitlist emails, form contents, health information or dietary preferences to GA4. Our integration omits URL query strings, fragments and external referrers.

GA4 may use _ga and related first-party cookies and process cookie/client identifiers, pages viewed, timestamps, session/engagement information, browser/device information and approximate location. These may be personal data. Advertising consent remains denied; Google Signals, user-provided data collection, advertising personalization and remarketing are disabled. GA4 event/user retention is configured to 14 months. This setting does not cover standard aggregated reports or guarantee exact-day erasure.

Browser preferences

This browser stores your analytics choice, decision time, notice version and manual language preference. Select Privacy Settings in the footer to turn analytics on or off. Withdrawal stops subsequent tracking and removes first-party GA cookies where possible; it does not delete historical Google data or your waitlist registration. Activities before analytics is turned on are not replayed later. Saved opt-outs, Global Privacy Control and Do Not Track signals are always respected, including in Taiwan, and are never overridden by the regional default. Clearing storage or changing browsers may require a new choice. Security services may use cookies separately. Analytics consent does not authorize unrelated marketing.

Retention and deletion

We retain waitlist registrations only while needed for early-access invitations and related launch communications, for a maximum of 24 calendar months from original registration, with earlier deletion when no longer needed or required by an applicable request or law. Duplicate attempts and later contact do not restart this period. Relevant operator-controlled copies follow the same rule. Retention is managed through periodic operator review; automated deletion is not active.

Provider-managed backups and technical logs have separate lifecycles under the providers' policies. Removing an active registration does not guarantee immediate removal from every historical backup or log. Before using a restored waitlist, we reconcile previously deleted and expired registrations so they are not returned to active use. Privacy-request and recovery records are restricted and kept only as necessary to handle requests, prevent restoration of removed records and meet applicable legal requirements.

Your rights

Under Taiwan's Personal Data Protection Act, subject to lawful exceptions, you may request access or a copy, correction, cessation of collection, processing or use, or deletion at leo@hotcup.tw. We use proportionate verification of control of the registered mailbox rather than routinely requesting identity documents. We respond as required by law, confirm the outcome privately and explain applicable exceptions or backup limitations.

Policy updates

When this policy changes, we update its effective date and provide any additional notice required by law.