Privacy Policy

This Privacy Policy explains how Ginseng Swap Limited, doing business as BothCups ("BothCups," "we," "us," or "our"), collects, uses, discloses, and safeguards personal information in connection with the BothCups neighbourhood agent — an AI agent, reached by text message or phone call, that connects people in the same neighbourhood for real-life activities — together with the website at pulse520.ai and related services (collectively, the "Service").

The Service is being built for Canada first, starting in Toronto. We design for the Personal Information Protection and Electronic Documents Act (PIPEDA) as our baseline, and honour additional rights that apply in your jurisdiction.

Registered office: Ginseng Swap Limited, Room 1006, 10/F, Haleson Building, 1 Jubilee Street, Central, Hong Kong.

• Members — people who join a neighbourhood number to be matched into activities with other members.
• Organizers — members who use the agent to organize activities for their neighbourhood.
• Waitlist joiners & website visitors — people who contact us, join the waitlist, or browse pulse520.ai before the service is live.
• Venues & partners — local businesses and community spaces whose staff interact with the agent (for example, when it calls to book a table or a court).

3.1 Information you provide

• Phone number: your phone number is your account. We verify it by one-time code and use it to identify you, deliver messages, and keep the community limited to real, reachable people.
• Profile basics: your first name (or preferred name), and your general neighbourhood — at the level of a neighbourhood or postal prefix (e.g. a Toronto FSA such as "M6J"). We do not ask for, and you should not provide, your street address.
• Interests & availability: the activities you say you're into, when you're generally free, and preferences you share (pace, skill level, group size) — this is the information the matching runs on.
• Messages: the content of texts (SMS/MMS) you exchange with the agent, including messages the agent relays between you and other members.
• Voice calls: if you call the number (or the agent calls you), the call is processed by our voice pipeline and may be recorded and transcribed to provide the Service. Where recording applies, the agent discloses it at the start of the call.
• Activity history: RSVPs, attendance and cancellations (which feed the reliability "show-up score"), and feedback you give after activities.
• Waitlist & support: your email address and anything you include when you contact us.

3.2 Information collected automatically

• Usage data: website pages viewed, device type, browser, approximate location (country/region), and timestamps. We use Vercel Web Analytics, a privacy-friendly provider that does not use cookies or cross-site identifiers.
• Log data: IP address, user agent, request paths, message delivery metadata, error traces, and security events, retained for operational and security purposes.
• Cookies: a small number of first-party cookies strictly required for authentication, session management, and security. See Section 8.

3.3 What we deliberately do not collect

• Precise location: we do not track GPS location. Your neighbourhood is something you tell us, not something we follow.
• Home addresses: the Service is designed around public meeting places; we do not request members' home addresses.
• Contact-list uploads: we do not import your phone's address book.

We use personal information to:

• Match you into activities with nearby members based on your interests, availability, and general neighbourhood;
• Organize those activities — sending invitations and reminders, collecting RSVPs, and contacting venues (including by phone call) to make bookings on the group's behalf;
• Relay communications between members through the agent, so activities can be planned without members exchanging phone numbers;
• Keep the community safe — verifying phone numbers, maintaining the show-up score, enforcing blocks, investigating reports, and preventing spam, fraud, and abuse;
• Provide, operate, maintain, secure, and improve the Service;
• Communicate with you about your account, the waitlist, service updates, and — only with your consent — news about the Service (see Section 7 on CASL);
• Comply with legal obligations and enforce our Terms of Service.

We do not use your information for third-party advertising, and we do not build advertising profiles from your messages.

Privacy between neighbours is a core design constraint of the Service:

• Other members see your first name, general neighbourhood, and relevant interests when you're matched into an activity together — enough to say hello at the park, nothing more.
• Your phone number is never shared with other members. All coordination messages are relayed through the agent unless and until you choose to share your number with someone directly.
• Your show-up score influences matching but is not displayed as a public ranking of you to other members.
• Venues the agent contacts on your behalf receive only what the booking requires (e.g. a first name and party size) — not your phone number or profile.

We share personal information only with:

• Telephony providers (such as Twilio) — to send and receive the texts and calls the Service runs on. Message and call content necessarily transits these providers.
• AI service providers — the agent is powered by large language models; message content and call transcripts are processed by these providers to generate the agent's replies and actions, under data-processing terms that prohibit them from using your content to train their models where such commitments are available.
• Infrastructure providers — cloud hosting, database, logging, and email delivery vendors, bound by confidentiality and data-processing terms.
• Payment processing — if the Service offers optional commitment deposits or paid features, payments will be processed by Stripe. Card details go directly to Stripe and are not stored on our servers.
• Legal & safety recipients — if required by law, to enforce our Terms, to protect the rights or safety of members or the public, or to respond to lawful requests.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell personal information, and we do not share it with advertising platforms.

• Consent: joining a neighbourhood number is opt-in. When you sign up we explain what the agent does — including that it will text and may call you proactively with activity proposals — and ask for your consent. You can narrow what it contacts you about, or withdraw consent entirely, at any time.
• Opting out: reply STOP at any time to stop all messages, or PAUSE to pause proposals without leaving. Quiet hours are respected by default.
• CASL: any commercial electronic messages we send (for example, news about the Service to waitlist joiners) are sent only with consent, identify us as the sender, and include a working unsubscribe mechanism, as required by Canada's Anti-Spam Legislation.
• Carrier charges: standard message and data rates from your carrier may apply.

We use a minimal set of strictly necessary first-party cookies (authentication, session, security) and no advertising or cross-site tracking cookies. Vercel Web Analytics, our website analytics provider, does not set cookies or use cross-site identifiers.

BothCups is operated by a Hong Kong company and uses infrastructure and service providers located in Canada, the United States, and other jurisdictions. Your information may be processed outside the province or country where you live, where it may be subject to local law. We use contractual and technical safeguards with our providers regardless of where they operate, and where EEA/UK data is involved we rely on Standard Contractual Clauses or equivalent mechanisms.

• Account and profile data — while your account is active, plus up to 12 months after you leave.
• Message content and call transcripts — retained while needed to provide the Service (context for your agent) and for safety investigations; routinely deleted or de-identified on a rolling basis thereafter.
• Call recordings — short retention, only as needed for transcription and quality/safety review.
• Safety records (reports, blocks, enforcement) — retained longer as needed to keep the community safe.
• Payment records — 7 years, to meet tax and accounting obligations.
• Operational logs — up to 12 months.

11.1 Canada (PIPEDA and provincial law)

• access the personal information we hold about you and ask how it is used and disclosed;
• correct inaccurate or incomplete information;
• withdraw consent (subject to legal or contractual restrictions) — including by simply texting STOP;
• ask us to delete your account and associated personal information;
• complain to our Privacy Officer (Section 14), and if unsatisfied, to the Office of the Privacy Commissioner of Canada.

11.2 Other jurisdictions

If you are in the EEA/UK (GDPR), California (CCPA/CPRA), or another jurisdiction with its own privacy law, you may have equivalent or additional rights — including access, erasure, portability, objection, and non-discrimination. Contact us using the details in Section 14 and we will respond within the timeframe required by applicable law.

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS), encryption at rest for sensitive data, least-privilege access controls, audit logging, and regular security reviews. No system is perfectly secure; we cannot guarantee absolute security.

The Service is for adults: you must be 18 or older to join. We do not knowingly collect personal information from anyone under 18. Family-oriented activities (such as parent meetups) are organized between adult members; any information a member shares about their children (e.g. ages, for playdate matching) is provided by the parent, used only for that purpose, and never shared beyond the matched group. If you believe a minor has created an account, contact us and we will delete it.

We may update this Policy from time to time — including a substantial revision when the Service launches. Material changes will be notified via the Service or by text/email. The "Last updated" date at the top of this page reflects the latest version.

For privacy questions, to exercise your rights, or to reach our Privacy Officer, contact: