Privacy policy.

Third State is an artisanal third-wave coffee bar in Dubai, United Arab Emirates. This policy describes the personal information we collect through our website, how we use it, and the choices you have.

By using our website or services, you agree to the practices described here. If you have questions at any time, contact us at hello@thirdstate.ae.

We only collect the information we need to run our business and serve you:

• Waitlist emails. When you sign up to be notified about our opening, we collect your email address and the time you signed up.
• Account and order information. If you create an account or place an order, we collect your name, email address, phone number, and order details.
• WhatsApp messages. If you order through WhatsApp, the messages you send are processed through the WhatsApp Business Platform to receive and confirm your order.
• Device identifiers. Ordering terminals and shared devices may store a non-personal token (for example a kiosk session token) used to keep that device associated with the correct orders.
• IP addresses. When you submit the waitlist form, we read the IP address of your request in memory for a few minutes to stop automated abuse. It is never stored or logged.

Your information is used only for the purposes you would reasonably expect:

• To send waitlist updates and notify you when Third State opens
• To process, confirm, and fulfil your orders, at the counter and through WhatsApp
• To create and manage your account and keep you signed in through secure magic links
• To detect and prevent automated abuse of our forms and services

We do not sell your personal information. To operate the site we rely on a small number of processors, each bound by contract to use your information only for the services described below:

• Supabase — database storage and authentication
• Meta (WhatsApp Business Cloud API) — transmitting your order messages
• Vercel — hosting this website
• Mail gateway (Lovable / Gmail connector) — sending waitlist confirmation emails from hello@thirdstate.ae

Our website does not use advertising or cross-site tracking cookies. We use standard browser storage only where it is needed to function:

You can clear browser storage at any time without affecting the public pages of the site.

• Authentication sessions — so you can stay signed in when using account features
• Kiosk and device tokens — on shared ordering terminals, so orders are routed correctly

Waitlist emails are kept until you ask us to remove them, or until the waitlist has served its purpose. Account and order records are kept only as long as reasonably needed for operations, customer service, and legal and accounting obligations. IP addresses used for abuse protection are held in memory and never written to storage.

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives you rights over your personal information:

To exercise any of these rights, email hello@thirdstate.ae. We will respond within the timeframes required by law. You may also make a complaint to the UAE Data Office.

• Access — request a copy of the personal data we hold about you
• Correction — ask us to fix inaccurate or incomplete data
• Deletion — ask us to remove data we no longer need
• Withdrawal of consent — opt out of waitlist communications at any time

For questions, privacy requests, or complaints, email hello@thirdstate.ae. We aim to respond within five business days.

We may update this policy from time to time. When we do, we will revise the effective date below and make the updated version available on this page.