Privacy Policy

1. Introduction

This Privacy Policy explains how Fresh & Furious (“we,” “us,” or “our”) collects, uses, and shares information when you use our online ordering service for pickup and dine-in. By using the service, you agree to the practices described here.

2. Information We Collect

We collect the information you give us and a limited amount of technical information, including: your name; email address; phone number; your order history (items, totals, pickup or dine-in details); your marketing preference (whether you opted in); and device and usage data such as IP address, browser type, and pages viewed. We do notcollect or store your full payment card details — those are sent directly to our payment processor, Square, Inc. (“Square”).

3. How We Use Your Information

We use your information to: fulfill and prepare your orders; send you order-status updates and receipts; send optional marketing messages where you have opted in; detect, prevent, and investigate fraud and abuse; operate, maintain, and improve the service; and comply with our legal, tax, and accounting obligations. We process this information because it is necessary to provide the service you request, to pursue our legitimate business interests, and to meet our legal obligations.

4. Sub-Processors and Third Parties We Share With

We share information with a small number of trusted service providers (sub-processors) only as needed to operate the service:

Square, Inc. — payment processing. Your card details and payment are handled by Square.

Resend — email delivery. We use Resend to send transactional email (such as order confirmations and receipts) and, if you opted in, marketing email.

Supabase — database and hosting infrastructure. Your order and account information is stored on infrastructure provided by Supabase.

Each of these providers processes information on our behalf under its own terms and security commitments. We may also disclose information where required by law or to protect our rights, but we do not sell your personal information. [DRAFT: confirm full sub-processor list and data-processing agreements with counsel.]

5. Cookies and Similar Technologies

We use cookies and similar technologies for session and authentication purposes — for example, to keep your cart and order session working as you browse. We do not use third-party advertising or cross-site ad-tracking cookies. [DRAFT: confirm cookie inventory and any consent banner requirements with counsel.]

6. Data Retention

We retain order and transaction records for as long as necessary to meet our tax, accounting, and legal obligations, and to resolve disputes. Other personal information is kept only as long as needed for the purposes described in this policy. [DRAFT: specific retention periods are a pending decision for counsel.]

7. Your Rights and Choices

Marketing opt-out. You can unsubscribe from marketing email at any time using the link in those messages or by visiting /unsubscribe.

California (CCPA). If you are a California resident, you have the right to know what personal information we collect, to request deletion of your personal information, and to opt out of the sale of personal information. We do not sell personal information.

EU/UK (GDPR). If you are in the EU or UK, you have rights to access, rectify, erase, and port your personal information, and to object to or restrict certain processing. [DRAFT: dedicated request endpoints for these rights are not yet built — confirm the intake process and verification with counsel.]

To exercise any of these rights, contact us using the details in the Contact section below.

8. Children’s Privacy

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

9. Data Security

We use reasonable technical and organizational safeguards to protect your information, including encryption in transit and at rest and tokenized payments handled by Square so that full card numbers never reach our systems. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the service after an update takes effect indicates your acceptance of the revised policy.

11. Contact for Privacy Requests

For privacy questions or to exercise your rights, contact Fresh & Furious at [DRAFT: privacy contact email] or [DRAFT: company legal name and mailing address].