1. Scope

This Policy applies to personal information collected through Zavor & Co.-operated websites, checkout pages, forms, the Zavor recipe app, account or customer-portal experiences, customer-support channels, delivery operations, and related services. It does not control the independent privacy practices of third-party websites or services that you choose to visit.

2. Information We Collect

2.1 Information You Provide

Depending on how you interact with us, we may collect:

• Identity and contact information: Name, email address, telephone number, and other contact details.
• Order and delivery information: Products and quantities ordered, Buy once or Auto-Delivery selection, order history, delivery address, ZIP code, delivery instructions, delivery status, and communications about an order.
• Billing information: Billing address, payment status, transaction identifiers, limited payment-method details such as card brand and last four digits, and related records. Full payment-card numbers are handled by Stripe and are not stored by us.
• Account information: Account or portal identifiers, access activity, Auto-Delivery status and quantity, billing history, and preferences.
• Communication and consent information: Messages, inquiries, feedback, support history, marketing preferences, SMS and email consent records, opt-outs, and suppression status.
• Form and partnership information: Information submitted through contact, expansion-area, event, retail, food-service, school, office, referral, or partnership forms.
• Information you voluntarily provide: Any other information included in a message, review, survey response, or support request. Please do not send sensitive medical information unless it is necessary for us to address a food-safety or allergen concern.

2.2 Information Collected Automatically

When you use our websites or app, we and our service providers may automatically collect:

• Device and network data: Browser type, operating system, device type, Internet Protocol address, language, and similar technical information.
• Usage data: Pages or screens viewed, links and buttons selected, referring pages, approximate timestamps, session activity, errors, and interactions with Site or app features.
• Approximate location: General location derived from an Internet Protocol address. This is different from the street address you provide for delivery.
• Cookies and similar technologies: Identifiers and information described in Section 8.

2.3 Delivery Records

To complete, document, and troubleshoot deliveries, we may create delivery notes, timestamps, route and status records, failed-delivery reasons, and proof-of-delivery photographs. A proof photograph may show the drop-off location or surrounding property but should not intentionally capture people or the inside of a residence. We use these records for delivery confirmation, customer support, safety, fraud prevention, and dispute resolution.

2.4 Information from Other Sources

We may receive transaction, account, communication, fraud-prevention, analytics, or technical information from service providers used to operate our business, including Stripe, GoHighLevel/LeadConnector, Google, and Cloudflare. We may also receive information from a person who submits a referral, partnership inquiry, or other request involving you.

3. How We Use Personal Information

We may use personal information to:

• Process, confirm, prepare, deliver, and document Buy once and Auto-Delivery orders.
• Calculate charges, process payments, manage monthly Auto-Delivery billing, and maintain transaction records.
• Verify service-area eligibility and plan delivery routes.
• Provide account or customer-portal access and maintain account security.
• Send transactional communications about orders, payments, deliveries, account access, or Auto-Delivery when permitted.
• Send marketing email or text messages only with the applicable consent or as otherwise permitted by law.
• Record, honor, and demonstrate communication choices, consent, revocation, and opt-out requests.
• Respond to inquiries, provide customer support, and resolve complaints, delivery problems, payment disputes, refunds, or replacement requests.
• Operate, secure, troubleshoot, analyze, and improve our websites, app, products, delivery operations, and customer experience.
• Detect and prevent fraud, misuse, unauthorized access, and other security incidents.
• Maintain business, tax, accounting, food-safety, consent, and legal records.
• Comply with law, enforce our agreements, establish or defend legal claims, and protect the rights and safety of customers, Zavor & Co., and others.

4. SMS and Text Messages

Providing a telephone number or placing an order does not, by itself, enroll you in marketing text messages. When SMS is offered, transactional and marketing text-message consents are separate, optional choices. We send automated texts only within the scope of the consent you expressly provide or as otherwise permitted by law.

• Transactional texts may include order confirmations, payment or account notices, delivery updates, and Auto-Delivery information.
• Marketing texts may include promotions, product news, or offers and require the applicable marketing consent. Marketing consent is not a condition of purchase.

Message frequency varies. Message and data rates may apply. Reply STOP to revoke SMS consent or HELP for help. A one-time opt-out confirmation may be sent where permitted. You may also contact [email protected]. Revoking SMS consent does not cancel an order or Auto-Delivery; use the cancellation process described in our Terms of Service to cancel Auto-Delivery.

5. Email Communications

We may send transactional or relationship emails needed to administer an order, payment, delivery, account, Auto-Delivery enrollment, or customer-service request. We may send promotional or newsletter emails with your consent or as otherwise permitted by law. Marketing emails include an unsubscribe method. We honor valid marketing-email opt-out requests within the time required by law, without stopping necessary transactional communications.

6. How We Disclose Personal Information

We do not sell personal information or share it for cross-context behavioral advertising. We may disclose personal information for the business purposes described below:

• Payment processing: Stripe processes payments, recurring charges, refunds, fraud checks, and related transaction data.
• Customer relationship and communications: GoHighLevel/LeadConnector helps operate checkout experiences, forms, customer records, workflows, email, SMS, and account-related functions.
• Website, app, and security infrastructure: Cloudflare helps host, deliver, protect, and monitor certain Zavor & Co. websites, apps, data, and media.
• Analytics: Google Analytics helps us understand aggregate website and app usage. Our current configuration disables Google signals and advertising-personalization signals.
• Email and workplace tools: Google Workspace supports business email, documents, and internal communications.
• Maps and delivery tools: Mapping and routing providers may process delivery addresses and route information needed to plan or complete deliveries.
• Delivery and operational support: Authorized personnel and vendors may receive the minimum information needed to prepare, route, complete, document, or support an order.
• Professional advisers: Accountants, attorneys, insurers, and other advisers may receive information when reasonably necessary to provide professional services.
• Legal and safety disclosures: We may disclose information when we reasonably believe disclosure is required by law or necessary to protect rights, safety, property, customers, or the public.
• Business transactions: Information may be disclosed in connection with an actual or proposed merger, financing, acquisition, reorganization, sale of assets, or similar transaction, subject to applicable law.

Service providers may use personal information only as permitted by their agreements with us and applicable law.

7. Third-Party Privacy Information

The privacy practices of key service providers are described in their own policies:

• Stripe Privacy Policy
• GoHighLevel Privacy Policy
• Google Privacy Policy
• Cloudflare Privacy Policy

8. Cookies and Analytics

Our websites and app may use cookies, pixels, local storage, and similar technologies, including:

• Essential technologies: Support security, fraud prevention, forms, checkout, account access, preferences, and core functionality.
• Analytics technologies: Help us understand visits, sessions, approximate location, device and browser information, page or screen activity, and feature usage.
• Functional technologies: Remember settings or choices and improve the user experience.

We use Google Analytics 4. Google Analytics may use a first-party cookie or similar identifier to distinguish browsers and sessions and may collect device/browser information, approximate location, and activity on our websites or app. Google Analytics uses Internet Protocol addresses during collection to derive general location and does not log or store individual Internet Protocol addresses. We have disabled Google signals and advertising-personalization signals in our current configuration.

You can restrict cookies using your browser settings, although blocking essential technologies may affect Site, checkout, portal, or app functionality. You may also use the Google Analytics Opt-out Browser Add-on. Where applicable law requires consent for nonessential technologies, we will request it through an available consent mechanism.

9. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, disclosure, or destruction. Payment-card information is processed by Stripe, and we do not store full card numbers. Certain operational systems use authentication, access controls, encrypted connections, and restricted links. No security method is perfect, and we cannot guarantee absolute security.

If a security incident affects personal information, we will investigate and provide notices to affected individuals, regulators, or others when required by applicable law.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. Retention periods vary based on the type of information and may account for an active order or Auto-Delivery enrollment, customer support, food-safety and delivery records, consent and suppression records, tax and accounting requirements, fraud prevention, dispute resolution, legal claims, and service-provider settings.

Cancellation of Auto-Delivery or closure of an account does not automatically delete order, transaction, consent, delivery, or legal-compliance records. When information is no longer reasonably needed, we may delete, de-identify, or securely archive it as appropriate. Aggregated or de-identified information may be retained where it no longer reasonably identifies an individual.

11. Your Choices and Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right or ability to:

• Request access to or a copy of personal information associated with you.
• Request correction of inaccurate personal information.
• Request deletion of certain personal information.
• Withdraw consent where processing depends on consent.
• Opt out of marketing email or text messages.
• Request information about categories of personal information collected, used, or disclosed.
• Exercise other privacy rights available under applicable law without unlawful discrimination.

Submit a request to [email protected] with the subject “Privacy Request.” Describe the request and identify the email address or telephone number connected with your interactions with us. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law and may deny or limit a request where an exception applies. Authorized agents may submit requests where permitted by law, subject to verification.

Privacy requests do not automatically cancel an order or Auto-Delivery enrollment. To cancel Auto-Delivery, follow the cancellation process in our Terms of Service.

12. Children’s Privacy

Our ordering, account, and delivery services are intended for adults and are not designed to collect personal information directly from children under 13. We do not knowingly collect personal information online from a child under 13 without legally sufficient parental consent. Zavor & Co. may create family-oriented or children’s content, but a child should not submit personal information, create an account, or place an order.

If you are a parent or guardian and believe a child under 13 submitted personal information to us, contact [email protected]. We will review the request and take appropriate action as required by law.

13. Third-Party Links and Platforms

Our websites, app, emails, or social channels may link to third-party websites, apps, videos, social networks, or services. Those third parties control their own privacy practices. Review their policies before providing information to them. Links do not imply that we are responsible for a third party’s privacy, security, or content.

14. Pennsylvania Breach Notification

If a breach of personal information occurs, Zavor & Co. will provide notices to affected individuals, the Pennsylvania Office of Attorney General, consumer reporting agencies, or others when and as required by the Pennsylvania Breach of Personal Information Notification Act and other applicable laws.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, services, providers, or legal obligations. We will post the revised version and update the Effective Date. When required by law, we will provide additional notice or obtain consent before a material change takes effect. We encourage you to review this Policy periodically.

16. Contact Us