Saucy Bowl Privacy Policy

Effective Date: June 21, 2026 Last Updated: June 21, 2026

For California-licensed counsel review before publication. This is a final-quality draft. Validate statutory citations and CCPA/CPRA mechanics against current law. Sections marked [CONFIRM] flag the highest-attention items.

This Privacy Policy describes how Saucy Bowl, LLC, a California limited liability company ("Saucy Bowl," "we," "us," or "our"), collects, uses, shares, and protects information about you when you use the Saucy Bowl website at saucybowl.us, our mobile applications, and any related services (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy.

1. Scope

This Privacy Policy applies to information collected through the Service. It does not apply to:

• Third-party websites or services linked from the Service (subject to their own privacy policies)
• Stripe, Inc. (payment processing — see https://stripe.com/privacy)
• DoorDash, Inc. (delivery — see https://www.doordash.com/privacy)
• Otter (kitchen integration, if applicable — see https://tryotter.com/privacy)
• Partner Kitchens' independent practices when you visit them in person (not as a Saucy Bowl customer)

2. Information We Collect

2.1 Information You Provide

When you place an order, contact us, or otherwise use the Service, we collect:

• Identifiers: Name, email address, phone number, delivery address
• Order Details: Items ordered, customization (base, protein, sauce, spice level, allergens flagged), order history, special instructions
• Payment Information: Tokenized payment method information from Stripe (we do not store your full card number; Stripe stores card data in compliance with PCI-DSS)
• Communications: Messages you send to customer support
• User Content: Reviews, ratings, and feedback you submit

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Device and Connection Data: IP address, browser type, device type, operating system, screen size, language preferences
• Usage Data: Pages viewed, features used, links clicked, time spent, referring URL, search queries within the Service
• Location Data: Approximate location derived from IP address or ZIP code you provide (for nearby-kitchen lookup). We do not collect precise GPS location without your explicit consent.
• Cookies and Similar Technologies: See Section 6 below.

2.3 Information from Third Parties

We may receive information about you from:

• Stripe — Payment status, transaction details, fraud signals
• DoorDash Drive — Courier assignment, delivery status, ETA updates
• Otter or other order-injection partners — Kitchen acceptance and prep status
• Google Maps — Address autocomplete, geocoding (if used)
• Analytics providers — Aggregated usage data
• Fraud prevention services — Risk scoring for suspicious orders

We combine information from these sources with information we collect directly to operate and improve the Service.

3. How We Use Your Information

We use your information to:

• Process and fulfill orders — Route your order to a Partner Kitchen, communicate with you about preparation and delivery status, process payment, handle refunds
• Communicate with you — Send order confirmations, status updates, receipts, and customer service responses
• Improve the Service — Analyze usage patterns, debug errors, test new features, conduct A/B experiments
• Personalize your experience — Remember your default ZIP, last-ordered Partner Kitchen, and recent orders
• Marketing (with your consent) — Send promotional emails and SMS messages where you have opted in. You may opt out at any time.
• Prevent fraud and abuse — Detect suspicious orders, suspected fraud, account abuse, or violations of our Terms of Service
• Comply with legal obligations — Respond to lawful requests, comply with tax and food-safety regulations, enforce our Terms, respond to legal claims
• With your consent — For other purposes disclosed to you and consented to at the time of collection

4. How We Share Your Information

We share your information only as described below. We do not sell your personal information.

4.1 With Partner Kitchens

We share the minimum information needed for your order to be fulfilled, including:

• Your first name (last initial only on the kitchen ticket)
• Your order details
• Delivery address (for delivery orders) or pickup time (for pickup orders)
• Your phone number (for last-mile coordination only)
• Allergen flags you've selected

Partner Kitchens are contractually obligated to use this information solely to fulfill your order and not for any other purpose. They are "service providers" under California law (Cal. Civ. Code § 1798.140(ag)).

4.2 With Couriers (DoorDash Drive)

For delivery orders, we share with the Courier:

• Your name
• Your phone number
• Your delivery address and instructions
• Order pickup location and time

4.3 With Service Providers

We share information with third-party service providers who help us operate the Service, subject to contractual confidentiality and use-limitation obligations:

• Stripe — payment processing
• DoorDash — delivery dispatch and tracking
• Otter — kitchen order routing (where applicable)
• MongoDB Atlas — database hosting
• Vercel — application hosting
• Cloud storage and CDN providers
• Email providers — transactional email delivery
• SMS providers — order status text messages (e.g., Twilio)
• Analytics providers — aggregated usage analysis
• Customer support tools
• Fraud prevention services

4.4 For Legal Reasons

We may disclose your information if we reasonably believe disclosure is necessary to:

• Comply with applicable law, court orders, subpoenas, or government requests
• Investigate and prevent fraud, abuse, or illegal activity
• Protect the rights, property, or safety of Saucy Bowl, our customers, Partner Kitchens, Couriers, or the public
• Enforce our Terms of Service

4.5 In Business Transactions

If Saucy Bowl is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your information may be transferred to the acquirer or successor entity. We will provide notice before your information becomes subject to a different privacy policy.

4.6 With Your Consent

We may share your information for other purposes with your explicit consent at the time of collection.

4.7 What We Do Not Do

We do not:

• Sell your personal information for monetary or other valuable consideration
• Share your personal information for cross-context behavioral advertising
• Allow Partner Kitchens to market to you directly
• Share your information with data brokers

5. Data Retention

We retain your information only as long as needed for the purposes described in this Privacy Policy or as required by law:

• Active customer data — for the duration of your relationship with Saucy Bowl
• Completed orders — typically 7 years for tax and audit purposes (matching our document retention policy)
• Payment records — as required by tax, accounting, and Stripe retention requirements
• Customer support correspondence — typically 3 years
• Marketing preferences — until you opt out, then a suppression record indefinitely
• Anonymized / aggregated data — indefinitely (no longer "personal information")

When information is no longer needed, we delete or anonymize it.

6. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to operate the Service:

6.1 Essential Cookies

Required for the Service to function — for example, remembering your cart contents and selected Partner Kitchen across page navigation. These cookies cannot be disabled without breaking the Service.

6.2 Functional Cookies

Remember your preferences (default ZIP, recent orders).

6.3 Analytics Cookies

Help us understand how the Service is used so we can improve it. Where required by law, we obtain your consent before placing analytics cookies.

6.4 We Do Not Use

We do not use advertising cookies, cross-site tracking, or third-party advertising networks at this time. If we add these in the future, we will update this Privacy Policy and obtain consent where required.

6.5 Browser Controls

Most browsers allow you to refuse or delete cookies. Disabling essential cookies will prevent the Service from working correctly.

6.6 Do Not Track

We do not currently respond to "Do Not Track" browser signals, but we honor the Global Privacy Control (GPC) signal as required by CCPA/CPRA. If your browser sends GPC, we treat it as a request to opt out of any "sale" or "sharing" of your personal information.

7. California Privacy Notice (CCPA / CPRA) [CONFIRM]

If you are a California resident, this section describes your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and how to exercise them.

7.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information about California residents:

7.2 Sources

See Section 2.

7.3 Business and Commercial Purposes

See Section 3.

7.4 Categories of Recipients

See Section 4.

7.5 Sale or Sharing of Personal Information

We do not sell or share your personal information as those terms are defined under CCPA/CPRA. We have not sold or shared your personal information in the past 12 months.

7.6 Your California Rights

You have the following rights:

• Right to Know: Request a copy of the personal information we hold about you, categories collected, sources, purposes, and recipients
• Right to Delete: Request deletion of your personal information, subject to legal retention obligations
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: Although we do not currently sell or share, you may pre-emptively exercise this right. Visit our Do Not Sell or Share My Personal Information page.
• Right to Limit Use of Sensitive Personal Information: We do not currently process sensitive personal information for purposes beyond what is permitted without limitation.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

7.7 How to Exercise Your Rights

To exercise your rights, contact us at:

• Email: [email protected]
• Web form: /legal/data-request (if available)

We will respond within 45 days, with a possible 45-day extension where reasonably necessary.

7.8 Verification

To protect your information, we will verify your identity before processing your request. We may ask you to confirm details we already have on file (such as your most recent order or email address).

7.9 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization (typically a signed permission or power of attorney), and we may contact you to verify the request.

7.10 Shine the Light

California Civil Code § 1798.83 ("Shine the Light") gives California residents the right to request information about disclosures of personal information to third parties for direct marketing purposes. Saucy Bowl does not disclose personal information to third parties for their own direct marketing purposes. To make a Shine the Light request, contact [email protected].

8. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including:

• TLS encryption for data in transit
• Encrypted storage for sensitive data at rest
• Role-based access controls for employees
• Regular security reviews
• PCI-DSS compliance through our payment processor (Stripe)

No security system is impenetrable. If we discover a security breach affecting your information, we will notify you in accordance with applicable law.

9. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from someone under 18, contact us at [email protected] and we will delete it.

For users under 13 specifically (Children's Online Privacy Protection Act), we do not knowingly collect any information.

10. International Users

The Service is intended for use in the United States only. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We do not currently offer service to customers outside the United States.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. Review their privacy policies before sharing your information.

12. Your Choices

• Email marketing: Unsubscribe via any promotional email or contact [email protected]
• SMS marketing: Reply STOP to any text message
• Push notifications: Disable in your device settings
• Cookies: Manage through your browser settings
• Account deletion: Contact [email protected]

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by posting the updated Privacy Policy on the Service with an updated "Last Updated" date and, where appropriate, by sending an email notice. Material changes affecting your California rights become effective only after we have provided notice and any required opt-in.

14. Contact Us

Privacy questions or requests:

Saucy Bowl, LLC Attn: Privacy Officer 4039 Reecer Dr, Rocklin, CA 95677 Email: [email protected]

For general inquiries: [email protected]

Open Items for Counsel [CONFIRM]

1. Sub-processor list accuracy — confirm exact list at launch; some may not be in use yet (Twilio, Vercel, etc.)
2. Sensitive PI determination — confirm we are not collecting "sensitive personal information" as defined under CPRA (e.g., precise geolocation, government ID, financial account info, race/religion/sexual orientation/etc.). Stripe holds payment data; if we ever hold it directly the analysis changes.
3. Data retention periods — verify 7-year financial / 3-year support are appropriate
4. California Shine the Light — confirm we don't disclose to third parties for their direct marketing
5. CCPA verification mechanics — confirm exact verification flow at /legal/data-request
6. GPC honoring — confirm we implement GPC signal handling (currently advertising-related "sale/share" is none, so GPC is a no-op, but if we ever add analytics tracking to CDPs this matters)
7. Mailing address — required for CCPA notice validity
8. Privacy Officer designation — internal role assignment; "[email protected]" email needs to be live
9. International transfer language — currently US-only; if EU expansion is on roadmap, add Standard Contractual Clauses provisions
10. Other state privacy laws — Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana, Tennessee — confirm whether multi-state coverage section needed given which states you ship to