1. INTRODUCTION & SCOPE

‍

This Privacy Policy explains how Table22, Inc. (“Table22,” “we,” “us”) collects, uses, discloses, and protects personal information when you use our websites, apps, and services (the “Services”), through which independent businesses (“Merchants”) sell products and subscriptions to you. It applies to Buyers and visitors in the United States. It does not cover Merchants’ own data practices, or third-party sites we link to.

‍

2. PERSONAL INFORMATION WE COLLECT

‍

We collect the following categories of personal information (using the categories defined under California law). Whether a category is “sold” or “shared” refers to the use of advertising technologies described in Section 5 and 7.

‍

CategoryExamplesCollectedSold/Shared for adsIdentifiersName, email, phone, postal address, account ID, IP address, device identifiersYesYes (including online identifiers and hashed email addresses used for advertising matching)Customer recordsBilling/contact details; payment information (card data is handled by our payment processor, currently Stripe, and is not stored by us)YesNoCommercial informationOrders, subscriptions, purchase and delivery history, preferencesYesYes (in part, via ads)Internet/online activityPages viewed, clicks, interactions, and similar data collected via cookies and pixelsYesYesGeolocationApproximate location and delivery addressYesNoInferencesPreferences and characteristics derived from the aboveYesYes (for ads)Sensitive PIAccount login credentials; precise geolocation only if you enable itLimitedNo

‍

We do not knowingly collect Social Security numbers or biometric data, and we do not knowingly collect personal information from children (see Section 13). If you enter dietary restriction, allergen, or similar information in a field we provide for that purpose (for example, in connection with an order or subscription), we use that information only to fulfill and support your orders and to communicate with you and the relevant Merchant about them. We do not use the information you enter in these fields for targeted advertising and do not sell or share it, we configure our advertising and session-replay technologies to exclude these fields, and we treat this information as sensitive where applicable law so requires. Separately, as described in Sections 5 and 7, our advertising partners may receive information about the products you view or purchase (which may include product names and descriptions); if you prefer not to have this information used for advertising, you may opt out at any time as described in Section 10. We use sensitive personal information only for permitted business purposes and do not use it to infer characteristics or for targeted advertising.

‍

3. SOURCES OF PERSONAL INFORMATION

‍

We collect information: (a) directly from you (account, orders, communications); (b) automatically from your device (cookies, pixels, analytics); (c) from Merchants you transact with; (d) from our payment processor and delivery providers; and (e) from advertising and analytics partners.

‍

4. HOW WE USE PERSONAL INFORMATION

‍

We use personal information to: provide and operate the Services; process and fulfill orders, subscriptions, payments, and deliveries; provide customer support; communicate with you (including service messages, marketing emails, and — with your opt-in — text messages); personalize and improve the Services; conduct analytics and measure and serve advertising; prevent fraud and secure the Services; verify age for age-restricted products; and comply with law.

‍

5. COOKIES, ANALYTICS & ADVERTISING TECHNOLOGIES

‍

5.1 Cookies and pixels. We and our partners use cookies, pixels, tags, SDKs, and similar technologies to operate the Services, remember preferences, measure performance, and deliver and measure advertising. Some of these are placed by third parties (such as analytics and advertising providers, including major social and search advertising platforms). We also use session-recording and replay analytics technologies that capture how you interact with the Services (such as clicks, scrolls, mouse movements, pages viewed, and similar usage information) to understand how the Services are used, diagnose problems, and improve the Services. These tools are configured to mask payment fields and other sensitive inputs.

‍

5.2 Targeted advertising / retargeting. These technologies allow us and our advertising partners to show you ads on other sites and apps based on your activity (often called targeted, interest-based, or cross-context behavioral advertising). This includes “matched audience” advertising, in which we share hashed identifiers (such as a hashed email address) with advertising platforms to reach our customers, or audiences similar to them, on those platforms. Under several state laws this constitutes “sharing” and/or “selling” of personal information.

‍

5.3 Your controls. You can opt out of advertising cookies through our “Your Privacy Choices” control, your browser or device settings, and industry tools (such as the DAA WebChoices and NAI opt-out pages). We honor Global Privacy Control (GPC) and similar recognized opt-out preference signals as a request to opt out of sale/sharing for the browser or device on which they are enabled. See Sections 7 and 10.

‍

6. HOW WE DISCLOSE PERSONAL INFORMATION

‍

We disclose personal information to: (a) Merchants you purchase from, to fulfill and support your orders and (subject to your choices) for their own marketing — once disclosed, the Merchant is an independent recipient of that information, and its use is governed by the Merchant’s own privacy practices and policies; (b) service providers and processors that perform services for us (hosting, payment processing (currently Stripe), delivery, analytics, communications, fraud prevention) under contracts limiting their use of the information; (c) advertising and analytics partners as described in Section 5; (d) authorities or others when required by law or to protect rights, safety, and the integrity of the Services; and (e) parties to a merger, financing, acquisition, or sale of assets.

‍

7. SELLING & SHARING OF PERSONAL INFORMATION

‍

7.1 We sell/share for advertising. Because we use the advertising technologies described in Section 5, we “sell” and/or “share” certain categories of personal information — specifically identifiers (including online identifiers and hashed email addresses), internet/online activity, commercial information, and inferences — with advertising and analytics partners for targeted advertising and measurement. We do not sell or share this information in exchange for money; the exchange is the use of these technologies.

‍

7.2 What we do not sell/share. We do not sell or share sensitive personal information for targeted advertising, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

‍

7.3 How to opt out. You can opt out of this sale/sharing at any time using the methods in Section 10, including our “Your Privacy Choices” control and GPC.

‍

8. YOUR PRIVACY RIGHTS

‍

Depending on your state of residence, you may have the right to:

‍

(a) know and access the personal information we have collected about you, and obtain a portable copy;

‍

(b) correct inaccurate personal information;

‍

(c) delete personal information, subject to legal exceptions;

‍

(d) opt out of the sale or sharing of personal information and of targeted advertising;

‍

(e) limit the use and disclosure of sensitive personal information;

‍

(f) opt out of certain profiling, where applicable; and

‍

(g) not receive discriminatory treatment for exercising your rights.

‍

9. HOW TO EXERCISE YOUR RIGHTS

‍

9.1 Submitting a request. Submit access, correction, or deletion requests by emailing yum@table22.com. We will verify your identity before responding, generally by confirming information associated with your account.

‍

9.2 Authorized agents. You may use an authorized agent to submit a request on your behalf, with proof of authorization and, where required, verification of your identity.

‍

9.3 Timing and appeals. We respond within the timeframes required by applicable law. In states that provide an appeal right (such as Virginia, Colorado, and Connecticut), you may appeal a decision by contacting us at yum@table22.com; if your appeal is denied, you may contact your state attorney general.

‍

10. YOUR PRIVACY CHOICES (OPT-OUTS)

‍

10.1 Do Not Sell or Share / targeted advertising. Email us at yum@table22.com with the subject “Your Privacy Choices” to opt out of sale/sharing and targeted advertising. We honor Global Privacy Control (GPC) signals.

‍

10.2 Marketing emails. Use the unsubscribe link in any marketing email.

‍

10.3 Text messages. Reply STOP to any marketing text to opt out, or HELP for help.

‍

10.4 Cookies. Manage cookies through your browser or device settings.

‍

11. DATA RETENTION

‍

We retain personal information for as long as needed to provide the Services, maintain your account and order history, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it.

‍

12. DATA SECURITY

‍

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No system is completely secure, and we cannot guarantee absolute security.

‍

13. CHILDREN’S PRIVACY

‍

The Services are intended for adults (18+; 21+ for alcohol) and are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 for sale/sharing). If you believe a child has provided us personal information, contact us and we will delete it.

‍

14. THIRD-PARTY LINKS & SERVICES

‍

The Services may link to or integrate third-party services (including Merchants, payment processing, mapping, and advertising). Their use of your information is governed by their own privacy policies, for which we are not responsible.

‍

15. WHERE WE PROCESS DATA

‍

We process personal information in the United States. If you access the Services from outside the United States, you understand your information will be processed in the United States.

‍

16. STATE-SPECIFIC NOTICES

‍

16.1 California. California residents have the rights described above under the CCPA/CPRA, including the right to opt out of sale/sharing and to limit sensitive personal information. California’s “Shine the Light” law: you may request information about disclosures to third parties for their direct marketing; we do not make such disclosures, or you may opt out via Section 10. If we offer a program that provides a discount, credit, or other benefit in exchange for providing personal information (for example, a signup or referral offer), we will provide any required notice of financial incentive at the point of signup, participation is voluntary, and you may withdraw at any time.

‍

16.2 Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Minnesota, Delaware, New Hampshire, New Jersey, Nebraska, Iowa, Tennessee, Indiana, Kentucky, Rhode Island, Maryland, and other states with comprehensive privacy laws have rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling, as described above, subject to each state’s law and exceptions. Oregon residents may also request a list of the specific third parties to which we have disclosed personal information. Maryland residents: we do not sell sensitive personal information, and we collect and use personal information only as reasonably necessary to provide the Services you request, consistent with Maryland law. Washington and Nevada residents: to the extent we process consumer health data (such as dietary or allergen information you enter in fields we provide for that purpose), we process it only to fulfill and support your orders as described in Section 2, we exclude those fields from our advertising and session-replay technologies, and we do not sell consumer health data or share it for targeted advertising.

‍

17. CHANGES TO THIS POLICY

‍

We may update this Privacy Policy from time to time. We will post the updated policy with a new effective date and, where required, provide additional notice.

‍

18. CONTACT US

‍

18.1 Contact. Questions or privacy requests: yum@table22.com, or Table22, Inc., 169 Madison Ave STE 11550, New York, NY 10016.

‍

18.2 Governing law. This Policy and our privacy practices are governed by the laws of the State of New York, except where the law of your state of residence applies to your statutory privacy rights.

‍

18.3 California complaints. Under California Civil Code §1789.3, California users may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by phone at (800) 952-5210.