Privacy Policy

2. Information We Collect

We may collect the following categories of information:

• Account Information: name, email address, and mobile phone number.
• Order Information: items ordered, payment method, and pickup or delivery details.
• Loyalty Information: points, rewards activity, and preferences.
• Payment Data: processed by Stripe. We do not store card details.
• Location Data: approximate location, inferred from your IP address or, with your consent, your device, to support pickup and delivery.
• Device & Usage Data: IP address, browser and device type, app version, and usage logs.
• Communications: emails, texts, or in-app messages you send or receive through the Services.
• Cookies & Tracking Data: used to operate, secure, and analyze the Services.

Personal information does not include information that is publicly available, aggregated, anonymized, or de-identified.

Data Retention: We retain your information only as long as necessary for the purposes described in this Policy, subject to the following schedules:

• Order and transaction data: retained for approximately 7 years from the date of the transaction to support dispute resolution, tax compliance, and legal obligations.
• Account data: retained while your account is active. Following account closure or a verified deletion request, it is deleted or anonymized within 90 days, except where a longer period is required by law.
• SMS consent and opt-out records: retained for approximately 4 years.
• Communications and support records: retained for 2 years.
• Cookies and usage data: retained for up to 13 months.

Any transaction records we retain for legal or tax purposes are kept as financial records only and are not used to contact or market to you. Payment records are held by Stripe and retained under Stripe's own legal obligations and retention policy, which we do not control. Data that is no longer required will be securely deleted or anonymized.

3. How We Use Information

We use information to:

• Process and fulfill your orders.
• Provide customer support.
• Operate our loyalty and rewards programs.
• Facilitate payments.
• Improve and personalize the Services.
• Verify your identity, including one-time passcodes sent by text.
• Send transactional updates such as order confirmations and security alerts.
• Send marketing communications by email, with your consent where required by applicable law.
• Detect fraud, enforce our terms, and comply with legal obligations.

We do not use personal information for cross-context behavioral advertising, targeted advertising, or automated decision-making that produces legal effects on individuals.

4. How We Share Information

We do not sell your personal information, and we do not share it for targeted advertising. We may share information with:

• Stripe: to process payments. Your card and payment details are collected and handled by Stripe on Stripe's own PCI-compliant systems, and we do not store your full card number. Stripe processes this information under its own Privacy Policy (stripe.com/privacy), and for some features, such as optional saved-payment services, Stripe acts as an independent controller of that data.
• Service Providers: including the technology platform, hosting, SMS delivery, analytics, and customer support tools, who process data on our behalf under contractual data protection obligations and only to provide services to us.
• Order Fulfillment: order details, including name, contact, instructions, and, for delivery, address, go to the location and any delivery provider fulfilling your order.
• Legal Authorities: when required by law, legal process, or to protect the rights and safety of Nashville Coop and its users.
• Business Transfers: in connection with a merger, financing, or sale of assets, subject to this Policy.

We may use and disclose, without restriction, de-identified, aggregated, or anonymized information that does not identify any individual.

Your information is used only for Nashville Coop. It is not reused, shared, or repurposed for any other brand or business. If our practices ever change, we will provide a clear opt-out mechanism and advance notice before doing so.

5. Privacy Rights

Depending on your state of residence, and where required by applicable law, you may have the right to:

• Access or receive a copy of the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information, subject to legal retention obligations.
• Opt out of the sale of personal information, targeted advertising, and certain profiling.
• Appeal a decision if we deny your privacy rights request.

We do not sell personal data, share it for targeted advertising, or engage in profiling that produces legal or similarly significant effects.

To submit a privacy rights request, email kamal@nashvillecoop.com. We will verify your identity using account information and respond within the timeframe required by applicable law (generally 45 days, with a possible 45-day extension). If we deny a request, you may appeal by email to the same address. Minnesota residents may also file a complaint with the Minnesota Attorney General's Office.

We will not discriminate against you for exercising any privacy rights available to you under applicable law.

6. California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended:

• Right to Know: the categories and specific pieces of personal information we have collected, the sources, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: deletion of personal information we collected from you, subject to exceptions.
• Right to Correct: correction of inaccurate personal information.
• Right to Opt Out: we do not sell or share personal information, so there is nothing to opt out of.
• Right to Limit Sensitive Data Use: we do not use sensitive personal information for purposes that require a right to limit.
• Right to Non-Discrimination: we will not discriminate against you for exercising these rights.

To exercise any of these rights, email kamal@nashvillecoop.com. We do not knowingly sell or share the personal information of California residents under 16.

7. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect, use, or share personal information from anyone under 13. If we discover that we have inadvertently collected information from a child under 13, we will promptly delete it.

If you are a resident of Colorado, Delaware, or Montana and under 18, or a resident of New Jersey and under 17, and we become aware of your age, we will either delete your personal data or seek affirmative consent from your parent or guardian before processing it.

If you believe we have collected information from a minor, please contact us at kamal@nashvillecoop.com.

8. Communications & SMS

We use text messages for account, security, and order purposes only. We do not send marketing or promotional text messages. Promotions, if you opt in, are sent by email.

Account & Security Messages: when you create or sign in to your account, we send a one-time passcode by text to verify it is you. By providing your number and using the Services, you consent to these account and security messages. They are required to use the Services.

Order Messages: we may text you about the status of your orders, such as confirmation, ready for pickup, and delivery updates.

For all text messages, frequency varies, and message and data rates may apply. Reply STOP to opt out and HELP for help, or contact us using the information in Section 14. Carriers are not liable for delayed or undelivered messages.

We will not sell, rent, or share your mobile number, your SMS opt-in information, or your consent with third parties or affiliates for their own marketing or promotional purposes. We share your number only with the service providers that help us deliver these messages to you, and only for that purpose. Your consent to receive messages from Nashville Coop applies to Nashville Coop only and does not extend to any other brand or business.

You may opt out of promotional emails at any time using the "unsubscribe" link or by contacting us. Opting out of promotional emails does not stop account-related or order-related messages.

9. Cookies & Tracking

We use cookies and similar technologies for login, security, and analytics, including Google Analytics 4 (GA4). When you use the Services, certain usage data may be shared with Google for analytics purposes, where Google acts as our service provider.

On your first visit, you will be presented with a consent banner before any analytics tracking is activated. If you decline, analytics operates in cookieless mode and does not collect or share your personal information with Google. If you accept, standard analytics tracking is enabled to help us improve the Services. You may change your consent preference at any time through the Services settings.

We automatically detect and honor Global Privacy Control (GPC) browser signals as a valid opt-out of the sharing of your personal information. No additional action is required if your browser has GPC enabled.

You can also adjust your browser settings to disable cookies at any time, though some features may not function correctly. For more information on how Google processes data, visit policies.google.com/privacy.

10. Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including encryption in transit and at rest, access controls, and monitoring. While no system is fully secure, we take meaningful steps to reduce the risk of unauthorized access, loss, or misuse. You are responsible for keeping your account password confidential.

In the event of a data breach affecting your personal information, we will notify you as required by applicable state law.

11. International Users

The Services are intended for users located in the United States. If you access the Services from outside the United States, your data may be transferred to and stored in the U.S. We will apply appropriate safeguards as required by applicable law for such transfers.

12. Loyalty Programs & Financial Incentives

Participation in our loyalty and rewards programs is voluntary and governed by the program's terms. We do not sell information collected through these programs. We do not currently offer any other financial incentive in exchange for your personal information. If we do in the future, we will provide a separate notice with the material terms and obtain your opt-in consent first.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. Material changes will be communicated by posting a notice in the app or on our website with an updated effective date. Your continued use of the Services after any update constitutes your acceptance of the revised Policy.