Privacy Policy

1. Information we collect

We collect information you provide, information generated when you use the Services, and information received from partners that help us operate the Services.

We may derive approximate city or region from an IP address and infer likely preferences from how you interact with the Services. We do not intend to collect precise geolocation unless a feature clearly asks for it and you grant permission. The bakery map and the “where” step ask for device location only if you choose that option.

The current pilot does not intentionally collect government identifiers, health data, or payment-card details. A bread request, Fresh Alert, or waitlist signup is not a confirmed order and does not take payment.

2. Sources of personal information

• Directly from you, including through signup, search, request, feedback, and support forms.
• Automatically from your device, through server logs, cookies, and similar technologies used to deliver, secure, diagnose, and understand the Services.
• From bakeries, couriers, and service providers, such as request status, availability, delivery status, fraud signals, and support outcomes.
• From public or licensed sources, such as publicly available bakery information, where permitted by law.

3. How we use personal information

We use personal information for the following business and commercial purposes:

• Provide and personalize the Services. Show relevant bakeries and breads, remember choices, route a request, coordinate pickup or delivery, and communicate status.
• Operate the pilot. Assess demand by area and bread preference, invite eligible participants, manage waitlists, and improve coverage.
• Communicate. Send service notices, answer questions, request feedback, and, with any consent required by law, send promotional messages. You can unsubscribe from marketing email using the link in the message.
• Improve and develop. Analyze performance and usage, test features, troubleshoot errors, conduct research, and develop new products. Where practical, we use aggregated or de-identified information for these purposes.
• Protect people and the Services. Prevent fraud, abuse, security incidents, and prohibited conduct; verify requests; enforce our Terms of Use; and protect rights, safety, and property.
• Comply with law and run the business. Maintain records, respond to lawful process, exercise or defend legal claims, complete audits, and support a corporate transaction.

4. Legal bases outside the United States

If law requires us to identify a legal basis, we rely on performance of a contract or steps you ask us to take before a contract, our legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where required. You may withdraw consent at any time, without affecting prior lawful processing.

Current pilot. Submitting interest or a request does not guarantee service, availability, or fulfillment. We may use aggregate pilot trends to decide where and how to launch, but should not needlessly expose individual responses in partner reporting.

5. How we disclose personal information

We may disclose personal information to the following recipients:

• Bakeries and fulfillment partners. We may send the details needed to evaluate, confirm, prepare, fulfill, or support a request. A bakery or courier may process that information under its own privacy policy when acting independently. During this pilot, request details are reviewed by Bread2Door and are not automatically sent to a bakery as a paid order.
• Service providers and contractors. Hosting, security, analytics, mapping, communications, customer support, payment, professional-adviser, and other vendors may process information for us under contractual restrictions.
• Legal, safety, and integrity recipients. We may disclose information if we reasonably believe it is necessary to comply with law or legal process; investigate fraud, abuse, or a security incident; enforce agreements; or protect rights, safety, or property.
• Business transaction recipients. Information may be disclosed during due diligence or transferred as part of a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.
• At your direction or with your consent. For example, when you ask us to send a request to a selected bakery or connect you with another service.

In the current pilot, service providers include the host that runs the website, object storage for catalog photos, Resend to deliver email we send, PostHog for product analytics when a project key is configured, Leaflet and OpenStreetMap tile servers for the bakery map, and Google Fonts when your browser loads the site’s typefaces. We do not use advertising pixels, retargeting tags, or data-broker enrichment.

6. Sale, sharing, and targeted advertising

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising, as those terms are defined by California law, unless we clearly disclose that practice, provide legally required choices, and update this Policy before doing so.

If Bread2Door later uses advertising cookies or pixels that constitute “selling,” “sharing,” or targeted advertising under applicable law, we will provide a “Your Privacy Choices” mechanism and honor legally recognized opt-out preference signals, including Global Privacy Control, where required.

7. Aggregated and de-identified information

We may create and use information that is aggregated or de-identified so that it cannot reasonably be linked to you. We will maintain de-identified information in de-identified form and will not attempt to re-identify it except to test whether our de-identification methods work, as permitted by law.

8. Cookies and similar technologies

Cookies are small files placed on a browser or device. We may use:

• Strictly necessary technologies to deliver requested features, remember security or privacy settings, balance traffic, and prevent abuse.
• Functional technologies to remember selections and improve convenience.
• Analytics technologies to understand traffic, performance, and feature use.

Technologies used on the current site:

• Essential. An antiforgery cookie protects forms. A visitor cookie named b2d_vid associates Fresh Alerts and demand counts with a browser without requiring an account. Signed-in operators receive an authentication cookie.
• Functional. Cookies named b2d_alert_email and b2d_alert_phone reopen your Fresh Alerts. The on-site basket preview, which does not take payment, is stored in session storage on your device.
• Analytics. When PostHog is configured, it uses a cookie and local storage to measure feature use. It is not used for cross-context advertising. Local development can run without it.
• Maps and fonts. Opening a bakery map loads Leaflet and OpenStreetMap tiles. Loading the site may request fonts from Google. Those providers receive the technical data their services need, such as an IP address.

You can control cookies through browser settings and any consent tool we provide. Blocking some technologies may affect functionality. We do not respond to “Do Not Track” signals, which are not standardized, but we honor legally required opt-out preference signals as described above.

9. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, manage a pilot or request, maintain security, comply with law, resolve disputes, and enforce agreements. Retention depends on the type of information, the sensitivity and risk, the length of our relationship, operational needs, applicable limitation periods, and legal requirements.

When information is no longer needed, we delete or de-identify it. Residual copies may remain for a limited period in backups or where deletion is not reasonably possible, and will remain protected and isolated from routine use.

Pilot signups, bread requests, Fresh Alerts, bakery waitlist entries, bakery claim requests, and the policy-acceptance record for each submission are kept so we can operate the pilot, honor a privacy request, and show which policy version you accepted. Operators can delete a signup or waitlist entry from the admin inbox.

10. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No system is completely secure, and we cannot guarantee absolute security. You are responsible for using a secure device and promptly telling us if you suspect unauthorized activity involving the Services.

11. Data location and international transfer

Bread2Door and its providers may process information in the United States and other countries where privacy laws may differ. Where required, we use recognized safeguards for cross-border transfers. By using the Services from outside the United States, you understand that information may be transferred to and processed in the United States.

12. Your choices

• Email. Use the unsubscribe link in promotional email. We may still send non-promotional messages about a request, security, or this Policy. The current pilot does not send a separate promotional mailing list.
• Text messages. We do not send promotional texts. If you choose text for a Fresh Alert or bakery waitlist, we may send service texts about that request. Message and data rates may apply. Remove the alert or email us to stop.
• Cookies. Use browser controls and any consent or privacy-choice tool on the site.
• Device permissions. Change permissions, such as location access or notifications, in device or browser settings.
• Requests. Contact us to update information you submitted, withdraw a pending request when possible, or ask a privacy question.

13. Privacy rights

Depending on where you live and subject to exceptions, you may have the right to:

• know or access personal information we hold about you and receive a portable copy;
• correct inaccurate personal information;
• delete personal information;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent or object to or restrict processing; and
• appeal a decision and not receive discriminatory treatment for exercising a right.

To submit a request, email [email protected] with the subject “Privacy Request” and describe the right you wish to exercise. We may need to verify your identity by matching information you provide with information we maintain. We will use verification information only for the request. If we cannot verify a request, we may deny or limit it and explain why where required.

You may use an authorized agent where permitted. We may ask for proof of authorization and may need to verify your identity directly. You may appeal a denial by replying to our decision with “Privacy Appeal.” You may also complain to your local privacy regulator.

14. California notices

California residents may request the categories and specific pieces of personal information collected; the sources, purposes, and recipient categories; correction; deletion; and opt-out of sale or sharing. The categories collected in the preceding 12 months are described in Sections 1 and 2, and disclosures are described in Section 5. We do not use or disclose sensitive personal information to infer characteristics about a person.

California's “Shine the Light” law may permit residents to ask about certain disclosures for direct marketing. Send requests to the contact above.

15. Payment information

The current pilot does not collect payment. If payments are enabled, a payment processor may collect card or bank details directly. Bread2Door should receive only limited transaction information, such as payment status, token, card brand, and last four digits, unless the checkout clearly states otherwise. The processor's privacy policy will govern its independent handling of payment credentials.

16. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 provided personal information, contact us so we can take appropriate action. Users under 18 may use the Services only with the involvement and permission of a parent or legal guardian.

17. Third-party links and services

The Services may link to bakery, mapping, social-media, video, courier, payment, or other third-party services. Bread2Door does not control their privacy or security practices. Review the policies of any third party before providing information to it.

18. Changes to this Policy

We may update this Policy to reflect changes in the Services, technology, law, or our practices. We will post the updated version, change the “Last updated” date, and provide additional notice when required. If a change materially affects how previously collected information is used, we will provide notice and obtain consent where required. Earlier published versions stay available at their dated URL.

19. Contact us

For privacy questions or requests, contact:

Bread2Door
Email: [email protected]
Website: https://bread2door.com