1 Information We Collect

Information You Provide Directly

• Account registration name, email address, phone number, and password when you create an account on our website
• Online orders your name, phone, email, and payment details when you place a pickup order
• Table reservations name, phone number, party size, and preferred date and time
• Catering and event inquiries contact details, event type, estimated guest count, and preferred date submitted via our inquiry form
• Contact messages any messages you send through our contact form
• Dish ratings and reviews if you rate a dish in our app, we store your star rating and any comment. Published reviews display your first name only, and you can edit or delete your review in the app at any time
• Push notification tokens if you allow notifications in our app, we store a random device identifier issued by Apple or Google so we can send you order updates and occasional offers
• Device location (app only, optional) if you allow location access, the app uses your device location solely to show your nearest Spices location and sort our restaurants by distance. This is processed on your device; we do not track your movements or keep a history of your location, and the app works fully without it
• Favorites dishes you mark with a heart, so they stay in sync between the app and website
• Reviews star ratings and written feedback you submit about your experience
• Job applications name, contact information, and any details you include when applying for a position
• Newsletter signup your email address when you subscribe to our newsletter
• Giveaway entries your name, email address, and phone number when you enter our weekly gift card giveaway. This is used only to run the giveaway and notify winners, is kept separate from our newsletter and marketing lists, and is not sold. Winners may be announced by first name on our Facebook page. See our Official Giveaway Rules

Information Collected Automatically

• Your IP address and approximate location (city or region level only)
• Browser type, device type, and operating system
• Pages you visit on our site and time spent on each page
• Cart contents and your preferred ordering location (stored locally on your device)

2 How We Use Your Information

We only use your information for legitimate purposes related to operating our restaurant. Specifically:

1. Process and fulfill your online orders and send confirmation emails
2. Manage your customer account, rewards points balance, and order history
3. Handle your table reservation and send reminders
4. Respond to catering inquiries and event booking requests
5. Process gift card purchases and track redemptions
6. Administer our weekly gift card giveaway and contact winners
7. Send promotional emails and newsletters only if you opt in
8. Respond to your messages and customer service requests
9. Send you order status notifications (such as when your order is confirmed or ready) and, if enabled, occasional news about specials or rewards. You can turn notifications off anytime in your phone settings
10. Review and process job applications
11. Improve our website, menu, and overall service
12. Detect and prevent fraudulent activity on our platform
13. Comply with legal and financial obligations

3 Who We Share Information With

We share your information only with the following trusted parties, and only to the extent necessary to provide our services:

• Clover (Payment Processing) processes your card payments securely. We do not store full card numbers on our servers. Clover is PCI-DSS compliant.
• Uber Eats (Delivery) when you choose delivery, your name, phone, and delivery address are passed to Uber Eats to fulfill your order.
• Mailchimp (Email Marketing) if you subscribe to our newsletter, your name and email are stored in our Mailchimp audience. You can unsubscribe at any time.
• Legal authorities we may disclose information when required by law, court order, or to protect the safety and rights of our business or customers.
• Business transfers in the unlikely event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• Notification delivery Expo, Apple, and Google receive your device token and the message content in order to deliver push notifications to your phone

We do not share your information with advertisers, data brokers, or any other third parties beyond those listed above.

4 Data Security

We have implemented the following measures to protect your personal information:

• HTTPS encryption all data transmitted between your browser and our website is encrypted via SSL/TLS
• Password hashing your account password is hashed using a secure algorithm and never stored in plain text
• CSRF protection all forms on our website use CSRF tokens to prevent unauthorized submissions
• PCI-compliant payments card payments are handled entirely by Clover and we never see or store your full card number
• Restricted admin access our admin panel requires authentication and restricts access based on staff role

While we take reasonable steps to protect your data, no internet transmission is completely risk-free. We encourage you to use a strong and unique password for your account.

5 Cookies and Tracking

Our website uses cookies and browser local storage for the following purposes:

• Session cookies keep you logged into your account while you browse
• Cart storage your cart items and selected location are saved in your browser’s local storage so they persist between visits
• Security tokens CSRF tokens to protect form submissions
• Analytics we may use Google Analytics to understand how visitors use our site. This data is aggregated and does not identify you personally.

You can disable cookies in your browser settings. Note that disabling cookies will prevent you from staying logged in and may affect cart functionality. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Add-on.

Our mobile app does not track you. The Spices app contains no third-party advertising networks and no cross-app tracking. We do not track you across other companies’ apps or websites, and we do not sell or share your information for advertising purposes.

6 Your Privacy Rights

You have the following rights regarding your personal information:

• Access request a copy of the personal information we hold about you
• Correction update or correct inaccurate information in your account at any time
• Deletion request that we delete your account and associated personal data
• Opt-out of marketing unsubscribe from our newsletter at any time using the unsubscribe link in any email we send
• Data portability request your data in a readable format
• Delete your account in the app open your profile in The Spices app and choose Delete Account to permanently remove your account, or contact us and we will do it for you

7 Data Retention

We retain your information only for as long as necessary:

• Account information retained while your account is active and deleted within a reasonable period upon request
• Order history retained for up to 3 years for business records and legal compliance
• Payment records retained as required by applicable financial regulations
• Job applications retained for up to 6 months and deleted sooner upon request
• Newsletter subscribers removed from Mailchimp promptly upon unsubscribe
• Contact messages retained until resolved and for a short period thereafter
• Push notification tokens retained while notifications remain enabled on your device; tokens naturally expire when you disable notifications, delete the app, or change devices

8 Children’s Privacy

Our website, mobile app, and online ordering services are not directed toward children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted personal information through our website, please contact us immediately and we will delete it promptly.

9 Changes to This Policy

We may update this Privacy Policy from time to time as our services evolve or legal requirements change. When we make updates, we will revise the Last Updated date at the top of this page. We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

10 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at any of our six Wisconsin locations: