Effective 2026-09-27

1yummyfood.com PRIVACY POLICY

This Privacy Policy explains how 1yummyfood.com (“Platform,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use our website, mobile applications, and related services.

By creating an account, placing an order, registering as a vendor, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

1yummyfood.com operates an online marketplace connecting customers with independent home bakers, artisan cooks, and other food vendors (“Vendors”). We provide the technology, ordering, payment processing, and delivery coordination that sits between customers and Vendors.

Contact for privacy questions:

Email: [email protected]

Website: 1yummyfood.com

2. Information We Collect

2.1. Information you provide directly

• Account information — name, email address, phone number, and password (stored only as a salted hash; we never store plaintext passwords).
• Delivery information — street address, apartment or unit number, city, state, postal code, delivery instructions, and approximate geographic coordinates.
• Vendor information — business name, business address, business type, operating hours, and product listings.
• Vendor compliance documents — cottage food permits, food handler certificates, and similar licensing documents uploaded during vendor onboarding.
• Order content — items ordered, selected options, customization notes, and messages you send to a Vendor through in-app chat.
• Support content — the text, attachments, and metadata of support tickets you open.

2.2. Information collected automatically

• Device and usage data — device type, operating system, browser, app version, and pages or screens viewed.
• Approximate location — derived from your delivery address, or from device location if you grant permission, to calculate delivery distance and fees.
• Log and diagnostic data — IP address, timestamps, and error traces used for security monitoring and debugging.

2.3. Information from third-party sign-in (SSO)

If you choose to create an account or sign in using a third-party identity provider, we receive a limited profile from that provider:

• Google — your name, email address, and profile picture URL.
• Facebook (Meta) — we request the public_profile and email permissions. From these we receive your name, profile picture URL, and the email address associated with your Facebook account.
• Apple — your name and either your email address or Apple's private relay address, depending on the choice you make at sign-in.
• TikTok — we request the user.info.basic scope. From this we receive your display name, avatar URL, and open ID.

We use this information solely to create and authenticate your account and to populate your profile. We do not post to your social accounts, we do not read your contacts or friend lists, and we do not use these providers for advertising.

You may disconnect a third-party sign-in at any time by deleting your account (see Section 9) or by revoking the Platform's access from within that provider's own settings.

3. How We Use Your Information

We use personal information to:

• Create and maintain your account and authenticate sign-in;
• Process, fulfill, and deliver your orders;
• Calculate delivery distance, delivery fees, and estimated arrival times;
• Process payments, refunds, and vendor payouts;
• Send transactional messages about your orders, subscriptions, and account (see Section 5);
• Verify vendor identity, licensing, and compliance documents;
• Provide customer support and respond to tickets;
• Detect, investigate, and prevent fraud, abuse, and policy violations;
• Comply with legal, tax, and regulatory obligations; and
• Improve the Platform's reliability, performance, and features.

4. How We Share Your Information

We do not sell your personal information.

4.1. With Vendors

When you place an order, we share your first name, order contents, customization notes, and — for delivery orders — your delivery address and any delivery instructions with the Vendor fulfilling that order. Vendors need this information to prepare and hand off your order. Vendors are contractually prohibited from using this information to solicit you outside the Platform.

4.2. With delivery personnel

For orders delivered by a Vendor or by an independent third-party driver arranged through the Platform, we share the recipient's first name, delivery address, and a tracking link with that delivery person strictly for the purpose of completing the delivery. A driver's access to order information expires as soon as the delivery reaches a completed or cancelled state.

4.3. With service providers (subprocessors)

We share limited personal information with vendors who process data on our behalf under contract:

• Supabase — application database, authentication, and file storage hosting.
• Stripe, Inc. — payment processing, vendor payouts, and identity/business verification for Vendors. Stripe's handling of your payment data is governed by Stripe's own privacy policy. We never store full card numbers.
• Telnyx — SMS, WhatsApp, and voice delivery for one-time passcodes and delivery notifications.
• Resend — transactional email delivery.
• Google Maps Platform — address autocomplete, geocoding, driving distance, and route estimation.
• EasyPost — shipping rates, label generation, and parcel tracking for shipped orders.
• Google Gemini — automated review of vendor compliance documents for authenticity and expiry extraction.
• Cloudflare — content delivery, DNS, and edge hosting.

Each of these providers is permitted to use your information only to perform services for us.

4.4. For legal and safety reasons

We may disclose information when we reasonably believe it is necessary to comply with a law, regulation, subpoena, or governmental request; to enforce our agreements; or to protect the rights, property, or safety of the Platform, our users, or the public.

4.5. Business transfers

If the Platform is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

5. SMS and Text Messaging

We use SMS for one-time passcodes, order and delivery status updates, and — where you have separately opted in — occasional service announcements.

We do not share mobile numbers collected for SMS consent with third parties or affiliates for marketing purposes. Mobile numbers are shared only with the messaging carriers and service providers strictly necessary to transmit the messages you have consented to receive.

Message and data rates may apply. Message frequency varies. You may reply STOP to any message to cancel and HELP for assistance. Opting out of SMS does not affect your ability to use the Platform, though you may need to receive one-time passcodes by another method.

Delivery drivers who receive a dispatch link are texted a one-time passcode and a tracking link at the direction of the Vendor assigning the delivery. That consent is confirmed by the Vendor at the point the dispatch is created.

6. Cookies and Similar Technologies

We use cookies and local browser storage to keep you signed in, remember your cart between visits, and remember interface preferences such as your selected filters. We do not use third-party advertising or cross-site tracking cookies.

You can clear or block browser storage through your browser settings, though doing so will sign you out and clear your saved cart.

7. Data Retention

We retain personal information for as long as your account is active, and afterwards only as long as needed for the purposes described in this policy or as required by law.

Specific retention windows currently in effect:

• In-app chat messages — deleted 12 months after they are sent.
• Activity and audit logs — deleted 90 days after they are written.
• Order, payment, refund, and payout records — retained for at least 7 years to satisfy tax and financial recordkeeping obligations.

8. Security

We protect personal information using encryption in transit (TLS), encryption at rest, row-level access controls in our database, hashed passwords, and optional two-factor authentication on your account.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any applicable regulator as required by law.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete your personal information (the “right to erasure” under GDPR Art. 17 and the “right to delete” under CCPA § 1798.105);
• Port your personal information to another service;
• Object to or restrict certain processing; and
• Withdraw consent where processing is based on consent.

How to delete your account and data: Open the Customer App, go to Profile → Settings → Delete Account, and confirm. You may also email [email protected] with the subject line “Data Deletion Request.” Full instructions are at 1yummyfood.com/data-deletion.

Deletion requests are queued with a 30-day grace period so a hijacked account can be recovered; you may cancel the request at any time during that window. After the grace period lapses, we permanently remove or irreversibly anonymize your name, email address, phone number, avatar, saved addresses, chat messages, and push subscriptions.

Because tax and financial regulations require us to retain transaction records, order, payment, refund, and payout entries are preserved in anonymized form — detached from your identity — rather than deleted.

Vendors with active subscriptions or unfulfilled orders must resolve those before self-service deletion; contact support and we will coordinate.

We will not discriminate against you for exercising any of these rights.

10. Children's Privacy

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact [email protected] and we will delete it.

11. International Users

The Platform is operated from the United States and our service providers are located primarily in the United States. If you access the Platform from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date above and, for material changes, notify you by email and through an in-app notice before the change takes effect.

13. Contact Us

Questions, requests, or complaints about this Privacy Policy:

1yummyfood.com

Email: [email protected]

Website: 1yummyfood.com