Privacy Policy

We collect information in three ways: information you provide to us directly, information collected automatically when you use the Services, and information received from third parties (such as Google when you use Google sign-in). The categories below also identify the corresponding categories of "personal information" under the CCPA/CPRA.

1.1 Information You Provide Directly

• Account Information: name, email address, phone number, and a securely hashed password when you create an account, sign in, or use Google sign-in. (CCPA categories: identifiers.)
• Order and Profile Information: order history, saved favorites, delivery addresses, reservation and event booking details, product reviews, and shopping cart contents. (CCPA categories: identifiers; commercial information.)
• Payment Information: when you pay online, your payment card details are collected and processed directly by our PCI-DSS compliant payment processors (Stripe and/or Clover). We never receive or store your full card number, CVV, or card expiration date on our servers; we receive only a payment confirmation token, the card brand, and the last four digits for receipt purposes. (CCPA categories: commercial information.)
• Communications: the contents of messages you send us through contact forms, reviews, email, or text, along with your contact details. (CCPA categories: identifiers; other information you choose to provide.)

1.2 Information Collected Automatically

• Device and Usage Information: IP address, browser and app type and version, operating system, device identifiers, pages and screens viewed, time and duration of visits, referring URLs, and crash and diagnostic data. We use this information to secure the Services, diagnose problems, and improve performance. (CCPA categories: identifiers; internet or other electronic network activity information.)
• Approximate Location: we may infer your general (city-level) location from your IP address to confirm we can serve your area. (CCPA categories: geolocation data.)
• Precise Location (optional, with your consent): if you grant the location permission in our mobile app, we collect your device's precise location only while you are actively using the app, solely to pre-fill your delivery address and display live order tracking. We do not collect location in the background, and we do not use your precise location for advertising. You can withdraw this permission at any time in your device settings without losing access to core ordering features. (CCPA categories: precise geolocation data, which is "sensitive personal information" under the CPRA.)
• Cookies and Local Storage: small data files used to keep you signed in, remember your cart and preferences, and understand how visitors use the Services. See Section 5 for details and choices.
• Push Notification Tokens: if you enable push notifications, we store a device notification token (for example, a Firebase Cloud Messaging token) so we can deliver order, delivery, reservation, and account updates and, where you have opted in, promotional offers. (CCPA categories: identifiers.)

1.3 Information from Third Parties

• Google Sign-In: if you sign in with Google, we receive your name, email address, and profile picture from Google, in accordance with your Google account settings.
• Delivery Partners: third-party couriers may share delivery status and completion confirmations with us so we can show you live tracking.

We do not collect Social Security numbers, driver's license numbers, financial account credentials, biometric information, or health information, and we do not engage in profiling that produces legal or similarly significant effects.

We use the personal information we collect for the following business purposes:

• To create and manage your account and authenticate your sign-in.
• To process orders, payments, refunds, reservations, and event bookings.
• To calculate delivery distances and fees, assign our delivery riders or third-party couriers, and provide live order tracking.
• To send transactional communications, such as order confirmations, receipts, and delivery and reservation updates. These messages are necessary to provide the Services and are not marketing.
• To send marketing emails, text messages, and push notifications about offers, promotions, and news, only where you have opted in, and always with a clear way to opt out (see Section 9).
• To respond to your customer service requests, reviews, and contact form messages.
• To monitor, secure, and improve the Services, including debugging, fraud prevention, and analytics about how the Services are used.
• To comply with our legal, tax, and accounting obligations, and to establish, exercise, or defend legal claims.

We do not use your personal information for automated decision-making that produces legal effects, and we do not sell your personal information or share it for cross-context behavioral advertising.

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We disclose personal information only as described below:

• Payment Processors: Stripe and/or Clover receive and process your payment details directly under their own privacy policies and PCI-DSS security standards.
• Delivery Partners: our own delivery riders and, where applicable, third-party delivery providers (such as Uber Direct) receive the information necessary to fulfill and track your delivery: your name, delivery address, phone number, and order contents.
• Map and Geocoding Services: we use Google Maps Platform services to geocode addresses, calculate delivery distance and fees, and display delivery routes. Google's use of this data is governed by the Google Privacy Policy.
• Cloud Hosting and Infrastructure Providers: our website, databases, images, and backups are hosted with reputable cloud infrastructure and content delivery providers under contracts that require them to protect your data and use it only to provide services to us.
• Communications and Analytics Providers: email, SMS, and push notification delivery providers, and analytics tools that help us understand and improve the Services, each bound by confidentiality and data protection obligations.
• Legal Compliance and Safety: we may disclose information when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of Cool Beans, our customers, our staff, or the public.
• Business Transfers: if Cool Beans is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your personal information.

All service providers and contractors that process personal information on our behalf are bound by written contracts that restrict their use of your information to the services they perform for us, consistent with the CCPA/CPRA.

Our Android app may request the following device permissions. Each permission is optional, requested only at the time the related feature is used, and used solely for the purpose stated:

• Location: used only while the app is in use, to pre-fill your delivery address and show live order tracking. We do not access location in the background and do not use it for advertising or to build location profiles.
• Notifications: to alert you about order, delivery, reservation, and account updates, and promotional offers if you opt in.
• Camera / Photos: only if you choose to attach a photo, for example to a product review. We never access your camera or photo library without an action you initiate.

You may revoke any permission at any time through your device settings. Revoking a permission will not prevent you from using the core ordering features of the app.

We use cookies and similar local storage technologies for the following purposes:

• Strictly necessary: keeping you signed in, securing your session, and remembering items in your cart.
• Preferences: remembering settings such as your saved addresses and display preferences.
• Analytics: understanding how visitors use the Services so we can improve them.

You can control or delete cookies through your browser settings. Disabling cookies may limit features such as staying signed in or cart persistence.

Do Not Track: some browsers transmit "Do Not Track" (DNT) signals. Because there is no industry standard for interpreting DNT signals, our Services do not currently respond to them. However, we honor the Global Privacy Control (GPC) signal as a valid opt-out request where required by California law, and we do not engage in cross-site behavioral advertising.

You can delete your Cool Beans account and associated personal information at any time using any of the following methods:

• In the app: go to Account, then Settings, then Delete Account, and confirm. Account deletion is available directly inside the app.
• On the web: visit https://coolingthebeans.com/delete-account and follow the instructions, or sign in and use the account deletion option in your profile settings.
• By request: email info@coolbeanscafe.com or call 727-270-7011 and ask us to delete your account. We will verify your identity before processing the request.

When you delete your account, we delete your profile, saved addresses, favorites, push notification tokens, and marketing preferences. We may retain limited records that we are legally required to keep, such as completed order and payment records needed for tax, accounting, refund, and fraud prevention purposes. Retained records are kept only as long as required by law and are then deleted or de-identified.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy. In general:

• Account and profile information is retained while your account is active and deleted upon account deletion, subject to the legal retention exceptions in Section 6.
• Order, payment, and transaction records are retained for the period required by federal and Florida tax and accounting laws.
• Device, usage, and diagnostic logs are retained for a limited period for security and troubleshooting and are then deleted or aggregated.
• Marketing preferences and opt-out records are retained as long as needed to honor your choices.

The criteria we use to determine retention periods include the duration of our relationship with you, our legal obligations, applicable statutes of limitations, and whether retention is advisable for dispute resolution or fraud prevention.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including password hashing, encryption of data in transit (HTTPS/TLS), role-based access controls, and vendor security requirements. Payment card data is handled exclusively by PCI-DSS compliant processors.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security affecting your unencrypted personal information, we will notify you and the appropriate regulators as required by applicable law, including Florida's Information Protection Act and other state breach notification statutes.

• Marketing emails: every marketing email we send includes an unsubscribe link. We honor opt-out requests promptly, and in any event within 10 business days, as required by the CAN-SPAM Act. You cannot opt out of transactional emails such as receipts.
• Text messages: we send marketing text messages only with your prior express consent, as required by the TCPA. Reply STOP at any time to opt out and HELP for assistance. Message and data rates may apply. Message frequency varies. Consent to receive marketing texts is not a condition of purchase.
• Push notifications: you can turn off push notifications at any time in your device settings or in the app's notification preferences.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13, consistent with COPPA. If you believe a child under 13 has provided us with personal information, please contact us using the details in Section 14 and we will promptly delete it. We also do not knowingly sell or share the personal information of consumers under 16.

Depending on your state of residence, you may have some or all of the following rights regarding your personal information. We extend the rights below to all of our U.S. customers regardless of state:

• Right to Know / Access: request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties to whom we disclose it.
• Right to Delete: request deletion of the personal information we have collected from you, subject to legal exceptions (see Section 6).
• Right to Correct: request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: we do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. If our practices ever change, we will update this policy and provide a "Do Not Sell or Share My Personal Information" mechanism first.
• Right to Limit Use of Sensitive Personal Information: the only sensitive personal information we collect is optional precise location, which we use solely to provide the delivery features you request. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit under the CPRA.
• Right to Non-Discrimination: we will never deny you services, charge you different prices, or provide a different level of quality because you exercised any of your privacy rights.

How to Exercise Your Rights

You or your authorized agent may submit a request by emailing info@coolbeanscafe.com, calling 727-270-7011, or writing to the address in Section 14. To protect your information, we will verify your identity by matching the information you provide (such as your name, email address, and recent order details) against our records. An authorized agent must provide proof of your written authorization, and we may still require you to verify your identity directly.

We will confirm receipt of your request within 10 business days and respond within 45 calendar days. If we need more time (up to an additional 45 days), we will let you know the reason and the extension period in writing. We will not charge a fee to process a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

California "Shine the Light"

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Residents of Other States

Residents of states with comprehensive privacy laws, including Florida, Virginia, Colorado, Connecticut, Texas, and others, may have similar rights of access, correction, deletion, and portability, and the right to appeal a refusal to act on a request. To appeal a decision we have made about your request, reply to our response or contact us using the details in Section 14, and we will respond as required by your state's law.

The Services may contain links to third-party websites and services, such as social media pages, map directions, or delivery partner tracking pages. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policy of every site or service you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will revise the "Last Updated" date at the top of this policy and post the updated version on this page. If we make material changes, we will provide more prominent notice, such as an in-app notice or an email to registered users, before the changes take effect. Your continued use of the Services after the effective date of a revised policy constitutes your acceptance of it.

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at: