Privacy Policy

Draft for review. This document was prepared as part of the CravePlatter site build and has not been reviewed by counsel. Confirm the entity details, retention periods, insurance limits and governing-law clauses with your lawyer, and the food-safety claims with your local health department, before launch.

CravePlatter Provisions LLC (“CravePlatter”, “we”, “us”) runs the platter builder and the site at craveplatter.com. This notice explains what personal information we collect when you build a board, place an order or talk to the kitchen, why we collect it, how long we keep it, who we share it with, and the rights you have over it. It covers the site, our ordering and delivery operation, our email programme and our support channels.

1. Who is responsible

CravePlatter Provisions LLC, 47 Wythe Avenue, Building C, Brooklyn, NY 11249. Our privacy contact is [email protected], and that address reaches the person who is actually accountable rather than a ticket queue. We are a New York limited liability company and we do not have a designated Data Protection Officer; we are not required to appoint one.

2. What we collect

• Builder data. The guest count, build type, style direction and dietary flags you select in the platter builder, and the estimate that combination produced. Before you send an estimate to us this stays on your device.
• Order data. Your name, delivery address, billing address, phone number, email address, the date and window you asked for, building access notes, and the order history attached to your account or your email address.
• Dietary and allergen data. Allergen restrictions and dietary requirements you tell us about, for the guests you are feeding. We treat this as sensitive because it frequently concerns someone’s health, and we use it only to build and label your order safely.
• Payment data. Handled by our payment processor inside their own hosted frame. We receive the last four digits of the card, the card brand and the authorisation result. We never see or store a full card number.
• Corporate account data. For invoiced accounts: your company name, billing contact, purchase-order references, tax-exemption certificates where applicable, and the certificate-of-insurance requests your building has made.
• Support data. Messages you send the kitchen, and any photographs you attach to a delivery query or a complaint.
• Marketing data. Your email address and subscription status if you opt in, plus whether our emails were opened or clicked.
• Technical data. IP address, browser and device type, screen size, referring page and pages viewed. See the Cookie Policy for the detail.

You can use the builder without an account and without giving us anything. The estimate is computed in your browser; nothing is sent to us until you choose to send it.

3. Why we use it

4. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either, including in the twelve months before the date at the top of this page. We share information only with service providers who need it to run the kitchen, under a written contract that limits them to our instructions:

• Our payment processor, for authorisation, refunds and chargebacks.
• Our hosting, storage and content-delivery providers.
• The email platform that sends order confirmations and, if you opted in, the monthly email.
• Our delivery drivers and, outside the five boroughs, the cold-chain carrier. They receive your name, address, phone number and access notes — never your dietary information beyond a “contains allergen card” flag.
• Our accountants, and our lawyers where a dispute requires it.
• The New York City Department of Health and Mental Hygiene, or an equivalent authority, where a food-safety investigation legally requires disclosure.

5. How long we keep it

6. Your rights

If you are a New York resident, the New York SHIELD Act requires us to protect your private information with reasonable administrative, technical and physical safeguards, which we describe in section 7.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what we have collected and why, to receive a copy of it, to correct it, to delete it, and to limit our use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of, but you may still ask us to confirm that. You may use an authorised agent. We will not discriminate against you for exercising any of these rights — your prices, your delivery window and your service do not change.

Residents of Colorado, Connecticut, Virginia, Texas and other states with comprehensive privacy laws have comparable rights, and we apply the same process to everyone regardless of where they live, because operating two standards is how mistakes happen.

To exercise any right, email [email protected]. We will verify your identity against information we already hold — usually a recent order — and respond within 45 days, extendable once by a further 45 days if the request is complex, in which case we will tell you before the first period runs out.

7. How we protect it

Data is encrypted in transit with TLS and at rest by our hosting provider. Access to order and dietary data is limited to the kitchen, dispatch and support staff who need it, is controlled by named accounts with multi-factor authentication, and is logged. Payment card data never touches our systems. We review access quarterly and on every staff departure.

8. Children

The site is intended for adults placing orders. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to [email protected] and we will delete it.

9. Changes

If we change this notice materially we will post the new version here, change the date at the top, and email subscribers and anyone with an order in the last twelve months at least ten days before it takes effect.