California Privacy Notice

1. Scope of This Notice

This California Privacy Notice supplements the information contained in our main Privacy Policy and applies solely to visitors, users, and others who reside in the State of California ("consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA), and any terms defined in those statutes have the same meaning when used in this notice.

For purposes of this notice, "personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined under California law.

2. Categories of Personal Information Collected

The following table describes the categories of personal information we have collected from consumers within the last twelve months.

3. Sources of Personal Information

We obtain the categories of personal information listed above from the following sources:

• Directly from you. Information you provide when creating an account, placing an order, contacting customer support, or completing forms on our platform.
• Automatically through platform usage. Information collected via cookies, pixel tags, log files, and similar technologies as you navigate and interact with our platform.
• From restaurant partners. Information shared by restaurants on our platform in connection with order fulfillment and service delivery.
• From payment processors. Transaction data and verification information from third-party payment service providers.
• From analytics providers. Usage data and behavioral insights from third-party analytics services that help us understand how consumers use our platform.

4. Business Purposes for Collection

We use the personal information we collect for one or more of the following business purposes:

• Fulfilling orders. Processing, managing, and completing food orders placed through our platform, including coordinating with restaurant partners and delivery providers.
• Account management. Creating and maintaining your account, managing preferences, and providing personalized experiences.
• Payment processing. Processing payments, refunds, and credits for orders placed through the platform.
• Customer support. Responding to inquiries, resolving disputes, and providing technical assistance.
• Marketing and promotions. Sending promotional communications, personalized offers, and platform updates where you have opted in or where permitted by law.
• Analytics and improvement. Analyzing usage trends, measuring the effectiveness of our services, and improving platform functionality.
• Fraud prevention and security. Detecting, investigating, and preventing fraudulent transactions and unauthorized access to accounts.
• Legal compliance. Complying with applicable laws, regulations, legal processes, and enforceable governmental requests.

5. Sharing and Disclosure

We may disclose your personal information to the following categories of third parties for a business purpose:

• Restaurant partners. To fulfill and deliver your orders, restaurants receive your name, delivery address, order details, and contact information as necessary.
• Payment processors. To securely process transactions associated with your orders.
• Analytics providers. To help us analyze platform usage and improve our services.
• Delivery service providers. To coordinate and complete the delivery of your orders.
• Legal and regulatory authorities. When required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Your California Privacy Rights

As a California resident, you have the following rights under the CCPA/CPRA:

Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which your personal information was collected, the business or commercial purpose for collecting or selling your personal information, and the categories of third parties with whom we share your personal information.

Right to Delete

You have the right to request that we delete any personal information we have collected from you, subject to certain exceptions provided by law. We may deny your deletion request if retaining the information is necessary for us or our service providers to complete a transaction, detect security incidents, comply with legal obligations, or exercise other lawful uses.

Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of processing.

Right to Opt-Out of Sale/Sharing

You have the right to direct us not to sell or share your personal information to third parties. While Menu does not sell personal information for monetary consideration, to the extent any data sharing activities constitute a "sale" or "sharing" under California law, you may opt out by contacting us as described below.

Right to Limit Use of Sensitive Personal Information

You have the right to limit our use and disclosure of your sensitive personal information to uses that are necessary to perform the services or provide the goods you request, or as otherwise permitted by law.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. Unless permitted by law, we will not deny you goods or services, charge you different prices or rates, provide you a different level or quality of goods or services, or suggest that you may receive a different price or rate or different level or quality of goods or services.

7. How to Exercise Your Rights

You may submit a verifiable consumer request to exercise your rights through any of the following methods:

• Email. Send your request to privacy@menu.com.
• Account settings. Manage your privacy preferences directly through the privacy settings in your Menu account.
• Toll-free number. Call us at 1-800-MENU-PRIV (1-800-636-8774) to speak with a privacy specialist.

8. Authorized Agents

You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the authorized agent with written permission signed by you, or provide a valid power of attorney under the California Probate Code. We may still require you to directly verify your own identity and confirm that you provided the authorized agent permission to submit the request.

9. Data Retention

We retain your personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Order data. Retained for 7 years to comply with tax, accounting, and legal compliance requirements.
• Account data. Retained for the duration of your account. Upon receipt of a verified deletion request, account data will be deleted within 30 days, except where retention is required by law.
• Analytics data. Aggregated and de-identified analytics data may be retained indefinitely for statistical and business improvement purposes.

10. Changes to This Notice

We reserve the right to amend this California Privacy Notice at our discretion and at any time. When we make material changes to this notice, we will notify you by email (sent to the email address specified in your account) and update the "Last Updated" date at the top of this page. Your continued use of our platform after such modifications constitutes your acknowledgment of the modified notice.

11. Contact Us

If you have any questions or comments about this California Privacy Notice, your privacy rights, the ways in which we collect and use your personal information, or your choices and rights regarding such use, please do not hesitate to contact us.