Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email, phone number, delivery addresses, payment information, and dietary preferences. We also collect usage data including browsing history, order history, and device information.

2. How We Use Your Information

We use your information to:

• Process and deliver your orders
• Communicate order status and updates
• Improve our platform and services
• Personalize your shopping experience
• Comply with legal obligations
• Prevent fraud and ensure platform safety

3. Information Sharing

We share your delivery address and order details with Vendors and delivery drivers to fulfill orders. We do not sell your personal information to third parties. We may share data with service providers (payment processors, analytics) who assist in operating our platform.

3.1 Service Providers (Subprocessors)

We use the following subprocessors to operate the platform. Each one receives only the minimum data necessary for their function and is bound by a data-processing agreement equivalent to or stricter than this policy.

• Stripe, Inc. — payment processing, Stripe Connect partner payouts, Stripe Identity ID verification. Stripe holds card data + government-ID images directly; FreshCut never stores either. See Stripe's privacy notice.
• Twilio, Inc. — SMS one-time codes + masked driver-customer calling.
• SendGrid / Resend — transactional email (order confirmations, ID-verification status, password reset).
• Cloudinary — image storage for shop logos, product photos, delivery proof.
• Upstash Redis — rate limiting + background-job queue.
• Sentry, PostHog, Google Analytics 4 — error reporting + product analytics (consent-gated).
• Anthropic — review-moderation + support-triage LLM calls (no order-level PII transmitted).
• Google LLC / komoot GmbH (Germany) — address autocomplete. Suggestions come from Google Places when configured, otherwise from komoot's Photon geocoder (OpenStreetMap): only the partial address text you type is sent, server-proxied, with no account identifiers attached.

3.2 Age & ID Verification (cannabis / tobacco / vape)

If you purchase age-restricted products (cannabis, tobacco, vape), we verify your age in three stages: (1) you self-attest your date of birth on the age-gate modal, (2) you complete a government-ID + selfie verification via Stripe Identity, and (3) your driver visually inspects your physical ID at delivery. Stripe Identity holds the ID images directly; FreshCut never sees them and never stores them. We retain only the extracted fact of verification (status, method, expiration date, and the DOB extracted from your ID) under the audit-trail obligations imposed by NY Cannabis Law §125, FDA Tobacco 21 Act, PACT Act §376a, and NY DCWP record-keeping rules.

4. Data Security

We implement industry-standard security measures including encryption, secure servers, and access controls to protect your data. Payment information is processed through PCI-compliant payment processors and is never stored on our servers.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time by contacting support.

Age & ID verification records: where you have purchased an age-restricted product (cannabis, tobacco, or vape), we are required by NY DCWP, NY OCM, and the FDA to retain audit records — date of birth, verification method, verification timestamp, and driver-side ID-check details (excluding any full ID number) — for seven (7) years from the date of verification. After that, the records are permanently deleted. This retention obligation overrides general account-deletion requests for these specific records only; the rest of your account data is deleted on request as described above.

6. Your Rights

You have the right to access, correct, or delete your personal information. You can update your data sharing preferences in your profile settings. For data deletion requests, contact privacy@freshcut.nyc.

6.1 DCWP Data Sharing Opt-Out (NYC §20-846)

Under New York City Department of Consumer and Worker Protection rules, you have the right to prohibit FreshCut NYC from sharing your personally identifiable information with third-party delivery workers and store partners beyond what is strictly necessary to fulfill your order. You can toggle this setting in your profile under "Privacy & Data Sharing". When opted out, only your delivery address and order contents are shared with the fulfilling vendor — your name and phone number are masked behind a Twilio proxy line.

6.2 NY SHIELD Act Compliance

FreshCut NYC complies with the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act. We maintain reasonable administrative, technical, and physical safeguards for your personal information. In the event of a data breach affecting New York residents, we will notify affected users and the NY Attorney General within the timeframes required by law.

6.3 California Consumer Privacy Act (CCPA)

If you are a California resident, you have the right to: (a) know what personal information we collect about you; (b) request deletion of your personal information; (c) opt-out of the “sale” or “sharing” of your personal information. FreshCut NYC does not sell personal information. To exercise your rights, email privacy@freshcut.nyc or use the “Delete Account” option in your profile settings. We will respond within 45 days as required by law.

6.4 General Data Protection Regulation (GDPR)

If you access FreshCut NYC from the European Economic Area, your personal data is processed under GDPR. Your legal basis for processing is contractual necessity (to fulfill orders) and legitimate interest (to improve the platform). You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. Contact our Data Protection Officer at privacy@freshcut.nyc. Our supervisory authority is the New York Attorney General's office for cross-border complaints.

6.5 Children's Privacy

FreshCut NYC is not directed to children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If we learn we have collected personal information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, contact privacy@freshcut.nyc.

7. Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand platform usage. You can control cookie preferences through your browser settings.

8. Contact

For privacy-related questions or requests, contact us at privacy@freshcut.nyc.