Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email, phone number, delivery addresses, payment information, and dietary preferences. We also collect usage data including browsing history, order history, and device information.

2. How We Use Your Information

We use your information to:

• Process and deliver your orders
• Communicate order status and updates
• Improve our platform and services
• Personalize your shopping experience
• Comply with legal obligations
• Prevent fraud and ensure platform safety

3. Information Sharing

We share your delivery address and order details with Vendors and delivery drivers to fulfill orders. We do not sell your personal information to third parties. We may share data with service providers (payment processors, analytics) who assist in operating our platform.

3.1 Service Providers (Subprocessors)

The providers involved depend on the enabled features and your choices in the app. The list below describes their functions and the data involved.

• Stripe, Inc. — payment processing, Stripe Connect partner payouts, Stripe Identity ID verification. Stripe holds card data + government-ID images directly; FreshCut never stores either. See Stripe's privacy notice.
• Twilio, Inc. — SMS one-time codes + masked driver-customer calling.
• SendGrid / Resend — transactional email (order confirmations, ID-verification status, password reset).
• Cloudinary — image and video storage for shop logos, product photos, and delivery proof (photos, signatures and short videos, which may include sound).
• Upstash Redis — rate limiting + background-job queue.
• Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM) — when native push is configured and you enable notifications, the applicable provider receives your device push token, generic alert text, recipient account identifier, notification type and in-app destination. FreshCut associates the push token with your account to send updates and route notification taps.
• PostHog and Google Analytics 4 — when configured, product analytics runs after analytics consent, subject to your account sharing preference and privacy opt-out. Events may include account identifiers, role, searches and interactions. The login analytics payload does not include your email address.
• Sentry — when configured, diagnostic reporting operates separately from analytics consent. Reports may include your account identifier and role to investigate errors. The browser event filter removes email, username and IP-address fields from the user context; diagnostics should not be treated as anonymous.
• Anthropic — review-moderation, support-triage, and the /assistant ordering-chat LLM calls (chat messages and locale; no order totals or payment data are ever transmitted).
• Google LLC / komoot GmbH (Germany) — address autocomplete. Suggestions come from Google Places when configured, otherwise from komoot's Photon geocoder (OpenStreetMap): only the partial address text you type is sent, server-proxied, with no account identifiers attached.

3.2 Age & ID Verification (cannabis / tobacco / vape)

If you purchase age-restricted products (cannabis, tobacco, vape), we verify your age in three stages: (1) you self-attest your date of birth on the age-gate modal, (2) you complete a government-ID + selfie verification via Stripe Identity, and (3) your driver visually inspects your physical ID at delivery. Stripe Identity holds the ID images directly; FreshCut never sees them and never stores them. We retain only the extracted fact of verification (status, method, expiration date, and the DOB extracted from your ID) under the audit-trail obligations imposed by NY Cannabis Law §125, FDA Tobacco 21 Act, PACT Act §376a, and NY DCWP record-keeping rules.

3.3 Delivery Verification & Proof of Delivery

To protect you and the driver, a delivery is confirmed at the handoff. For delivery orders we give you a 4-digit PIN on your order page; the driver confirms the delivery with that PIN, or with a photo, a short video or your signature instead. The proof is stored with the order, shown to you, the store and FreshCut support, and used to resolve delivery disputes. A video may include sound from the handoff; it is recorded only when the driver chooses to record one and the microphone is not used at any other time. Drivers' devices are never used to listen in the background.

When a driver marks an order picked up or delivered, the driver's current location is checked against the store or delivery address, and the distance is recorded in the order audit trail. The driver's position while a delivery is active is shown to you on the order tracking page so you can see where your order is and when it will arrive.

4. Data Security

We implement industry-standard security measures including encryption, secure servers, and access controls to protect your data. Payment information is processed through PCI-compliant payment processors and is never stored on our servers.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time by contacting support.

Age & ID verification records: where you have purchased an age-restricted product (cannabis, tobacco, or vape), we are required by NY DCWP, NY OCM, and the FDA to retain audit records — date of birth, verification method, verification timestamp, and driver-side ID-check details (excluding any full ID number) — for seven (7) years from the date of verification. After that, the records are permanently deleted. This retention obligation overrides general account-deletion requests for these specific records only; the rest of your account data is deleted on request as described above.

6. Your Rights

You have the right to access, correct, or delete your personal information. You can update your data sharing preferences in your profile settings. For data deletion requests, contact privacy@freshcut.nyc.

6.1 DCWP Data Sharing Opt-Out (NYC §20-846)

Under New York City Department of Consumer and Worker Protection rules, you have the right to prohibit FreshCut NYC from sharing your personally identifiable information with third-party delivery workers and store partners beyond what is strictly necessary to fulfill your order. You can toggle this setting in your profile under "Privacy & Data Sharing". When opted out, only your delivery address and order contents are shared with the fulfilling vendor — your name and phone number are masked behind a Twilio proxy line.

6.2 NY SHIELD Act Compliance

FreshCut NYC complies with the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act. We maintain reasonable administrative, technical, and physical safeguards for your personal information. In the event of a data breach affecting New York residents, we will notify affected users and the NY Attorney General within the timeframes required by law.

6.3 California Consumer Privacy Act (CCPA)

If you are a California resident, you have the right to: (a) know what personal information we collect about you; (b) request deletion of your personal information; (c) opt-out of the “sale” or “sharing” of your personal information. FreshCut NYC does not sell personal information. To exercise your rights, email privacy@freshcut.nyc or use the “Delete Account” option in your profile settings. We will respond within 45 days as required by law.

6.4 General Data Protection Regulation (GDPR)

Where the GDPR applies to our processing of your personal data, you have rights of access, correction, erasure, restriction, portability and objection, subject to the applicable conditions. For privacy questions or requests, contact privacy@freshcut.nyc. You may also lodge a complaint with a competent data protection supervisory authority, particularly in the EU/EEA country where you normally live, work or believe an infringement occurred. You can find authority contact details in the European Data Protection Board directory.

6.5 Children's Privacy

FreshCut NYC is not directed to children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If we learn we have collected personal information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, contact privacy@freshcut.nyc.

7. Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand platform usage. You can control cookie preferences through your browser settings.

8. Contact

For privacy-related questions or requests, contact us at privacy@freshcut.nyc.